https://bugzilla.redhat.com/show_bug.cgi?id=1305655
--- Comment #7 from Zbigniew Jędrzejewski-Szmek zbyszek@in.waw.pl --- The idea is to provide the information that package A is using code B. Would there be no bundling, this information would be provided by BuildRequires or other dependency. We want to provide a replacement.
The purpose is to be able to quickly find code B, not just for security issues. Imagine that next version of gcc exposes a bug in boost::endian. If someone wants to go over all packages using boost::endian and recompile them with some patch, this Provides makes their life easier because they can identify relevant packages with one or two dnf queries.
In case you cannot identify a specific version, don't include the version. There's a lot of packages which do that. You can add a comment in the specfile...