fix(parser): exclude the SPDX document subject from components

[dmchaledev]

Summary

SPDX documents list their own root/subject package — the application the SBOM describes — inside packages[]. parseSPDX mapped every package into components (src/parser.ts), so a release‑to‑release diff of the same app reports the app itself as a spurious component change. Because the subject's versionInfo bumps on every release, this shows up as a [MAJOR] "upgrade" of the application on essentially every SPDX diff, drowning out the real dependency deltas.

CycloneDX already keeps its subject (metadata.component) out of components; this brings SPDX into line so both formats diff dependencies, not the artifact being described.

Reproduction (before this change)

Two SPDX SBOMs of the same app, 1.0.0 → 2.0.0, with only lodash unchanged:

↑ Upgraded Components:
  ~ my-app: 1.0.0 → 2.0.0 [MAJOR]

The application is reported as the only "change," even though no dependency moved. After this change the same inputs produce an empty (accurate) dependency diff.

Change

• parseSPDX now filters out the document subject before mapping packages to components.
• The subject is identified from the SBOM itself via either:
  • the documentDescribes shortcut array (SPDX 2.2+), and/or
  • a DESCRIBES relationship from SPDXRef-DOCUMENT (plus its DESCRIBED_BY inverse).
• Packages are excluded only when the document explicitly marks them as the subject. A document that declares no root is unchanged, so this is safe and backward‑compatible for SBOMs that don't include a subject package.

Tests

Added to src/__tests__/parser.test.ts:

• subject named via documentDescribes is excluded;
• subject named via a DESCRIBES relationship is excluded;
• when no subject is declared, every package is retained.

All existing tests still pass (32 passed), and lint / typecheck / build are green.

Scope

Parser‑localized and orthogonal to the open diff/reporter/CLI work — no open issue or PR addresses SPDX subject exclusion.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RrdcuDGmzaQ6s8JqCbGTs8

---

Generated by Claude Code