CISA-CD-002 warning

Dependency relationships are declared

Pack cisa-2026-v2.1 1.0.0

Severity: warning
Measured across 78,612 published SBOMs, 52.9 percent omit this entirely and only 0.10 percent of CycloneDX files use compositions to declare the graph incomplete. Silence is therefore indistinguishable from completeness, and a consumer reading a flat list cannot tell whether there are no dependencies or no data.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Emit the dependency graph. If the graph is known to be incomplete, say so: CycloneDX compositions with aggregate 'incomplete', or an SPDX relationship of NOASSERTION, so a reader can tell absence of data from absence of dependencies.
Source: cisa-2026-v2.1: Component Data, element 2, Component Dependency Relationship (Minor Update)
Note: Footnote 11 is materially important: copied-and-pasted code is effectively a dependency and should be documented as a named local fork with a dependency relationship, because tracking it that way improves vulnerability management.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-CD-002 --pack cisa-2026-v2.1 prints this page.