CMake: Use the $<VERSION> placeholder in qt_attribution.json

For all CPE and PURL fields where it makes sense, to avoid
duplication.

Pick-to: 6.8 6.9
Task-number: QTBUG-132181
Change-Id: Icd1c5267e4e9b582eea28150ebd1b2cca3852229
Reviewed-by: Joerg Bornemann <[email protected]>

27 files changed, 41 insertions, 41 deletions

diff --git a/src/3rdparty/D3D12MemoryAllocator/qt_attribution.json b/src/3rdparty/D3D12MemoryAllocator/qt_attribution.json
index 17670602dc1..48cd78e7496 100644
--- a/src/3rdparty/D3D12MemoryAllocator/qt_attribution.json
+++ b/src/3rdparty/D3D12MemoryAllocator/qt_attribution.json
@@ -8,7 +8,7 @@
 
         "Homepage": "https://github.com/GPUOpen-LibrariesAndSDKs/D3D12MemoryAllocator",
         "Version": "f128d39b7a95b4235bd228d231646278dc6c24b2",
-        "PURL": "pkg:github/GPUOpen-LibrariesAndSDKs/D3D12MemoryAllocator@f128d39b7a95b4235bd228d231646278dc6c24b2",
+        "PURL": "pkg:github/GPUOpen-LibrariesAndSDKs/D3D12MemoryAllocator@$<VERSION>",
         "License": "MIT License",
         "LicenseId": "MIT",
         "LicenseFile": "LICENSE.txt",
diff --git a/src/3rdparty/VulkanMemoryAllocator/qt_attribution.json b/src/3rdparty/VulkanMemoryAllocator/qt_attribution.json
index e4b99776b21..75f677ae328 100644
--- a/src/3rdparty/VulkanMemoryAllocator/qt_attribution.json
+++ b/src/3rdparty/VulkanMemoryAllocator/qt_attribution.json
@@ -8,7 +8,7 @@
 
         "Homepage": "https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator",
         "Version": "3.1.0",
-        "PURL": "pkg:github/GPUOpen-LibrariesAndSDKs/[email protected]",
+        "PURL": "pkg:github/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator@v$<VERSION>",
         "License": "MIT License",
         "LicenseId": "MIT",
         "LicenseFile": "LICENSE.txt",
diff --git a/src/3rdparty/blake2/qt_attribution.json b/src/3rdparty/blake2/qt_attribution.json
index 99302219390..8b14922f2e6 100644
--- a/src/3rdparty/blake2/qt_attribution.json
+++ b/src/3rdparty/blake2/qt_attribution.json
@@ -9,7 +9,7 @@
     "Homepage": "https://blake2.net/",
     "Version": "ed1974ea83433eba7b2d95c5dcd9ac33cb847913",
     "DownloadLocation": "https://github.com/BLAKE2/BLAKE2/tree/ed1974ea83433eba7b2d95c5dcd9ac33cb847913",
-    "PURL": "pkg:github/BLAKE2/BLAKE2@ed1974ea83433eba7b2d95c5dcd9ac33cb847913",
+    "PURL": "pkg:github/BLAKE2/BLAKE2@$<VERSION>",
     "CPE": "cpe:2.3:a:blake2:blake2:*:*:*:*:*:*:*:*",
     "License": "Creative Commons Zero v1.0 Universal or Apache License 2.0",
     "LicenseId": "CC0-1.0 OR Apache-2.0",
diff --git a/src/3rdparty/double-conversion/qt_attribution.json b/src/3rdparty/double-conversion/qt_attribution.json
index c374d5ac4bc..df4770561bf 100644
--- a/src/3rdparty/double-conversion/qt_attribution.json
+++ b/src/3rdparty/double-conversion/qt_attribution.json
@@ -7,8 +7,8 @@
     "Homepage": "https://github.com/google/double-conversion",
     "Version": "3.3.0",
     "DownloadLocation": "https://github.com/google/double-conversion/releases/tag/v3.3.0",
-    "PURL": "pkg:github/google/[email protected]",
-    "CPE": "cpe:2.3:a:google:double-conversion:3.3.0:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/google/double-conversion@v$<VERSION>",
+    "CPE": "cpe:2.3:a:google:double-conversion:$<VERSION>:*:*:*:*:*:*:*",
     "License": "BSD 3-clause \"New\" or \"Revised\" License",
     "LicenseId": "BSD-3-Clause",
     "LicenseFile": "LICENSE",
diff --git a/src/3rdparty/freetype/qt_attribution.json b/src/3rdparty/freetype/qt_attribution.json
index 26c7137251f..93fbb9f0520 100644
--- a/src/3rdparty/freetype/qt_attribution.json
+++ b/src/3rdparty/freetype/qt_attribution.json
@@ -11,10 +11,10 @@
         "Version": "2.13.3",
         "DownloadLocation": "https://download.savannah.gnu.org/releases/freetype/freetype-2.13.3.tar.gz",
         "PURL": [
-            "pkg:github/freetype/freetype@VER-2-13-3"
+            "pkg:github/freetype/freetype@VER-$<VERSION_DASHED>"
         ],
         "CPE": [
-            "cpe:2.3:a:freetype:freetype:2.13:3:*:*:*:*:*:*"
+            "cpe:2.3:a:freetype:freetype:$<VERSION>:*:*:*:*:*:*:*"
         ],
 
