csaf_ndaal:ndaal-sa-2026-1093

{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_informational_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "grundschutz-oscal-viewer 1.6.67 bumps the `web-sys` dependency 0.3.104 -> 0.3.106. Routine lockfile refresh (trivial: `cargo update` inside the existing version requirements, so no source change was expected and none was needed). The crate is a transitive dependency, not one named in Cargo.toml. It remediates NO published security advisory (no RUSTSEC / CVE is fixed by this bump); it is recorded for supply-chain traceability. Security impact: none - CVSS v3.1 base score 0.0 (None).",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "No source change: only Cargo.lock moved. `cargo update` moved web-sys 0.3.104 to 0.3.106. Not compiled into any release binary: an optional dependency edge, or build or test tooling. The upstream release notes of this refresh were not individually reviewed; the basis for the update is that it stays inside the semver ranges the dependents declare, that `cargo audit` and `cargo deny check` pass on the refreshed lockfile, and that the checks below pass. Checks run on the refreshed tree: `cargo fmt --check`, `cargo clippy --workspace --all-targets --all-features -- -D warnings`, `cargo audit`, `cargo deny check`. The full test suite had not been re-run when this advisory was written.",
        "title": "Upgrade Notes"
      },
      {
        "category": "general",
        "text": "Security / CVSS assessment: this dependency update introduces and remediates no known vulnerability. It has no confidentiality, integrity, or availability impact. CVSS v3.1 base score: 0.0 (None). CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N. CVSS v4.0 base score: 0.0 (None). CVSS v4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N. (Per CSAF rule 6.1.27.3 an informational advisory carries no /vulnerabilities element, so these scores are stated here rather than in a machine-readable metrics block.)",
        "title": "CVSS / Security Assessment"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
      "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1093/ndaal-sa-2026-1093.json"
      },
      {
        "category": "external",
        "summary": "web-sys crate on crates.io",
        "url": "https://crates.io/crates/web-sys"
      },
      {
        "category": "external",
        "summary": "grundschutz-oscal-viewer 1.6.67 CHANGELOG",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/blob/main/CHANGELOG.md"
      }
    ],
    "title": "ndaal Informational Advisory: web-sys 0.3.104 -> 0.3.106 bump (grundschutz-oscal-viewer 1.6.67)",
    "tracking": {
      "current_release_date": "2026-10-25T18:55:24.000Z",
      "generator": {
        "engine": {
          "name": "ndaal CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ndaal-sa-2026-1093",
      "initial_release_date": "2026-10-25T18:55:24.000Z",
      "revision_history": [
        {
          "date": "2026-10-25T18:55:24.000Z",
          "number": "0.0.1",
          "summary": "Draft prepared before the release of grundschutz-oscal-viewer 1.6.67. Finalise (status final, version 1.0.0) when it ships."
        }
      ],
      "status": "draft",
      "version": "0.0.1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.6.67",
                "product": {
                  "name": "grundschutz-oscal-viewer 1.6.67 - ships web-sys 0.3.106",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "purls": [
                      "pkg:cargo/grundschutz-oscal-viewer@1.6.67"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "grundschutz-oscal-viewer"
          }
        ],
        "category": "vendor",
        "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG"
      }
    ]
  }
}