CISA-MD-004 warning

SBOM Data Format Version is declared and not deprecated

Pack cisa-2026-v2.1 1.0.0

Severity: warning
The document says versions declared deprecated by the format maintainers should not be used. A deprecated version is accepted by tools today and may not be tomorrow, which is a slow failure a consumer cannot see coming.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Declare the format version, and check it against the format maintainer's own deprecation list before publishing.
Source: cisa-2026-v2.1: SBOM Metadata, element 4, SBOM Data Format Version (New)
Note: The document names no version numbers. The deprecation list is maintained upstream by CycloneDX and SPDX, so this rule checks presence here and defers the deprecation check to a maintained list in packages/rules/data/deprecated-format-versions.json.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-MD-004 --pack cisa-2026-v2.1 prints this page.