         "License": "Freetype Project License or GNU General Public License v2.0 only",
diff --git a/src/3rdparty/gradle/qt_attribution.json b/src/3rdparty/gradle/qt_attribution.json
index 7c102945bed..599912a1945 100644
--- a/src/3rdparty/gradle/qt_attribution.json
+++ b/src/3rdparty/gradle/qt_attribution.json
@@ -6,8 +6,8 @@
     "Homepage": "https://gradle.org",
     "Version": "8.10",
     "DownloadLocation": "https://github.com/gradle/gradle/releases/tag/v8.10.0",
-    "PURL": "pkg:github/gradle/[email protected]",
-    "CPE": "cpe:2.3:a:gradle:gradle:8.10.0:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/gradle/gradle@v$<VERSION>",
+    "CPE": "cpe:2.3:a:gradle:gradle:$<VERSION>:*:*:*:*:*:*:*",
     "QtUsage": "Needed to create Android packages",
     "License": "Apache License 2.0",
     "LicenseId": "Apache-2.0",
diff --git a/src/3rdparty/harfbuzz-ng/qt_attribution.json b/src/3rdparty/harfbuzz-ng/qt_attribution.json
index 82f133443be..3a5b5943c67 100644
--- a/src/3rdparty/harfbuzz-ng/qt_attribution.json
+++ b/src/3rdparty/harfbuzz-ng/qt_attribution.json
@@ -9,8 +9,8 @@
     "Homepage": "http://harfbuzz.org",
     "Version": "10.1.0",
     "DownloadLocation": "https://github.com/harfbuzz/harfbuzz/releases/tag/10.1.0",
-    "PURL": "pkg:github/harfbuzz/[email protected]",
-    "CPE": "cpe:2.3:a:harfbuzz_project:harfbuzz:10.1.0:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/harfbuzz/harfbuzz@$<VERSION>",
+    "CPE": "cpe:2.3:a:harfbuzz_project:harfbuzz:$<VERSION>:*:*:*:*:*:*:*",
     "License": "MIT License",
     "LicenseId": "MIT",
     "LicenseFile": "COPYING",
diff --git a/src/3rdparty/libjpeg/qt_attribution.json b/src/3rdparty/libjpeg/qt_attribution.json
index cef5703bc15..af7b3d411b4 100644
--- a/src/3rdparty/libjpeg/qt_attribution.json
+++ b/src/3rdparty/libjpeg/qt_attribution.json
@@ -9,8 +9,8 @@
     "Homepage": "http://libjpeg-turbo.virtualgl.org/",
     "Version": "3.1.0",
     "DownloadLocation": "https://github.com/libjpeg-turbo/libjpeg-turbo/releases/download/3.1.0/libjpeg-turbo-3.1.0.tar.gz",
-    "PURL": "pkg:github/libjpeg-turbo/[email protected]",
-    "CPE": "cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:3.1.0:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/libjpeg-turbo/libjpeg-turbo@$<VERSION>",
+    "CPE": "cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:$<VERSION>:*:*:*:*:*:*:*",
 
