For [`CVE-2021-44228`](https://nvd.nist.gov/vuln/detail/CVE-2021-44228), the producer adds too many non-Maven PURLs that might not be affected by the vulnerability.