diff --git a/tests/_data/snapshots/plain_alternative-package-registry.json.bin b/tests/_data/snapshots/plain_alternative-package-registry.json.bin
index 88520511..a48a796d 100644
--- a/tests/_data/snapshots/plain_alternative-package-registry.json.bin
+++ b/tests/_data/snapshots/plain_alternative-package-registry.json.bin
@@ -45,7 +45,7 @@
       "name": "demo-alternative-package-registry",
       "version": "0.0.0",
       "bom-ref": "demo-alternative-package-registry@workspace:.",
-      "description": "demo: alternative-package-registry -- showcase how lternative package registrier affect the result",
+      "description": "demo: alternative-package-registry -- showcase how alternative package registries affect the result",
       "licenses": [
         {
           "license": {
@@ -70,8 +70,12 @@
       "group": "@jsr",
       "version": "0.1.3",
       "bom-ref": "@jsr/act__act@npm:0.1.3::__archiveUrl=https%3A%2F%2Fnpm.jsr.io%2F~%2F11%2F%40jsr%2Fact__act%2F0.1.3.tgz",
-      "purl": "pkg:npm/%40jsr/act__act@0.1.3",
+      "purl": "pkg:npm/%40jsr/act__act@0.1.3?download_url=https%3A//npm.jsr.io/~/11/%40jsr/act__act/0.1.3.tgz",
       "externalReferences": [
+        {
+          "url": "https://npm.jsr.io/~/11/@jsr/act__act/0.1.3.tgz",
+          "type": "distribution"
+        },
         {
           "url": "https://jsr.io/@act/act",
           "type": "website",
diff --git a/tests/_data/snapshots/plain_alternative-package-registry.xml.bin b/tests/_data/snapshots/plain_alternative-package-registry.xml.bin
index 4cdfa95a..03aa45fc 100644
--- a/tests/_data/snapshots/plain_alternative-package-registry.xml.bin
+++ b/tests/_data/snapshots/plain_alternative-package-registry.xml.bin
@@ -36,7 +36,7 @@
     <component type="application" bom-ref="demo-alternative-package-registry@workspace:.">
       <name>demo-alternative-package-registry</name>
       <version>0.0.0</version>
-      <description>demo: alternative-package-registry -- showcase how lternative package registrier affect the result</description>
+      <description>demo: alternative-package-registry -- showcase how alternative package registries affect the result</description>
       <licenses>
         <license acknowledgement="declared">
           <id>Apache-2.0</id>
@@ -53,8 +53,11 @@
       <group>@jsr</group>
       <name>act__act</name>
       <version>0.1.3</version>
-      <purl>pkg:npm/%40jsr/act__act@0.1.3</purl>
+      <purl>pkg:npm/%40jsr/act__act@0.1.3?download_url=https%3A//npm.jsr.io/~/11/%40jsr/act__act/0.1.3.tgz</purl>
       <externalReferences>
+        <reference type="distribution">
+          <url>https://npm.jsr.io/~/11/@jsr/act__act/0.1.3.tgz</url>
+        </reference>
         <reference type="website">
           <url>https://jsr.io/@act/act</url>
           <comment>as detected from PackageJson property "homepage"</comment>
diff --git a/tests/_data/snapshots/plain_git-protocol-dependency.json.bin b/tests/_data/snapshots/plain_git-protocol-dependency.json.bin
index 064bbc8b..9f7de995 100644
--- a/tests/_data/snapshots/plain_git-protocol-dependency.json.bin
+++ b/tests/_data/snapshots/plain_git-protocol-dependency.json.bin
@@ -80,8 +80,12 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40cyclonedx/cyclonedx-library@6.4.2?vcs_url=git%2Bhttps%3A//github.com/CycloneDX/cyclonedx-javascript-library.git",