     "License": "Independent JPEG Group License and BSD 3-Clause \"New\" or \"Revised\" License",
     "LicenseId": "IJG AND BSD-3-Clause",
diff --git a/src/3rdparty/libpng/qt_attribution.json b/src/3rdparty/libpng/qt_attribution.json
index 6d9995381ce..ef6ed2a4341 100644
--- a/src/3rdparty/libpng/qt_attribution.json
+++ b/src/3rdparty/libpng/qt_attribution.json
@@ -9,8 +9,8 @@
     "Homepage": "http://www.libpng.org/pub/png/libpng.html",
     "Version": "1.6.44",
     "DownloadLocation": "https://download.sourceforge.net/libpng/libpng-1.6.44.tar.xz",
-    "PURL": "pkg:github/pnggroup/[email protected]",
-    "CPE": "cpe:2.3:a:libpng:libpng:1.6.44:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/pnggroup/libpng@v$<VERSION>",
+    "CPE": "cpe:2.3:a:libpng:libpng:$<VERSION>:*:*:*:*:*:*:*",
 
     "License": "libpng License and PNG Reference Library version 2",
     "LicenseId": "Libpng AND libpng-2.0",
diff --git a/src/3rdparty/libpsl/qt_attribution.json b/src/3rdparty/libpsl/qt_attribution.json
index 02d42edbc12..e69c2efb56b 100644
--- a/src/3rdparty/libpsl/qt_attribution.json
+++ b/src/3rdparty/libpsl/qt_attribution.json
@@ -39,7 +39,7 @@ supported by Qt (by the QNetworkCookieJar class).",
 to lookup entries in it.",
     "Homepage": "https://github.com/rockdaboot/libpsl",
     "Version": "664f3dc85259ec65e30248a61fa1c45b7b0e4c3f",
-    "PURL": "pkg:github/rockdaboot/libpsl@664f3dc85259ec65e30248a61fa1c45b7b0e4c3f",
+    "PURL": "pkg:github/rockdaboot/libpsl@$<VERSION>",
     "License": "BSD 3-clause \"New\" or \"Revised\" License",
     "LicenseFile": "src/LICENSE.chromium",
     "LicenseId": "BSD-3-Clause",
diff --git a/src/3rdparty/md4c/qt_attribution.json b/src/3rdparty/md4c/qt_attribution.json
index 59578e2eecf..2142413d098 100644
--- a/src/3rdparty/md4c/qt_attribution.json
+++ b/src/3rdparty/md4c/qt_attribution.json
@@ -12,7 +12,7 @@
     "LicenseFile": "LICENSE.md",
     "Version": "0.5.2",
     "DownloadLocation": "https://github.com/mity/md4c/releases/tag/release-0.5.2",
-    "PURL": "pkg:github/mity/[email protected]",
-    "CPE": "cpe:2.3:a:md4c_project:md4c:0.5.2:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/mity/md4c@release-$<VERSION>",
+    "CPE": "cpe:2.3:a:md4c_project:md4c:$<VERSION>:*:*:*:*:*:*:*",
     "Copyright": "Copyright © 2016-2024 Martin Mitáš"
 }
diff --git a/src/3rdparty/pcre2/qt_attribution.json b/src/3rdparty/pcre2/qt_attribution.json
index 9ac498650c3..086abf3e39b 100644
--- a/src/3rdparty/pcre2/qt_attribution.json
+++ b/src/3rdparty/pcre2/qt_attribution.json
@@ -10,8 +10,8 @@
     "Homepage": "http://www.pcre.org/",
