Migrate Spdx22ComponentDetector from Newtonsoft.Json to System.Text.json

[JamieMagee]

• Replace JObject/JsonTextReader with JsonDocument.ParseAsync
• Convert JObject property access to JsonElement.TryGetProperty pattern
• Make OnFileFoundAsync properly async
• Update exception handling from JsonReaderException to JsonException

[codecov]

Codecov Report

❌ Patch coverage is 77.77778% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.6%. Comparing base (f096423) to head (56a1717).

Files with missing lines	Patch %	Lines
...etection.Detectors/spdx/Spdx22ComponentDetector.cs	77.7%	0 Missing and 6 partials ⚠️

Additional details and impacted files

@@                           Coverage Diff                           @@
##           users/jamagee/go-vcpkg-system.text.json   #1571   +/-   ##
=======================================================================
  Coverage                                     89.5%   89.6%           
=======================================================================
  Files                                          426     426           
  Lines                                        36268   36272    +4     
  Branches                                      2262    2262           
=======================================================================
+ Hits                                         32494   32501    +7     
+ Misses                                        3312    3309    -3     
  Partials                                       462     462           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR migrates the Spdx22ComponentDetector from Newtonsoft.Json to System.Text.Json, aligning with modern .NET standards. The detector parses SPDX 2.2 SBOM files in JSON format to extract component metadata.

Key changes:

• Replaced JObject/JsonTextReader with JsonDocument.ParseAsync for async JSON parsing
• Converted property access patterns from nullable ?. operators to explicit TryGetProperty checks
• Updated exception handling from JsonReaderException to JsonException

Comments suppressed due to low confidence (1)

src/Microsoft.ComponentDetection.Detectors/spdx/Spdx22ComponentDetector.cs:1

• The JsonDocument returned by ParseAsync should be disposed. In DotNetComponentDetector (line 281), the document is not wrapped in a using statement, which could lead to a memory leak. However, in this file (line 60), you correctly use using var document. Consider checking if DotNetComponentDetector needs the same fix, but this current usage is correct.

#nullable disable

[Copilot]

The SpdxComponent constructor calls ValidateRequiredInput on all parameters (see SpdxComponent.cs:16-21), which will throw if these values are null. However, these properties may legitimately be missing from malformed SPDX documents. This will cause the component creation to throw an unhandled exception instead of gracefully logging a warning. Consider adding null checks before constructing the component, or catching the validation exception and logging an appropriate warning message.

[Copilot]

The variable name versionElement2 is unclear and suggests a copy-paste error. It should be renamed to spdxVersionElement or versionElementSpdx to better indicate its purpose and distinguish it from versionElement used in IsSPDXVersionSupported.

Suggested change

	var spdxVersion = document.TryGetProperty("spdxVersion", out var versionElement2) ? versionElement2.GetString() : null;
	var spdxVersion = document.TryGetProperty("spdxVersion", out var spdxVersionElement) ? spdxVersionElement.GetString() : null;