{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"ndaal SARIF Viewer 1.1.12 advances the `self_update` dependency 1.0.0-rc.6 -> 1.3.0. This is a routine currency update from the 2026-09-16 `cargo update` sweep. It remediates NO published security advisory (no RUSTSEC or CVE is fixed by this bump) and introduces none; it is recorded for supply-chain traceability. Security impact: none -- CVSS 0.0 (None) in both v3.1 and v4.0.","title":"Summary"},{"category":"general","text":"self_update implements the optional --check-update / --self-update path against GitLab releases (src/updater.rs), with default-features off plus gitlab, ureq, rustls and checksums; ordinary viewing and validation runs perform no network I/O. Dependency kind: direct, [dependencies]. Picked up via `cargo update`: the Cargo.toml requirement string still literally reads \"1.0.0-rc.6\", which as a caret requirement admits any 1.x release, so the lockfile moved off the release candidate onto the stable 1.3.0 line without a manifest edit. This is the most consequential entry of the sweep: the shipped self-update path no longer runs a pre-release dependency. FOLLOW-UP RECORDED, NOT YET DONE: the manifest requirement should be tightened from \"1.0.0-rc.6\" to \"1.3\" so that the pin reads as the stable line it now resolves to; until then the manifest is misleading to anyone auditing it by eye. Compare ndaal-sa-2026-487, which raised the same release-candidate concern for the sibling OSCAL viewer. Folds ureq 3.3.0 -> 3.4.2, ureq-proto 0.6.0 -> 0.6.4, reqwest 0.13.4 -> 0.13.5, cookie 0.18.1 -> 0.18.2, flate2 1.1.9 -> 1.1.10 with the new zlib-rs 0.6.8 backend, encoding_rs 0.8.35 -> 0.8.41 with the new multiversion 0.9.0 SIMD dispatch crates, and webpki-roots / webpki-root-certs 1.0.8 -> 1.0.9. Verification after the sweep, on the resolved lockfile: `cargo check --all-targets` is clean (exit code 0) and `cargo audit` reports 0 vulnerabilities across 350 crate dependencies, down from 2 on the pre-sweep lockfile (the remaining output is the allowed RUSTSEC-2026-0192 unmaintained warning for ttf-parser 0.25.1, which this sweep does not change). The local RUSTSEC advisory database (1246 advisories) reports no advisory against either the old or the new version of this crate, except where an advisory is named explicitly above. The full `cargo test` suite was NOT re-run as part of this sweep and is therefore not asserted here.","title":"Dependency Currency"},{"category":"general","text":"sarif-viewer is a secure, memory-safe, single-binary offline viewer, validator and multi-format exporter for SARIF 2.1.0 and SARIF 2.2 (draft). Imported runs are validated against the vendored OASIS schemas (jsonschema) and served from an embedded UI over a TLS 1.3 listener (rustls with the aws-lc-rs provider and prefer-post-quantum key exchange) that speaks HTTP/1.1 and HTTP/2 through hyper-util's auto builder (src/server.rs) and HTTP/3 through h3 over quinn. Filesystem access for import, export and checksum sidecars is confined with cap-std. Its network-reachable request parsing surface, its TLS termination, and its supply chain are on the primary trust boundary.","title":"Product Description"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.","title":"Legal Disclaimer"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/640/ndaal-sa-2026-640.json"},{"category":"external","summary":"sarif-viewer source code","url":"https://gitlab.com/vPierre/ndaal_public_sarif_viewer"},{"category":"external","summary":"sarif-viewer on crates.io","url":"https://crates.io/crates/sarif-viewer"},{"category":"external","summary":"self_update 1.3.0 on crates.io","url":"https://crates.io/crates/self_update/1.3.0"}],"title":"ndaal Advisory: self_update 1.0.0-rc.6 -> 1.3.0 dependency-currency bump (sarif-viewer 1.1.12)","tracking":{"current_release_date":"2026-09-16T12:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-640","initial_release_date":"2026-09-16T12:00:00.000Z","revision_history":[{"date":"2026-09-16T12:00:00.000Z","number":"1.0.0","summary":"Dependency currency bump self_update 1.0.0-rc.6 -> 1.3.0; no security impact (CVSS 0.0)"}],"status":"final","version":"1.0.0"},"x_extensions":[{"$schema":"https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json","category":"informational","content":{"dashboard_short_name":"ndaal","publisher_brand":"ndaal Advisories Database"},"critical":false}]},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"1.1.12","product":{"name":"ndaal SARIF Viewer 