     "Version": "10.44",
     "DownloadLocation": "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.44/pcre2-10.44.tar.bz2",
-    "PURL": "pkg:github/PCRE2Project/[email protected]",
-    "CPE": "cpe:2.3:a:pcre:pcre2:10.44:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/PCRE2Project/pcre2@pcre2-$<VERSION>",
+    "CPE": "cpe:2.3:a:pcre:pcre2:$<VERSION>:*:*:*:*:*:*:*",
     "License": "BSD 3-clause \"New\" or \"Revised\" License with PCRE2 binary-like Packages Exception",
     "LicenseId": "LicenseRef-BSD-3-Clause-with-PCRE2-Binary-Like-Packages-Exception",
     "LicenseFile": "LICENCE",
@@ -29,8 +29,8 @@
     "Homepage": "http://www.pcre.org/",
     "Version": "10.44",
     "DownloadLocation": "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.44/pcre2-10.44.tar.bz2",
-    "PURL": "pkg:github/PCRE2Project/[email protected]",
-    "CPE": "cpe:2.3:a:pcre:pcre2:10.44:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/PCRE2Project/pcre2@$<VERSION>",
+    "CPE": "cpe:2.3:a:pcre:pcre2:$<VERSION>:*:*:*:*:*:*:*",
     "License": "BSD 2-clause \"Simplified\" License",
     "LicenseId": "BSD-2-Clause",
     "LicenseFile": "LICENCE-SLJIT",
diff --git a/src/3rdparty/pixman/qt_attribution.json b/src/3rdparty/pixman/qt_attribution.json
index 8fe97b4199c..2a273f06811 100644
--- a/src/3rdparty/pixman/qt_attribution.json
+++ b/src/3rdparty/pixman/qt_attribution.json
@@ -7,7 +7,7 @@
     "Description": "pixman is a library that provides low-level pixel manipulation features such as image compositing and trapezoid rasterization.",
     "Homepage": "http://www.pixman.org/",
     "Version": "0.17.12",
-    "PURL": "pkg:generic/[email protected]?download_url=http://www.pixman.org/",
+    "PURL": "pkg:generic/pixman@$<VERSION>?download_url=http://www.pixman.org/",
     "License": "MIT License",
     "LicenseFile": "LICENSE",
     "LicenseId": "MIT",
diff --git a/src/3rdparty/sha3/qt_attribution.json b/src/3rdparty/sha3/qt_attribution.json
index c91e88affb6..ddb440cbdbd 100644
--- a/src/3rdparty/sha3/qt_attribution.json
+++ b/src/3rdparty/sha3/qt_attribution.json
@@ -9,7 +9,7 @@
 
         "Description": "SHA-3, originally known as Keccak, is a cryptographic hash function.",
         "Version": "4b9e13ead2c5b5e41ca27c65de4dd69ae0bac228",
-        "PURL": "pkg:github/BrianGladman/sha@4b9e13ead2c5b5e41ca27c65de4dd69ae0bac228",
+        "PURL": "pkg:github/BrianGladman/sha@$<VERSION>",
         "License": "BSD 2-clause \"Simplified\" License",
         "LicenseFile": "BRG_ENDIAN_LICENSE",
         "LicenseId": "BSD-2-Clause",
@@ -38,7 +38,7 @@
 
