{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "ndaal SARIF Viewer 1.1.12 advances the `anyhow` dependency 1.0.103 -> 1.0.104. This is a routine currency update from the 2026-09-16 `cargo update` sweep. It remediates NO published security advisory (no RUSTSEC or CVE is fixed by this bump) and introduces none; it is recorded for supply-chain traceability. Security impact: none -- CVSS 0.0 (None) in both v3.1 and v4.0.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "anyhow carries boxed error context through the import, validation and export paths. Dependency kind: direct, [dependencies]. Picked up via `cargo update` within the existing (unchanged) Cargo.toml requirement \"1\"; lockfile-only patch advance. Verification after the sweep, on the resolved lockfile: `cargo check --all-targets` is clean (exit code 0) and `cargo audit` reports 0 vulnerabilities across 350 crate dependencies, down from 2 on the pre-sweep lockfile (the remaining output is the allowed RUSTSEC-2026-0192 unmaintained warning for ttf-parser 0.25.1, which this sweep does not change). The local RUSTSEC advisory database (1246 advisories) reports no advisory against either the old or the new version of this crate, except where an advisory is named explicitly above. The full `cargo test` suite was NOT re-run as part of this sweep and is therefore not asserted here.",
        "title": "Dependency Currency"
      },
      {
        "category": "general",
        "text": "sarif-viewer is a secure, memory-safe, single-binary offline viewer, validator and multi-format exporter for SARIF 2.1.0 and SARIF 2.2 (draft). Imported runs are validated against the vendored OASIS schemas (jsonschema) and served from an embedded UI over a TLS 1.3 listener (rustls with the aws-lc-rs provider and prefer-post-quantum key exchange) that speaks HTTP/1.1 and HTTP/2 through hyper-util's auto builder (src/server.rs) and HTTP/3 through h3 over quinn. Filesystem access for import, export and checksum sidecars is confined with cap-std. Its network-reachable request parsing surface, its TLS termination, and its supply chain are on the primary trust boundary.",
        "title": "Product Description"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
      "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/631/ndaal-sa-2026-631.json"
      },
      {
        "category": "external",
        "summary": "sarif-viewer source code",
        "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer"
      },
      {
        "category": "external",
        "summary": "sarif-viewer on crates.io",
        "url": "https://crates.io/crates/sarif-viewer"
      },
      {
        "category": "external",
        "summary": "anyhow 1.0.104 on crates.io",
        "url": "https://crates.io/crates/anyhow/1.0.104"
      }
    ],
    "title": "ndaal Advisory: anyhow 1.0.103 -> 1.0.104 dependency-currency bump (sarif-viewer 1.1.12)",
    "tracking": {
      "current_release_date": "2026-09-16T12:00:00.000Z",
      "generator": {
        "engine": {
          "name": "ndaal CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ndaal-sa-2026-631",
      "initial_release_date": "2026-09-16T12:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-09-16T12:00:00.000Z",
          "number": "1.0.0",
          "summary": "Dependency currency bump anyhow 1.0.103 -> 1.0.104; no security impact (CVSS 0.0)"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    },
    "x_extensions": [
      {
        "$schema": "https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json",
        "category": "informational",
        "content": {
          "dashboard_short_name": "ndaal",
          "publisher_brand": "ndaal Advisories Database"
        },
        "critical": false
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.1.12",
                "product": {
                  "name": "ndaal SARIF Viewer 1.1.12",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "purls": [
                      "pkg:cargo/sarif-viewer@1.1.12"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "sarif-viewer"
          }
        ],
        "category": "vendor",
        "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "ids": [
        {
          "system_name": "ndaal Advisory ID",
          "text": "ndaal-sa-2026-631"
        }
      ],
      "metrics": [
        {
          "content": {
            "cvss_v3": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 0.0,
              "baseSeverity": "NONE",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
              "version": "3.1"
            },
            "cvss_v4": {
              "attackComplexity": "LOW",
              "attackRequirements": "NONE",
              "attackVector": "NETWORK",
              "baseScore": 0.0,
              "baseSeverity": "NONE",
              "privilegesRequired": "NONE",
              "subAvailabilityImpact": "NONE",
              "subConfidentialityImpact": "NONE",
              "subIntegrityImpact": "NONE",
              "userInteraction": "NONE",
              "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
              "version": "4.0",
              "vulnAvailabilityImpact": "NONE",
              "vulnConfidentialityImpact": "NONE",
              "vulnIntegrityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "notes": [
        {
          "category": "summary",
          "text": "ndaal SARIF Viewer 1.1.12 advances the `anyhow` dependency 1.0.103 -> 1.0.104. This is a routine currency update from the 2026-09-16 `cargo update` sweep. It remediates NO published security advisory (no RUSTSEC or CVE is fixed by this bump) and introduces none; it is recorded for supply-chain traceability. Security impact: none -- CVSS 0.0 (None) in both v3.1 and v4.0.",
          "title": "Change Summary"
        },
        {
          "category": "description",
          "text": "Impact assessment (none): this change neither introduces nor remediates a known vulnerability, and has no confidentiality, integrity or availability impact. It is scored explicitly rather than left unscored so that the record is machine-readable. CVSS v3.1 base score 0.0 (NONE), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N. CVSS v4.0 base score 0.0 (NONE), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N.",
          "title": "Impact assessment (none)"
        },
        {
          "category": "details",
          "text": "anyhow carries boxed error context through the import, validation and export paths. Dependency kind: direct, [dependencies]. Picked up via `cargo update` within the existing (unchanged) Cargo.toml requirement \"1\"; lockfile-only patch advance. Verification after the sweep, on the resolved lockfile: `cargo check --all-targets` is clean (exit code 0) and `cargo audit` reports 0 vulnerabilities across 350 crate dependencies, down from 2 on the pre-sweep lockfile (the remaining output is the allowed RUSTSEC-2026-0192 unmaintained warning for ttf-parser 0.25.1, which this sweep does not change). The local RUSTSEC advisory database (1246 advisories) reports no advisory against either the old or the new version of this crate, except where an advisory is named explicitly above. The full `cargo test` suite was NOT re-run as part of this sweep and is therefore not asserted here.",
          "title": "Dependency Currency"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "sarif-viewer: anyhow 1.0.104 lands in 1.1.12. Picked up via `cargo update` within the existing (unchanged) Cargo.toml requirement \"1\"; lockfile-only patch advance.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "anyhow upgraded 1.0.103 to 1.0.104 (routine currency; no security impact, CVSS 0.0)"
    }
  ]
}