Security.Package.version

What Bun resolved the requested range to, not a range itself.

For packages from a registry this is the exact semver version, like 4.1.2. For packages from other sources this is the resolved specifier as it appears in bun.lock, for example github:user/repo#<commit>, git+https://host/repo.git#<commit>, https://example.com/pkg.tgz, ./vendor/pkg.tgz, file:packages/pkg or link:pkg. Compare it with Bun.semver.satisfies, which returns false for such specifiers, rather than assuming it parses as semver.

The user:password@ part and the query string of a URL are left out of this field, of tarball and of requestedRange. The tarball of a package from a registry keeps its query string.