{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_informational_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"sbom-auditor 1.6.35 bumps the `icu_* (ICU4X, 11 crates)` dependency 2.3.x -> 2.4.0. This is a routine minor update (trivial: semver-compatible, no source change). It remediates NO published security advisory (no RUSTSEC / CVE is fixed by this bump); it is recorded for supply-chain traceability. Security impact: none - CVSS v3.1 base score 0.0 (None).","title":"Summary"},{"category":"description","text":"No source change: only `Cargo.lock` changes (`cargo update`). Moved with it: `icu_locale_core` 2.3.0 -> 2.4.0, `icu_locale_fallback` 2.3.0 -> 2.4.0, `icu_locale_fallback_data` 2.3.0 -> 2.4.0, `icu_normalizer` 2.3.0 -> 2.4.0, `icu_normalizer_data` 2.3.0 -> 2.4.0, `icu_properties` 2.3.0 -> 2.4.0, `icu_properties_data` 2.3.0 -> 2.4.0, `icu_provider` 2.3.1 -> 2.4.0, `icu_segmenter` 2.3.0 -> 2.4.0, `icu_segmenter_data` 2.3.0 -> 2.4.0. The ICU4X crates move together as one family. Verified on the sbom-auditor tree with the updated Cargo.lock (commit 3d1d2b20): cargo fmt --check, cargo clippy -D warnings, the test suite (744 unit tests, the integration tests and the doctests), cargo doc, cargo audit, cargo deny and cargo vet pass.","title":"Upgrade Notes"},{"category":"general","text":"Security / CVSS assessment: this dependency update introduces and remediates no known vulnerability. It has no confidentiality, integrity, or availability impact. CVSS v3.1 base score: 0.0 (None). CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N. CVSS v4.0 base score: 0.0 (None). CVSS v4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N. (Per CSAF rule 6.1.27.3 an informational advisory carries no /vulnerabilities element, so these scores are stated here rather than in a machine-readable metrics block.)","title":"CVSS / Security Assessment"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.","title":"Legal Disclaimer"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1021/ndaal-sa-2026-1021.json"},{"category":"external","summary":"icu_collections crate on crates.io","url":"https://crates.io/crates/icu_collections"},{"category":"external","summary":"icu_segmenter_data crate on crates.io","url":"https://crates.io/crates/icu_segmenter_data"},{"category":"external","summary":"icu_segmenter crate on crates.io","url":"https://crates.io/crates/icu_segmenter"},{"category":"external","summary":"icu_provider crate on crates.io","url":"https://crates.io/crates/icu_provider"},{"category":"external","summary":"icu_properties_data crate on crates.io","url":"https://crates.io/crates/icu_properties_data"},{"category":"external","summary":"icu_properties crate on crates.io","url":"https://crates.io/crates/icu_properties"},{"category":"external","summary":"icu_normalizer_data crate on crates.io","url":"https://crates.io/crates/icu_normalizer_data"},{"category":"external","summary":"icu_normalizer crate on crates.io","url":"https://crates.io/crates/icu_normalizer"},{"category":"external","summary":"icu_locale_fallback_data crate on crates.io","url":"https://crates.io/crates/icu_locale_fallback_data"},{"category":"external","summary":"icu_locale_fallback crate on crates.io","url":"https://crates.io/crates/icu_locale_fallback"},{"category":"external","summary":"icu_locale_core crate on crates.io","url":"https://crates.io/crates/icu_locale_core"},{"category":"external","summary":"sbom-auditor 1.6.35 CHANGELOG","url":"https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/raw/v1.6.35/CHANGELOG.md"},{"category":"external","summary":"sbom-auditor 1.6.35 on crates.io","url":"https://crates.io/crates/sbom-auditor/1.6.35"},{"category":"external","summary":"sbom-auditor 1.6.35 release on GitLab","url":"https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/releases/v1.6.35"}],"title":"ndaal Informational Advisory: icu_* (ICU4X, 11 crates) 2.3.x -> 2.4.0 bump (sbom-auditor 1.6.35)","tracking":{"current_release_date":"2026-10-26T02:19:12.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-1021","initial_release_date":"2026-10-26T02:19:12.000Z","revision_history":[{"date":"2026-10-26T02:19:12.000Z","number":"1.0.0","summary":"Initial release. Informational advisory documenting the icu_* (ICU4X, 11 crates) 2.3.x -> 2.4.0 bump shipped in sbom-auditor 1.6.35 (released on 2026-10-26)."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"1.6.35","product":{"name":"sbom-auditor 1.6.35 - ships icu_* (ICU4X, 11 crates) 2.4.0","product_id":"CSAFPID-0001","product_identification_helper":{"purls":["pkg:cargo/sbom-auditor@1.6.35"]}}}],"category":"product_name","name":"sbom-auditor"}],"category":"vendor","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG"}]}}