diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -0,0 +1,16 @@
+# 0.2.0.0
+
+* Rely on `purl` for `Security.OSV.Package.packageUrl`
+* Update `tasty` dependency bounds
+
+# 0.1.0.2
+
+* Update dependencies bounds
+
+# 0.1.0.1
+
+* Fix `cvss` dependency bounds
+
+# 0.1.0.0
+
+* Introduction
diff --git a/README.md b/README.md
new file mode 100644
--- /dev/null
+++ b/README.md
@@ -0,0 +1,7 @@
+# osv
+
+This project aims to support [Open Source Vulnerability format](https://ossf.github.io/osv-schema/).
+
+## Building
+
+We aim to support both regular cabal-based and nix-based builds.
diff --git a/osv.cabal b/osv.cabal
--- a/osv.cabal
+++ b/osv.cabal
@@ -1,6 +1,6 @@
 cabal-version:      2.4
 name:               osv
-version:            0.1.0.0
+version:            0.2.0.0
 
 -- A short (one-line) description of the package.
 synopsis:
@@ -15,16 +15,16 @@
 
 -- The license under which the package is released.
 license:            BSD-3-Clause
-author:             David Christiansen
-maintainer:         david@davidchristiansen.dk
+author:             Haskell Security Response Team
+maintainer:         security-advisories@haskell.org
 
 -- A copyright notice.
 -- copyright:
 category:           Data
-extra-doc-files:    CHANGELOG.md
+extra-doc-files:    CHANGELOG.md, README.md
 
 tested-with:
-  GHC ==8.10.7 || ==9.0.2 || ==9.2.8 || ==9.4.8 || ==9.6.3 || ==9.8.1
+  GHC ==8.10.7 || ==9.0.2 || ==9.2.8 || ==9.4.8 || ==9.6.6 || ==9.8.3 || ==9.10.1 || ==9.12.1
 
 library
   exposed-modules:
@@ -32,10 +32,11 @@
 
   build-depends:
     , aeson                 >=2.0.1.0  && <3
-    , base                  >=4.14     && <4.20
-    , cvss
+    , base                  >=4.14     && <5
+    , cvss                  >=0.2      && <0.3
+    , purl                  >=0.1      && <0.2
     , text                  >=1.2      && <3
-    , time                  >=1.9      && <1.14
+    , time                  >=1.9      && <1.15
 
   hs-source-dirs:   src
   default-language: Haskell2010
@@ -48,9 +49,9 @@
   hs-source-dirs:   test
   main-is:          Spec.hs
   build-depends:
-    , base           <5
+    , base
     , osv
-    , tasty          <1.5
+    , tasty          <2
     , tasty-hunit    <0.11
 
   default-language: Haskell2010
diff --git a/src/Security/OSV.hs b/src/Security/OSV.hs
--- a/src/Security/OSV.hs
+++ b/src/Security/OSV.hs
@@ -44,6 +44,7 @@
 import Data.Time.Format.ISO8601 (iso8601ParseM)
 import Data.Tuple (swap)
 
+import Data.Purl (Purl)
 import qualified Security.CVSS as CVSS
 
 data Affected dbSpecific ecosystemSpecific rangeDbSpecific = Affected
@@ -182,8 +183,8 @@
 data Package = Package
   { packageName :: Text
   , packageEcosystem :: Text
-  , packagePurl :: Maybe Text  -- TODO refine type
-  } deriving (Show, Eq, Ord)
+  , packagePurl :: Maybe Purl
+  } deriving (Show, Eq)
 
 data Range dbSpecific
   = RangeSemVer [Event Text {- TODO refine -}] (Maybe dbSpecific)
@@ -246,7 +247,7 @@
   -- @app.any.run@ replaying the exploitation of the vulnerability.
   | ReferenceTypeWeb
   -- ^ A web page of some unspecified kind.
-  deriving (Show, Eq)
+  deriving (Show, Eq, Enum, Bounded)
 
 -- | Bijection of reference types and their string representations
 referenceTypes :: [(ReferenceType, Text)]