+      "purl": "pkg:npm/%40cyclonedx/cyclonedx-library@6.4.2?download_url=https%3A//github.com/CycloneDX/cyclonedx-javascript-library.git%23commit%3Da4a74012c163b44ffd25bc6146fc7f59aa7e33e7",
       "externalReferences": [
+        {
+          "url": "https://github.com/CycloneDX/cyclonedx-javascript-library.git#commit=a4a74012c163b44ffd25bc6146fc7f59aa7e33e7",
+          "type": "distribution"
+        },
         {
           "url": "https://github.com/CycloneDX/cyclonedx-javascript-library/issues",
           "type": "issue-tracker",
diff --git a/tests/_data/snapshots/plain_git-protocol-dependency.xml.bin b/tests/_data/snapshots/plain_git-protocol-dependency.xml.bin
index 89a6372b..2733009e 100644
--- a/tests/_data/snapshots/plain_git-protocol-dependency.xml.bin
+++ b/tests/_data/snapshots/plain_git-protocol-dependency.xml.bin
@@ -60,8 +60,11 @@
           <id>Apache-2.0</id>
         </license>
       </licenses>
-      <purl>pkg:npm/%40cyclonedx/cyclonedx-library@6.4.2?vcs_url=git%2Bhttps%3A//github.com/CycloneDX/cyclonedx-javascript-library.git</purl>
+      <purl>pkg:npm/%40cyclonedx/cyclonedx-library@6.4.2?download_url=https%3A//github.com/CycloneDX/cyclonedx-javascript-library.git%23commit%3Da4a74012c163b44ffd25bc6146fc7f59aa7e33e7</purl>
       <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/CycloneDX/cyclonedx-javascript-library.git#commit=a4a74012c163b44ffd25bc6146fc7f59aa7e33e7</url>
+        </reference>
         <reference type="issue-tracker">
           <url>https://github.com/CycloneDX/cyclonedx-javascript-library/issues</url>
           <comment>as detected from PackageJson property "bugs.url"</comment>
diff --git a/tests/_data/snapshots/plain_github-protocol-dependency.json.bin b/tests/_data/snapshots/plain_github-protocol-dependency.json.bin
index 633abc63..a01eb0ff 100644
--- a/tests/_data/snapshots/plain_github-protocol-dependency.json.bin
+++ b/tests/_data/snapshots/plain_github-protocol-dependency.json.bin
@@ -80,8 +80,12 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40cyclonedx/cyclonedx-library@6.4.2?vcs_url=git%2Bhttps%3A//github.com/CycloneDX/cyclonedx-javascript-library.git",
+      "purl": "pkg:npm/%40cyclonedx/cyclonedx-library@6.4.2?download_url=https%3A//github.com/CycloneDX/cyclonedx-javascript-library.git%23commit%3Da4a74012c163b44ffd25bc6146fc7f59aa7e33e7",
       "externalReferences": [
+        {
+          "url": "https://github.com/CycloneDX/cyclonedx-javascript-library.git#commit=a4a74012c163b44ffd25bc6146fc7f59aa7e33e7",
+          "type": "distribution"
+        },
         {
           "url": "https://github.com/CycloneDX/cyclonedx-javascript-library/issues",
           "type": "issue-tracker",
diff --git a/tests/_data/snapshots/plain_github-protocol-dependency.xml.bin b/tests/_data/snapshots/plain_github-protocol-dependency.xml.bin
index 0c336f67..b19a1a4d 100644
--- a/tests/_data/snapshots/plain_github-protocol-dependency.xml.bin
+++ b/tests/_data/snapshots/plain_github-protocol-dependency.xml.bin
@@ -60,8 +60,11 @@
           <id>Apache-2.0</id>
         </license>
       </licenses>
-      <purl>pkg:npm/%40cyclonedx/cyclonedx-library@6.4.2?vcs_url=git%2Bhttps%3A//github.com/CycloneDX/cyclonedx-javascript-library.git</purl>
+      <purl>pkg:npm/%40cyclonedx/cyclonedx-library@6.4.2?download_url=https%3A//github.com/CycloneDX/cyclonedx-javascript-library.git%23commit%3Da4a74012c163b44ffd25bc6146fc7f59aa7e33e7</purl>
