diff --git a/detect/detect_test.go b/detect/detect_test.go
index 0072771..1fb70b6 100644
--- a/detect/detect_test.go
+++ b/detect/detect_test.go
@@ -2284,8 +2284,8 @@ func TestGitSubmoduleManifestDependencies(t *testing.T) {
 		t.Errorf("manifests should contain %+v, got %+v", wantManifest, report.Manifests)
 	}
 	wantDependencies := map[string]string{
-		"lib/foo":    "pkg:git/lib%2Ffoo?repository_url=https:%2F%2Fgithub.com%2Fexample%2Ffoo.git",
-		"vendor/bar": "pkg:git/vendor%2Fbar?repository_url=git%40github.com:example%2Fbar.git",
+		"github.com/example/foo": "pkg:git/github.com/example/foo",
+		"github.com/example/bar": "pkg:git/github.com/example/bar",
 	}
 	for name, purl := range wantDependencies {
 		if !slices.ContainsFunc(report.Dependencies, func(dependency brief.DepInfo) bool {
diff --git a/go.mod b/go.mod
index de7a34b..c74eadd 100644
--- a/go.mod
+++ b/go.mod
@@ -15,9 +15,9 @@ require (
 	github.com/git-pkgs/forge v0.10.1
 	github.com/git-pkgs/licensecheck v0.4.1
 	github.com/git-pkgs/magic v0.6.0
-	github.com/git-pkgs/manifests v0.12.3
+	github.com/git-pkgs/manifests v0.12.4
 	github.com/git-pkgs/outline v0.2.3
-	github.com/git-pkgs/purl v0.1.21
+	github.com/git-pkgs/purl v0.2.1
 	github.com/git-pkgs/registries v0.11.1
 	github.com/git-pkgs/roles v0.1.3
 	github.com/git-pkgs/spdx v0.3.3
@@ -30,7 +30,7 @@ require (
 require (
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/bazelbuild/buildtools v0.0.0-20260716142318-04cf7de1434f // indirect
-	github.com/bmatcuk/doublestar/v4 v4.10.2 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.3 // indirect
 	github.com/ecosyste-ms/ecosystems-go v0.5.0 // indirect
 	github.com/git-pkgs/gitignore v1.3.0 // indirect
 	github.com/git-pkgs/pom v0.1.8 // indirect
diff --git a/go.sum b/go.sum
index 8ca2c94..caa42bb 100644
--- a/go.sum
+++ b/go.sum
@@ -6,8 +6,8 @@ github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP
 github.com/bazelbuild/buildtools v0.0.0-20260716142318-04cf7de1434f h1:2mT6QcXmMFtvg7bezs1Fef7nnpJyeCmfWoWNjwtvNZ4=
 github.com/bazelbuild/buildtools v0.0.0-20260716142318-04cf7de1434f/go.mod h1:PLNUetjLa77TCCziPsz0EI8a6CUxgC+1jgmWv0H25tg=
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
-github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
-github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI=
+github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -33,14 +33,14 @@ github.com/git-pkgs/licensecheck v0.4.1 h1:b5ilmpIpgeeewBFjdhJ4W7jvwPIFsYQ7ujZma
 github.com/git-pkgs/licensecheck v0.4.1/go.mod h1:cfFO7yHHPeuXsoODHBWyevajH2yWcbfkIFELyG3ZpU0=
 github.com/git-pkgs/magic v0.6.0 h1:fINPe67FEIaFRVlZzhOIDClMkm+gftBroBENa8bHSxQ=
 github.com/git-pkgs/magic v0.6.0/go.mod h1:SXOqcsNmbmpZjJZHEEWnwxprbsFvpwWgTAZrgXp4Jm4=
-github.com/git-pkgs/manifests v0.12.3 h1:6lhpuQYOT10jDVkD1TdAvIZ9lBIKYWL+7tBLIux8Bp0=
-github.com/git-pkgs/manifests v0.12.3/go.mod h1:jz0Vpic/FUdGHB8FZYGgYobjyH0LLpYONt6F0rzfzVU=
+github.com/git-pkgs/manifests v0.12.4 h1:u8Id3dkq2z+bos7By/6EH60OgcG7QScyELnzAcdKB3k=
+github.com/git-pkgs/manifests v0.12.4/go.mod h1:yNXi6ELHdtx5X2243yr53HgOIRf5KF8CE4Z2u2d6dNQ=
 github.com/git-pkgs/outline v0.2.3 h1:sTCk4pjEwASQ7wYmqPBQLXMcPxZDEx9/VlmjtcGLd+Q=
 github.com/git-pkgs/outline v0.2.3/go.mod h1:lHC7bzvHlXAdsuQZODQ63+wCVkmhk4D7z/1r8YRRuok=
 github.com/git-pkgs/pom v0.1.8 h1:mXCuWw6XkrKKZb6IurRZyIznYLPhV5AYg5ZO38Uj/l8=
 github.com/git-pkgs/pom v0.1.8/go.mod h1:sQBeYRzjCUn77fcABPn6I/a1aBHFxm55jTmkNxYtGtw=
-github.com/git-pkgs/purl v0.1.21 h1:PDZUX43lxIiXPn2eHcsNiiiwQo+HajntZ/4TwSvCGlw=
-github.com/git-pkgs/purl v0.1.21/go.mod h1:4dOmris48ehjiKmWBqSmMHguUQht48BLeXW+hQUnuj0=
+github.com/git-pkgs/purl v0.2.1 h1:b46hRlOMbrG6aXjjFJdYixGi5WTh0TLlAnH9iNeuOS0=
+github.com/git-pkgs/purl v0.2.1/go.mod h1:l8rCfvt5iXVrFIcoQ8+vCLOaHhrtEW2id0LENP+IzMw=
 github.com/git-pkgs/registries v0.11.1 h1:AkVQ15Rnrho4tbTnocYuHQuzNQ1m9jEjWKTA8P3xnPI=
 github.com/git-pkgs/registries v0.11.1/go.mod h1:bKxgdy/PwnzQXL2FnOktmSQHTKk6B85MA4VtvvYItPc=
 github.com/git-pkgs/roles v0.1.3 h1:BkXoBFg0/4szCvBes8mD+UApRe1jITaZ/4bs+XtRxdw=