VEX without component version

[henschi]

Does anyone have any idea how I can reference a component with name and group but without version in a VEX file?
If I use the component values in the metadata section it works, but not as a component in the component section.

Why do I want this? I would like to have more than one component in a VEX file with its vulnerabilities. This is possible, but only for components with version information.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "timestamp": "2024-12-11T00:00:00Z"
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "component-ref",
      "group": "com.example",
      "name": "spring",
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-3203",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3203"
      },
      "analysis": {
        "state": "false_positive",
        "justification": "requires_dependency",
        "response": ["will_not_fix"],
        "detail": "Statement: false_positive - invalid cpe pattern matching"
      },
      "affects": [
        {
          "ref": "component-ref"
        }
      ]
    }
  ]
}