CISA-CD-008 warning

Component Version is present, or explicitly unknown

Pack cisa-2026-v2.1 1.0.0

Severity: warning
Without a version, no vulnerability lookup can be range-matched, so the component is effectively invisible to security tooling. Measured: only 29.9 percent of Python projects and 41.4 percent of Java projects carry version information for all top-level dependencies.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Record the version the component producer assigned. If the producer provides no version, state that it is unknown.
Source: cisa-2026-v2.1: Component Data, element 8, Component Version (Major Update)

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-CD-008 --pack cisa-2026-v2.1 prints this page.