         "Description": "SHA-3, originally known as Keccak, is a cryptographic hash function.",
         "Version": "3.2",
-        "PURL": "pkg:generic/[email protected]?download_url=https://keccak.team/obsolete/KeccakReferenceAndOptimized-3.2.zip",
+        "PURL": "pkg:generic/sha3_keccak@$<VERSION>?download_url=https://keccak.team/obsolete/KeccakReferenceAndOptimized-3.2.zip",
         "License": "Creative Commons Zero v1.0 Universal",
         "LicenseId": "CC0-1.0",
         "LicenseFile": "CC0_LICENSE",
diff --git a/src/3rdparty/sqlite/qt_attribution.json b/src/3rdparty/sqlite/qt_attribution.json
index 6b26f7eb763..59888aeded6 100644
--- a/src/3rdparty/sqlite/qt_attribution.json
+++ b/src/3rdparty/sqlite/qt_attribution.json
@@ -8,8 +8,8 @@
     "Description": "SQLite is a small C library that implements a self-contained, embeddable, zero-configuration SQL database engine.",
     "Homepage": "https://www.sqlite.org/",
     "Version": "3.47.2",
-    "PURL": "pkg:github/sqlite/[email protected]",
-    "CPE": "cpe:2.3:a:sqlite:sqlite:3.47.2:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/sqlite/sqlite@version-$<VERSION>",
+    "CPE": "cpe:2.3:a:sqlite:sqlite:$<VERSION>:*:*:*:*:*:*:*",
     "DownloadLocation": "https://www.sqlite.org/2024/sqlite-amalgamation-3470200.zip",
     "License": "SQLite Blessing",
     "LicenseId": "blessing",
diff --git a/src/3rdparty/tinycbor/qt_attribution.json b/src/3rdparty/tinycbor/qt_attribution.json
index 9bebd487615..8458eefd513 100644
--- a/src/3rdparty/tinycbor/qt_attribution.json
+++ b/src/3rdparty/tinycbor/qt_attribution.json
@@ -11,8 +11,8 @@
     "LicenseId": "MIT",
     "LicenseFile": "LICENSE",
     "DownloadLocation": "https://github.com/intel/tinycbor/archive/v0.6.0/tinycbor-0.6.0.tar.gz",
-    "PURL": "pkg:github/intel/[email protected]",
-    "CPE": "cpe:2.3:a:tinycbor:tinycbor:0.6.0:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/intel/tinycbor@v$<VERSION>",
+    "CPE": "cpe:2.3:a:tinycbor:tinycbor:$<VERSION>:*:*:*:*:*:*:*",
     "Version": "0.6.0",
     "Copyright": "Copyright (C) 2015-2021 Intel Corporation"
 }
diff --git a/src/3rdparty/wasm/qt_attribution.json b/src/3rdparty/wasm/qt_attribution.json
index 7d5015eb9a1..4814d94cdf0 100644
--- a/src/3rdparty/wasm/qt_attribution.json
+++ b/src/3rdparty/wasm/qt_attribution.json
@@ -9,7 +9,7 @@
 
     "Homepage": "https://dejavu-fonts.github.io/",
     "Version": "2.37",
-    "PURL": "pkg:generic/[email protected]?download_url=https://dejavu-fonts.github.io/",
+    "PURL": "pkg:generic/dejayvu@$<VERSION>?download_url=https://dejavu-fonts.github.io/",
     "License": "Bitstream Vera Font License",
     "LicenseId": "Bitstream-Vera",
     "LicenseFile": "DEJAVU-LICENSE",
diff --git a/src/3rdparty/zlib/qt_attribution.json b/src/3rdparty/zlib/qt_attribution.json
index c4ed4de2ddd..f8d13d57d12 100644
--- a/src/3rdparty/zlib/qt_attribution.json
+++ b/src/3rdparty/zlib/qt_attribution.json
@@ -9,8 +9,8 @@
     "Homepage": "https://zlib.net/",
     "Version": "1.3.1",
     "DownloadLocation": "https://github.com/madler/zlib/releases/download/v1.3.1/zlib-1.3.1.tar.gz",
-    "PURL": "pkg:github/madler/[email protected]",
-    "CPE": "cpe:2.3:a:zlib:zlib:1.3.1:*:*:*:*:*:*:*",
+    "PURL": "pkg:github/madler/zlib@v$<VERSION>",
+    "CPE": "cpe:2.3:a:zlib:zlib:$<VERSION>:*:*:*:*:*:*:*",
 