1.1.12","product_id":"CSAFPID-0001","product_identification_helper":{"purls":["pkg:cargo/sarif-viewer@1.1.12"]}}}],"category":"product_name","name":"sarif-viewer"}],"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG"}]},"vulnerabilities":[{"ids":[{"system_name":"ndaal Advisory ID","text":"ndaal-sa-2026-640"}],"metrics":[{"content":{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":0.0,"baseSeverity":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"cvss_v4":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":0.0,"baseSeverity":"NONE","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"notes":[{"category":"summary","text":"ndaal SARIF Viewer 1.1.12 advances the `self_update` dependency 1.0.0-rc.6 -> 1.3.0. This is a routine currency update from the 2026-09-16 `cargo update` sweep. It remediates NO published security advisory (no RUSTSEC or CVE is fixed by this bump) and introduces none; it is recorded for supply-chain traceability. Security impact: none -- CVSS 0.0 (None) in both v3.1 and v4.0.","title":"Change Summary"},{"category":"description","text":"Impact assessment (none): this change neither introduces nor remediates a known vulnerability, and has no confidentiality, integrity or availability impact. It is scored explicitly rather than left unscored so that the record is machine-readable. CVSS v3.1 base score 0.0 (NONE), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N. CVSS v4.0 base score 0.0 (NONE), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N.","title":"Impact assessment (none)"},{"category":"details","text":"self_update implements the optional --check-update / --self-update path against GitLab releases (src/updater.rs), with default-features off plus gitlab, ureq, rustls and checksums; ordinary viewing and validation runs perform no network I/O. Dependency kind: direct, [dependencies]. Picked up via `cargo update`: the Cargo.toml requirement string still literally reads \"1.0.0-rc.6\", which as a caret requirement admits any 1.x release, so the lockfile moved off the release candidate onto the stable 1.3.0 line without a manifest edit. This is the most consequential entry of the sweep: the shipped self-update path no longer runs a pre-release dependency. FOLLOW-UP RECORDED, NOT YET DONE: the manifest requirement should be tightened from \"1.0.0-rc.6\" to \"1.3\" so that the pin reads as the stable line it now resolves to; until then the manifest is misleading to anyone auditing it by eye. Compare ndaal-sa-2026-487, which raised the same release-candidate concern for the sibling OSCAL viewer. Folds ureq 3.3.0 -> 3.4.2, ureq-proto 0.6.0 -> 0.6.4, reqwest 0.13.4 -> 0.13.5, cookie 0.18.1 -> 0.18.2, flate2 1.1.9 -> 1.1.10 with the new zlib-rs 0.6.8 backend, encoding_rs 0.8.35 -> 0.8.41 with the new multiversion 0.9.0 SIMD dispatch crates, and webpki-roots / webpki-root-certs 1.0.8 -> 1.0.9. Verification after the sweep, on the resolved lockfile: `cargo check --all-targets` is clean (exit code 0) and `cargo audit` reports 0 vulnerabilities across 350 crate dependencies, down from 2 on the pre-sweep lockfile (the remaining output is the allowed RUSTSEC-2026-0192 unmaintained warning for ttf-parser 0.25.1, which this sweep does not change). The local RUSTSEC advisory database (1246 advisories) reports no advisory against either the old or the new version of this crate, except where an advisory is named explicitly above. The full `cargo test` suite was NOT re-run as part of this sweep and is therefore not asserted here.","title":"Dependency Currency"}],"product_status":{"known_affected":["CSAFPID-0001"]},"remediations":[{"category":"vendor_fix","details":"sarif-viewer: self_update 1.3.0 lands in 1.1.12. Picked up via `cargo update`: the Cargo.toml requirement string still literally reads \"1.0.0-rc.6\", which as a caret requirement admits any 1.x release, so the lockfile moved off the release candidate onto the stable 1.3.0 line without a manifest edit. This is the most consequential entry of the sweep: the shipped self-update path no longer runs a pre-release dependency. FOLLOW-UP RECORDED, NOT YET DONE: the manifest requirement should be tightened from \"1.0.0-rc.6\" to \"1.3\" so that the pin reads as the stable line it now resolves to; until then the manifest is misleading to anyone auditing it by eye. Compare ndaal-sa-2026-487, which raised the same release-candidate concern for the sibling OSCAL viewer.","product_ids":["CSAFPID-0001"]}],"title":"self_update upgraded 1.0.0-rc.6 to 1.3.0 (routine currency; no security impact, CVSS 0.0)"}]}