diff --git a/pyproject.toml b/pyproject.toml
index 5d0629d5..dc013637 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -69,7 +69,7 @@ cyclonedx-py = "cyclonedx_py._internal.cli:run"
 
 [tool.poetry.dependencies]
 python = "^3.8"
-cyclonedx-python-lib = { version = "^8.0", extras = ["validation"] }
+cyclonedx-python-lib = { version = "^8.0 || ^9.0", extras = ["validation"] }
 packageurl-python = ">=0.11, <2"  # keep in sync with same dep in `cyclonedx-python-lib`
 pip-requirements-parser = "^32.0"
 packaging = "^22 || ^23 || ^24"
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.0.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.0.xml.bin
index 4fcef9f6..dfe7d6c6 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.0.xml.bin
@@ -5,14 +5,14 @@
       <name>pathlib2</name>
       <version>2.3.5</version>
       <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <purl>pkg:pypi/pathlib2@2.3.5</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>pathlib2</name>
       <version>2.3.5</version>
       <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5</purl>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
       <modified>false</modified>
     </component>
     <component type="library">
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.1.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.1.xml.bin
index 0069c970..25030a94 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.1.xml.bin
@@ -1,18 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -29,6 +17,18 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.2.json.bin
index c7c3d4ee..fc41cb22 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.2.json.bin
@@ -1,20 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -35,6 +20,21 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.2.xml.bin
index b6e07290..97c7a261 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.2.xml.bin
@@ -20,18 +20,6 @@
     </component>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -48,6 +36,18 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.3.json.bin
index 8ef348b1..f1e54d62 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.3.json.bin
@@ -1,34 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:commit_id",
-          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:requested_revision",
-          "value": "2.3.5"
-        }
-      ],
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -67,6 +38,35 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:commit_id",
+          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:requested_revision",
+          "value": "2.3.5"
+        }
+      ],
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.3.xml.bin
index 072f31b6..39afe22d 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.3.xml.bin
@@ -23,23 +23,6 @@
     </properties>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
-        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
-      </properties>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -65,6 +48,23 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
+        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
+      </properties>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.4.json.bin
index 4a396f76..17366c39 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.4.json.bin
@@ -1,34 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:commit_id",
-          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:requested_revision",
-          "value": "2.3.5"
-        }
-      ],
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -67,6 +38,35 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:commit_id",
+          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:requested_revision",
+          "value": "2.3.5"
+        }
+      ],
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.4.xml.bin
index 23f6d02b..6284cbe1 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.4.xml.bin
@@ -50,23 +50,6 @@
     </properties>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
-        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
-      </properties>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -92,6 +75,23 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
+        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
+      </properties>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.5.json.bin
index add72e89..4fdc1f28 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.5.json.bin
@@ -1,34 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:commit_id",
-          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:requested_revision",
-          "value": "2.3.5"
-        }
-      ],
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -67,6 +38,35 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:commit_id",
+          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:requested_revision",
+          "value": "2.3.5"
+        }
+      ],
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.5.xml.bin
index d4d8d9da..d9b61656 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.5.xml.bin
@@ -60,23 +60,6 @@
     </properties>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
-        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
-      </properties>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -102,6 +85,23 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
+        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
+      </properties>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.6.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.6.json.bin
index 3a488e96..6a320088 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.6.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.6.json.bin
@@ -1,34 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:commit_id",
-          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:requested_revision",
-          "value": "2.3.5"
-        }
-      ],
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -67,6 +38,35 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:commit_id",
+          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:requested_revision",
+          "value": "2.3.5"
+        }
+      ],
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.6.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.6.xml.bin
index 4b46d947..9c316ad3 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.6.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock20_1.6.xml.bin
@@ -60,23 +60,6 @@
     </properties>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
-        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
-      </properties>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -102,6 +85,23 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
+        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
+      </properties>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.0.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.0.xml.bin
index 479ef89d..3c9907e2 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.0.xml.bin
@@ -5,14 +5,14 @@
       <name>pathlib2</name>
       <version>2.3.5</version>
       <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <purl>pkg:pypi/pathlib2@2.3.5</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>pathlib2</name>
       <version>2.3.5</version>
       <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5</purl>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
       <modified>false</modified>
     </component>
     <component type="library">
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.1.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.1.xml.bin
index 515e3b8b..eab3204c 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.1.xml.bin
@@ -1,18 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -29,6 +17,18 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.2.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.2.json.bin
index 9e9d90c2..565c492d 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.2.json.bin