     "License": "zlib License",
     "LicenseId": "Zlib",
diff --git a/src/corelib/mimetypes/3rdparty/qt_attribution.json b/src/corelib/mimetypes/3rdparty/qt_attribution.json
index bb9828595d6..c10bae6c8f2 100644
--- a/src/corelib/mimetypes/3rdparty/qt_attribution.json
+++ b/src/corelib/mimetypes/3rdparty/qt_attribution.json
@@ -19,7 +19,7 @@
         "Version": "5101bc7fb090ed7deffe56837d7633c9485a1e5d",
         "DownloadLocation":
                 "https://github.com/apache/tika/blob/5101bc7fb090ed7deffe56837d7633c9485a1e5d/tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml",
-        "PURL": "pkg:github/apache/tika@5101bc7fb090ed7deffe56837d7633c9485a1e5d#tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml",
+        "PURL": "pkg:github/apache/tika@$<VERSION>#tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml",
         "CPE": "cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*",
         "License": "Apache License 2.0",
         "LicenseId": "Apache-2.0",
diff --git a/src/dbus/qt_attribution.json b/src/dbus/qt_attribution.json
index ee565760f11..f97419942f4 100644
--- a/src/dbus/qt_attribution.json
+++ b/src/dbus/qt_attribution.json
@@ -8,7 +8,7 @@
     "Homepage": "https://www.freedesktop.org/wiki/Software/dbus/",
     "Version": "Minimal supported is 1.2, compatible up to ...",
     "Version": "dbus-1.13.12",
-    "PURL": "pkg:github/d-bus/[email protected]",
+    "PURL": "pkg:github/d-bus/dbus@dbus-$<VERSION>",
     "LicenseId": "AFL-2.1 OR GPL-2.0-or-later",
     "License": "Academic Free License v2.1, or GNU General Public License v2.0 or later",
     "LicenseFile": "LIBDBUS-1-LICENSE.txt",
diff --git a/src/gui/rhi/qt_attribution.json b/src/gui/rhi/qt_attribution.json
index 4e3a4ff3589..2a058d21b1e 100644
--- a/src/gui/rhi/qt_attribution.json
+++ b/src/gui/rhi/qt_attribution.json
@@ -9,7 +9,7 @@
 
         "Homepage": "https://github.com/microsoft/DirectX-Graphics-Samples",
         "Version": "0aa79bad78992da0b6a8279ddb9002c1753cb849",
-        "PURL": "pkg:github/microsoft/DirectX-Graphics-Samples@0aa79bad78992da0b6a8279ddb9002c1753cb849",
+        "PURL": "pkg:github/microsoft/DirectX-Graphics-Samples@$<VERSION>",
         "License": "MIT License",
         "LicenseId": "MIT",
         "LicenseFile": "MiniEngine_LICENSE.txt",
diff --git a/src/gui/text/qt_attribution.json b/src/gui/text/qt_attribution.json
index 822dbdb953b..20f83808f77 100644
--- a/src/gui/text/qt_attribution.json
+++ b/src/gui/text/qt_attribution.json
@@ -9,7 +9,7 @@
 
         "Homepage": "https://github.com/adobe-type-tools/agl-aglfn",
         "Version": "1.7",
-        "PURL": "pkg:github/adobe-type-tools/[email protected]",
+        "PURL": "pkg:github/adobe-type-tools/agl-aglfn@$<VERSION>",
         "License": "BSD 3-Clause \"New\" or \"Revised\" License",
         "LicenseId": "BSD-3-Clause",
         "LicenseFile": "AGLFN_LICENSE.txt",
diff --git a/src/gui/vulkan/qt_attribution.json b/src/gui/vulkan/qt_attribution.json
index 375fcdb10ce..61e9a3d44de 100644
--- a/src/gui/vulkan/qt_attribution.json
+++ b/src/gui/vulkan/qt_attribution.json
@@ -8,7 +8,7 @@
         "Files": "vk.xml",
 