       <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/CycloneDX/cyclonedx-javascript-library.git#commit=a4a74012c163b44ffd25bc6146fc7f59aa7e33e7</url>
+        </reference>
         <reference type="issue-tracker">
           <url>https://github.com/CycloneDX/cyclonedx-javascript-library/issues</url>
           <comment>as detected from PackageJson property "bugs.url"</comment>
diff --git a/tests/_data/snapshots/short-PURLs_alternative-package-registry.json.bin b/tests/_data/snapshots/short-PURLs_alternative-package-registry.json.bin
index 88520511..ec2b86aa 100644
--- a/tests/_data/snapshots/short-PURLs_alternative-package-registry.json.bin
+++ b/tests/_data/snapshots/short-PURLs_alternative-package-registry.json.bin
@@ -45,7 +45,7 @@
       "name": "demo-alternative-package-registry",
       "version": "0.0.0",
       "bom-ref": "demo-alternative-package-registry@workspace:.",
-      "description": "demo: alternative-package-registry -- showcase how lternative package registrier affect the result",
+      "description": "demo: alternative-package-registry -- showcase how alternative package registries affect the result",
       "licenses": [
         {
           "license": {
@@ -72,6 +72,10 @@
       "bom-ref": "@jsr/act__act@npm:0.1.3::__archiveUrl=https%3A%2F%2Fnpm.jsr.io%2F~%2F11%2F%40jsr%2Fact__act%2F0.1.3.tgz",
       "purl": "pkg:npm/%40jsr/act__act@0.1.3",
       "externalReferences": [
+        {
+          "url": "https://npm.jsr.io/~/11/@jsr/act__act/0.1.3.tgz",
+          "type": "distribution"
+        },
         {
           "url": "https://jsr.io/@act/act",
           "type": "website",
diff --git a/tests/_data/snapshots/short-PURLs_alternative-package-registry.xml.bin b/tests/_data/snapshots/short-PURLs_alternative-package-registry.xml.bin
index 4cdfa95a..846e8041 100644
--- a/tests/_data/snapshots/short-PURLs_alternative-package-registry.xml.bin
+++ b/tests/_data/snapshots/short-PURLs_alternative-package-registry.xml.bin
@@ -36,7 +36,7 @@
     <component type="application" bom-ref="demo-alternative-package-registry@workspace:.">
       <name>demo-alternative-package-registry</name>
       <version>0.0.0</version>
-      <description>demo: alternative-package-registry -- showcase how lternative package registrier affect the result</description>
+      <description>demo: alternative-package-registry -- showcase how alternative package registries affect the result</description>
       <licenses>
         <license acknowledgement="declared">
           <id>Apache-2.0</id>
@@ -55,6 +55,9 @@
       <version>0.1.3</version>
       <purl>pkg:npm/%40jsr/act__act@0.1.3</purl>
       <externalReferences>
+        <reference type="distribution">
+          <url>https://npm.jsr.io/~/11/@jsr/act__act/0.1.3.tgz</url>
+        </reference>
         <reference type="website">
           <url>https://jsr.io/@act/act</url>
           <comment>as detected from PackageJson property "homepage"</comment>
diff --git a/tests/integration/index.test.js b/tests/integration/index.test.js
index 800526ca..b4090413 100644
--- a/tests/integration/index.test.js
+++ b/tests/integration/index.test.js
@@ -43,8 +43,8 @@ const {
 
 const testSetups = [
   /* region functional tests */
-  'alternative-package-registry'
-/*  'bundled-dependencies',
+  'alternative-package-registry',
+  'bundled-dependencies',
   'concurrent-versions',
   'dev-dependencies',
   'git-protocol-dependency',