CISA SBOM guidance mandates full dependency depth

CISA's updated 2025 SBOM guidance requires all components, including transitive dependencies, with no minimum depth. Configuration files and fork lineage must be included. A hardened container image requires every layer to pass a basic sniff test for reduced risk and improved security.