Update packageurl-dotnet to 2.0.0-rc.2

[JamieMagee]

Bumps packageurl-dotnet from 1.0.0 to 2.0.0-rc.2.

What changed

• Renamed PackageURL to PackageUrl across all TypedComponent classes (the library renamed the type).
• GoComponent.PackageUrl now splits the module path into namespace + name, since v2 enforces the purl spec requirement that golang purls have a namespace. E.g. github.com/gorilla/context becomes namespace=github.com/gorilla, name=context.
• Updated test data: Go tests use real module paths instead of bare names like "test". CocoaPod purl assertions updated for v2's qualifier URL-encoding. Removed a stale CA1308 suppression in CppSdkComponentTests.

Links

• https://github.com/package-url/packageurl-dotnet/releases/tag/2.0.0-rc.1
• https://github.com/package-url/packageurl-dotnet/releases/tag/2.0.0-rc.2
• https://github.com/package-url/purl-spec/blob/master/types/golang-definition.json

[Copilot]

Pull request overview

Updates the repository to use packageurl-dotnet v2.0.0-rc.2 and aligns Contracts + tests with the renamed PackageUrl type, ensuring typed components continue to produce valid PURLs.

Changes:

• Bump packageurl-dotnet to 2.0.0-rc.2 and migrate from PackageURL → PackageUrl.
• Update multiple TypedComponent implementations to construct PackageUrl instances with the new API/normalization behavior.
• Adjust unit tests and documentation examples to match the new PURL object model and string formatting.

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Directory.Packages.props	Updates packageurl-dotnet dependency version to rc.2.
src/Microsoft.ComponentDetection.Contracts/TypedComponent/TypedComponent.cs	Switches base PackageUrl property type to PackageUrl.
src/Microsoft.ComponentDetection.Contracts/TypedComponent/*.cs	Updates typed components to return PackageUrl (including updated Go PURL namespace/name handling).
test/Microsoft.ComponentDetection.Contracts.Tests/PurlGenerationTests.cs	Updates PURL expectations (casing/encoding) for updated library behavior.
test/Microsoft.ComponentDetection.Contracts.Tests/TypedComponentSerializationTests.cs	Updates Go component serialization test data to include module-path names.
test/Microsoft.ComponentDetection.Contracts.Tests/CppSdkComponentTests.cs	Updates assertions to match new PackageUrl name behavior.
test/Microsoft.ComponentDetection.Detectors.Tests/SwiftComponentTests.cs	Updates Swift PURL tests to construct PackageUrl.
docs/creating-a-new-detector.md	Updates documentation sample to use PackageUrl.
docs/schema/manifest.schema.json	Formatting-only change.

Comments suppressed due to low confidence (1)

src/Microsoft.ComponentDetection.Contracts/TypedComponent/GoComponent.cs:63

• GetNamespaceAndName() calls this.Name.LastIndexOf('/') without validating Name. Since GoComponent() exists for deserialization, this can throw a NullReferenceException if PackageUrl is accessed before Name is populated (or if deserialization input is malformed). Consider validating required fields in the PackageUrl getter (e.g., via ValidateRequiredInput) so failures are deterministic and throw an ArgumentNullException with the existing standardized message.

    private (string Namespace, string Name) GetNamespaceAndName()
    {
        var lastSlash = this.Name.LastIndexOf('/');
        if (lastSlash > 0)
        {
            return (this.Name.Substring(0, lastSlash), this.Name.Substring(lastSlash + 1));
        }

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.0%. Comparing base (4e30e9e) to head (4a2c654).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@     Coverage Diff      @@
##   main   #1730   +/-   ##
============================
============================

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