FDA-DEPTH-001 warning

Transitive dependencies are present

Pack fda-524b 1.0.0

Severity: warning
FDA asks for the full stack including 'the upstream software dependencies that are required or depended upon by proprietary, purchased, licensed, and open-source software'. It sets no top-level floor, which makes it materially deeper than the EU requirement. A flat list of direct dependencies understates the real surface.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Include upstream transitive dependencies, not just the components you chose directly.
Source: fda-premarket-2026-02: Section V.A.4, robust SBOM paragraph, and depth discussion
Note: FDA sets no minimum depth and no top-level floor. Do not apply the EU CRA's top-level-only reading here.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-DEPTH-001 --pack fda-524b prints this page.