@@ -1,20 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -35,6 +20,21 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.2.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.2.xml.bin
index df3cdf6f..395e6919 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.2.xml.bin
@@ -20,18 +20,6 @@
     </component>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -48,6 +36,18 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.3.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.3.json.bin
index f2ce6317..3eaecbff 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.3.json.bin
@@ -1,34 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:commit_id",
-          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:requested_revision",
-          "value": "2.3.5"
-        }
-      ],
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -67,6 +38,35 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:commit_id",
+          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:requested_revision",
+          "value": "2.3.5"
+        }
+      ],
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.3.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.3.xml.bin
index ddf8fe0d..20955a0f 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.3.xml.bin
@@ -23,23 +23,6 @@
     </properties>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
-        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
-      </properties>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -65,6 +48,23 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
+        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
+      </properties>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.4.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.4.json.bin
index cf88f926..1b830d51 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.4.json.bin
@@ -1,34 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:commit_id",
-          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:requested_revision",
-          "value": "2.3.5"
-        }
-      ],
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -67,6 +38,35 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:commit_id",
+          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:requested_revision",
+          "value": "2.3.5"
+        }
+      ],
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.4.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.4.xml.bin
index b19e6dca..2b3dc396 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.4.xml.bin
@@ -50,23 +50,6 @@
     </properties>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
-        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
-      </properties>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -92,6 +75,23 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
+        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
+      </properties>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.5.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.5.json.bin
index 3b91f81a..3c147ea1 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.5.json.bin
@@ -1,34 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:commit_id",
-          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:requested_revision",
-          "value": "2.3.5"
-        }
-      ],
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -67,6 +38,35 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:commit_id",
+          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:requested_revision",
+          "value": "2.3.5"
+        }
+      ],
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.5.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.5.xml.bin
index 2c2868b5..1b1fcf2a 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.5.xml.bin
@@ -60,23 +60,6 @@
     </properties>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
-        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
-      </properties>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -102,6 +85,23 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
+        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
+      </properties>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.6.json.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.6.json.bin
index c8db97f6..4fee4b9f 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.6.json.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.6.json.bin
@@ -1,34 +1,5 @@
 {
   "components": [
-    {
-      "bom-ref": "pathlib2@2.3.5#1",
-      "description": "Object-oriented filesystem paths",
-      "externalReferences": [
-        {
-          "comment": "from VCS",
-          "type": "vcs",
-          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        }
-      ],
-      "name": "pathlib2",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:commit_id",
-          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
-        },
-        {
-          "name": "cdx:python:package:source:vcs:requested_revision",
-          "value": "2.3.5"
-        }
-      ],
-      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
-      "type": "library",
-      "version": "2.3.5"
-    },
     {
       "bom-ref": "pathlib2@2.3.5",
       "description": "Object-oriented filesystem paths",
@@ -67,6 +38,35 @@
       "type": "library",
       "version": "2.3.5"
     },
+    {
+      "bom-ref": "pathlib2@2.3.5#1",
+      "description": "Object-oriented filesystem paths",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        }
+      ],
+      "name": "pathlib2",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:commit_id",
+          "value": "5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6"
+        },
+        {
+          "name": "cdx:python:package:source:vcs:requested_revision",
+          "value": "2.3.5"
+        }
+      ],
+      "purl": "pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6",
+      "type": "library",
+      "version": "2.3.5"
+    },
     {
       "bom-ref": "pathlib2@2.3.6#2",
       "description": "Object-oriented filesystem paths",
diff --git a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.6.xml.bin b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.6.xml.bin
index 6a1c3fd9..46e91ee8 100644
--- a/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.6.xml.bin
+++ b/tests/_data/snapshots/poetry/plain_multi-constraint-deps_lock21_1.6.xml.bin
@@ -60,23 +60,6 @@
     </properties>
   </metadata>
   <components>
-    <component type="library" bom-ref="pathlib2@2.3.5#1">
-      <name>pathlib2</name>
-      <version>2.3.5</version>
-      <description>Object-oriented filesystem paths</description>
-      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
-      <externalReferences>
-        <reference type="vcs">
-          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
-          <comment>from VCS</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
-        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
-      </properties>
-    </component>
     <component type="library" bom-ref="pathlib2@2.3.5">
       <name>pathlib2</name>
       <version>2.3.5</version>
@@ -102,6 +85,23 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
+    <component type="library" bom-ref="pathlib2@2.3.5#1">
+      <name>pathlib2</name>
+      <version>2.3.5</version>
+      <description>Object-oriented filesystem paths</description>
+      <purl>pkg:pypi/pathlib2@2.3.5?vcs_url=git%2Bhttps://github.com/jazzband/pathlib2.git%405a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/jazzband/pathlib2.git#5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:source:vcs:commit_id">5a6a88db3cc1d08dbc86fbe15edfb69fb5f5a3d6</property>
+        <property name="cdx:python:package:source:vcs:requested_revision">2.3.5</property>
+      </properties>
+    </component>
     <component type="library" bom-ref="pathlib2@2.3.6#2">
       <name>pathlib2</name>
       <version>2.3.6</version>