FDA-SUP-002 warning

Every component declares an end-of-support date

Pack fda-524b 1.0.0

Severity: warning
Same standing as the level of support, and named in published reviews of real FDA deficiency letters as a recurring citation. The only public data source for these dates is a community-maintained wiki, which is why StratifyPro maintains its own.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Give the end-of-support date for every component. Where the date is genuinely unknown, say so explicitly rather than omitting the field.
Source: fda-premarket-2026-02: Section V.A.4(b), second additional element
Note: NO FORMAT HAS A FIELD FOR THIS. Resolved by packages/eos where possible.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-SUP-002 --pack fda-524b prints this page.