{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_base",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Release announcement for ndaal SARIF Viewer (sarif-viewer) 1.2.17. This is an informational release note, not a vulnerability disclosure: the announcement itself carries no security impact and is scored CVSS 0.0 (NONE) for both CVSS v3.1 and CVSS v4.0."
      },
      {
        "category": "description",
        "text": "sarif-viewer 1.2.17 is a dependency refresh: cargo update moved 80 crates in Cargo.lock, with no Cargo.toml or source change. tokio 1.53.1 -> 1.54.1 fixes RUSTSEC-2026-0386 (AsyncFd::new violates I/O safety); sarif-viewer was not affected, because nothing in its dependency graph calls AsyncFd. On the updated tree cargo check, cargo fmt --check, clippy with -D warnings, the full test suite and the doc tests pass, and cargo audit goes from two findings to one (ttf-parser is unmaintained, RUSTSEC-2026-0192, unchanged). The refresh is documented by 55 CSAF advisories, ndaal-sa-2026-961 to 1015: 54 informational ones and ndaal-sa-2026-1000 for tokio, a VEX with CVSS v3.1 7.0 and v4.0 7.3. This announcement records the release in the CSAF feed."
      },
      {
        "category": "details",
        "text": "Reused from CHANGELOG.md (v1.2.17): (1) [Changed] **Dependency refresh (`cargo update`).** 80 crates moved in `Cargo.lock`; there is no `Cargo.toml` or source change. `tokio` 1.53.1 -> 1.54.1 fixes RUSTSEC-2026-0386 (`AsyncFd::new` violates I/O safety); sarif-viewer was not affected, because nothing in its dependency graph calls `AsyncFd`. The direct dependencies moved are `hyper` 1.12.0, `hyper-rustls` 0.27.10, `hyper-util` 0.1.21, `rustls-native-certs` 0.8.5, `self_update` 1.3.2, `serde_json` 1.0.154, `sha2` 0.11.1, `tokio-rustls` 0.26.6 and, as a dev-dependency, `proptest` 1.12.0. On the updated tree `cargo check`, `cargo fmt --check`, clippy with `-D warnings`, the full test suite and the doc tests pass, and `cargo audit` goes from two findings to one (`ttf-parser` unmaintained, RUSTSEC-2026-0192, unchanged). (2) [Added] **55 CSAF advisories** `ndaal-sa-2026-961` to `1015`, one per crate moved by the refresh, with derive, macro, `-sys` and data siblings folded into their parent. 54 are informational (CVSS 3.1 and 4.0 both 0.0, stated in a note); `ndaal-sa-2026-1000` records `tokio` as a VEX with CVSS 3.1 7.0 and 4.0 7.3. Generated by `csaf/generate_dependency_bumps_961_1015.py`; each has five checksum sidecars and passes `csaf-validator`."
      },
      {
        "category": "general",
        "text": "Recommended action: upgrade to sarif-viewer 1.2.17 to ship tokio 1.54.1 and the refreshed dependencies; no other action is required for security. Operators tracking the ndaal advisory feed may ingest this document as the canonical record of the sarif-viewer 1.2.17 release. Prebuilt binaries for Linux, Windows and macOS (x86_64 and aarch64) are attached to the GitLab release, and the crate is published on crates.io (cargo binstall sarif-viewer). The full change list is published in CHANGELOG.md in the repository."
      },
      {
        "category": "other",
        "text": "CVSS applicability: this is a release announcement and carries no security impact itself, scored CVSS v3.1 0.0 (NONE) and CVSS v4.0 0.0 (NONE) with all impact metrics set to NONE. The score is intentionally zero to signal 'informational, no vulnerability' while still carrying a machine-readable metric; the real scores of the tokio finding are in ndaal-sa-2026-1000. Status: final."