         "Homepage": "https://www.khronos.org/",
-        "PURL": "pkg:github/KhronosGroup/[email protected]?download_url=https://github.com/KhronosGroup/Vulkan-Docs/blob/v1.3.223/xml/vk.xml",
+        "PURL": "pkg:github/KhronosGroup/Vulkan-Docs@v$<VERSION>?download_url=https://github.com/KhronosGroup/Vulkan-Docs/blob/v1.3.223/xml/vk.xml",
         "CPE": "cpe:2.3:a:khronos:vulkan:1.3.223:*:*:*:*:*:*:*",
         "Version": "1.3.223",
         "License": "Apache License 2.0 or MIT License",
diff --git a/src/testlib/3rdparty/catch2/qt_attribution.json b/src/testlib/3rdparty/catch2/qt_attribution.json
index 8bac8bc2bb8..1e4f2c5297c 100644
--- a/src/testlib/3rdparty/catch2/qt_attribution.json
+++ b/src/testlib/3rdparty/catch2/qt_attribution.json
@@ -14,7 +14,7 @@
         "Description": "Catch2 is a multi-paradigm test framework for C++.",
         "Homepage": "https://github.com/catchorg/Catch2",
         "Version": "2.13.10",
-        "PURL": "pkg:github/catchorg/[email protected]",
+        "PURL": "pkg:github/catchorg/Catch2@v$<VERSION>",
         "License": "Boost Software License 1.0",
         "LicenseId": "BSL-1.0",
         "LicenseFile": "LICENSE.txt",
diff --git a/src/testlib/3rdparty/cycle/qt_attribution.json b/src/testlib/3rdparty/cycle/qt_attribution.json
index dab1de85f60..4c8c67f4fef 100644
--- a/src/testlib/3rdparty/cycle/qt_attribution.json
+++ b/src/testlib/3rdparty/cycle/qt_attribution.json
@@ -20,7 +20,7 @@
         "Description": "Allows to access the CPU's cycle counters.",
         "Homepage": "http://fftw.org/",
         "Version": "3.3.10",
-        "PURL": "pkg:github/FFTW/[email protected]",
+        "PURL": "pkg:github/FFTW/fftw3@fftw-$<VERSION>",
         "License": "MIT License",
         "LicenseId": "MIT",
         "LicenseFile": "LICENSE.txt",
diff --git a/src/testlib/3rdparty/linux/qt_attribution.json b/src/testlib/3rdparty/linux/qt_attribution.json
index 8fbd0408c79..56b143189e5 100644
--- a/src/testlib/3rdparty/linux/qt_attribution.json
+++ b/src/testlib/3rdparty/linux/qt_attribution.json
@@ -19,7 +19,7 @@
         "Description": "Allows access to the Linux kernel's performance events.",
         "Homepage": "https://www.kernel.org",
         "Version": "6.0",
-        "PURL": "pkg:github/torvalds/[email protected]#include/uapi/linux/perf_event.h",
+        "PURL": "pkg:github/torvalds/linux@v$<VERSION>#include/uapi/linux/perf_event.h",
         "License": "GNU General Public License v2.0 only with Linux Syscall Note",
         "LicenseId": "GPL-2.0-only WITH Linux-syscall-note",
         "LicenseFile": "LICENSE.txt",
diff --git a/src/testlib/3rdparty/valgrind/qt_attribution.json b/src/testlib/3rdparty/valgrind/qt_attribution.json
index 8078274d690..e93a038b231 100644
--- a/src/testlib/3rdparty/valgrind/qt_attribution.json
+++ b/src/testlib/3rdparty/valgrind/qt_attribution.json
@@ -12,7 +12,7 @@
         "Description": "An instrumentation framework for building dynamic analysis tools.",
         "Homepage": "http://valgrind.org/",
         "Version": "3.23.0",
-        "PURL": "pkg:generic/[email protected]?download_url=https://valgrind.org/",
+        "PURL": "pkg:generic/valgrind@$<VERSION>?download_url=https://valgrind.org/",
         "License": "BSD 4-clause \"Original\" or \"Old\" License",
         "LicenseId": "BSD-4-Clause",
         "LicenseFile": "LICENSE.txt",