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
      "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/1097/ndaal-sa-2026-1097.json"
      },
      {
        "category": "external",
        "summary": "CHANGELOG 1.2.17",
        "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer/-/raw/main/CHANGELOG.md"
      },
      {
        "category": "external",
        "summary": "GitLab release v1.2.17 with prebuilt binaries and checksums",
        "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer/-/releases/v1.2.17"
      },
      {
        "category": "external",
        "summary": "sarif-viewer 1.2.17 on crates.io",
        "url": "https://crates.io/crates/sarif-viewer/1.2.17"
      },
      {
        "category": "external",
        "summary": "ndaal_public_sarif_viewer repository",
        "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer"
      },
      {
        "category": "external",
        "summary": "ndaal-sa-2026-1000: tokio 1.53.1 -> 1.54.1 addresses RUSTSEC-2026-0386",
        "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer/-/raw/main/csaf/2026/1000/ndaal-sa-2026-1000.json"
      },
      {
        "category": "external",
        "summary": "RustSec RUSTSEC-2026-0386",
        "url": "https://rustsec.org/advisories/RUSTSEC-2026-0386.html"
      },
      {
        "category": "external",
        "summary": "CSAF 2.1 specification (OASIS)",
        "url": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html"
      },
      {
        "category": "external",
        "summary": "CVSS v4.0 specification (FIRST)",
        "url": "https://www.first.org/cvss/v4-0/specification-document"
      }
    ],
    "title": "ndaal SARIF Viewer (sarif-viewer) 1.2.17 — release announcement (informational, no security impact, CVSS 0.0)",
    "tracking": {
      "current_release_date": "2026-10-25T21:47:23.000Z",
      "generator": {
        "engine": {
          "name": "ndaal CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ndaal-sa-2026-1097",
      "initial_release_date": "2026-10-25T21:47:23.000Z",
      "revision_history": [
        {
          "date": "2026-10-25T21:47:23.000Z",
          "number": "1.0.0",
          "summary": "Initial release announcement for sarif-viewer 1.2.17. Informational, no security impact, CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    },
    "x_extensions": [
      {
        "$schema": "https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json",
        "category": "informational",
        "content": {
          "dashboard_short_name": "ndaal",
          "publisher_brand": "ndaal Advisories Database"
        },
        "critical": false
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.2.17",
                "product": {
                  "name": "ndaal SARIF Viewer (sarif-viewer) 1.2.17 — release announcement, no security impact.",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "purls": [
                      "pkg:cargo/sarif-viewer@1.2.17"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "sarif-viewer"
          }
        ],
        "category": "vendor",
        "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "ndaal Advisory ID",
          "text": "ndaal-sa-2026-1097"
        }
      ],
      "metrics": [
        {
          "content": {
            "cvss_v3": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 0.0,
              "baseSeverity": "NONE",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
              "version": "3.1"
            },
            "cvss_v4": {
              "attackComplexity": "LOW",
              "attackRequirements": "NONE",
              "attackVector": "NETWORK",
              "baseScore": 0.0,
              "baseSeverity": "NONE",
              "privilegesRequired": "NONE",
              "subAvailabilityImpact": "NONE",
              "subConfidentialityImpact": "NONE",
              "subIntegrityImpact": "NONE",
              "userInteraction": "NONE",
              "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
              "version": "4.0",
              "vulnAvailabilityImpact": "NONE",
              "vulnConfidentialityImpact": "NONE",
              "vulnIntegrityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Release announcement for sarif-viewer 1.2.17. This announcement carries a CVSS 0.0 (NONE) score so the release is represented with a machine-readable, zero-impact metric in the CSAF feed; the tokio finding that the release fixes (RUSTSEC-2026-0386) is scored in ndaal-sa-2026-1000."
        },
        {
          "category": "details",
          "text": "Highlights: a dependency refresh of 80 crates with no source change; tokio 1.54.1 fixes RUSTSEC-2026-0386, which did not affect sarif-viewer; 55 CSAF advisories (ndaal-sa-2026-961 to 1015) record the bumps. See CHANGELOG.md for the full list."
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0001"
        ]
      },
      "threats": [
        {
          "category": "impact",
          "details": "None. Informational release announcement with no security impact (CVSS v3.1 0.0 / v4.0 0.0, NONE).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "sarif-viewer 1.2.17 release — informational, no security impact (CVSS 0.0)"
    }
  ]
}