ndaal Informational Advisory: v0.1.40 — EPSS/KEV enrichment feeder switches from community KEV-restricted GitHub CSV to FIRST.org bulk dataset; KEV flag now accurately cross-referenced against the CISA KEV catalog (table grows from ~1,200 to ~300,000+ rows; kev: true no longer hard-coded)
ndaal Informational Advisory: v0.1.41 — vendor-dashboard recent-25 tables on CVE-5.0 sources (vulnrichment / cvelistv5 / ubuntu / rust) regressed to render empty Severity / Published / Title columns from v0.1.36 onwards; the helpers in `routes/vendor_dashboard.rs` only walked legacy CSAF / OSV paths and missed `/containers/cna/...` and `/cveMetadata/...`. v0.1.41 ships a shared `routes/cve5.rs` module with the canonical CVE 5.0 / NVD / CSAF / OSV / EUVD extractors and rewires both `routes/home.rs` and `routes/vendor_dashboard.rs` to delegate to it; the dashboard helpers retain their CSAF / OSV first-pass logic and fall back to cve5 for CVE-5.0-shaped rows. Bonus fix: the lifted `extract_title` now also reads `/containers/cna/title` and `/containers/cna/descriptions[lang=en].value`, two paths the pre-v0.1.41 `home.rs::extract_title` was also missing.
ndaal Informational Advisory: v0.1.42 — CSAF Trusted Provider downloader (`crates/vl-feeders/src/csaf_downloader.rs`) parsed RFC 4180 quoted CSV fields verbatim from v0.1.0 through v0.1.41. Red Hat (the canonical quoted-CSV provider) ships every path in `changes.csv` as `"YYYY/rhsa-YYYY_NNNN.json"`; the parser stored those quotes inside `AdvisoryRef::path` and `join_url` percent-encoded each `"` as `%22`, yielding dead URLs of the form `…/advisories/%22YYYY/rhsa-YYYY_NNNN.json%22` that always returned HTTP 404. Net effect: zero Red Hat advisories ever imported on v0.1.0..v0.1.41 and the 404 storm contributed to operator-facing HTTP timeouts under feeder load. v0.1.42 introduces `strip_csv_quotes(s: &str) -> &str` and applies it to every CSV field consumed by `parse_changes_csv` and `parse_index_txt`; three regression-pin tests in `csaf_downloader::tests` lock the fix.
ndaal Informational Advisory: v0.1.42 — daemon's tokio runtime split into dedicated HTTP and feeder executors so heavy feeder phases (CWE enrichment scan, NVD page parse, Debian 72 MB tracker parse, EPSS gz decompress) no longer starve HTTP request handlers. v0.1.0..v0.1.41 spawned every feeder loop on the same 4-worker `#[tokio::main]` runtime that served HTTP, producing multi-minute timeouts on /dashboards/* and /api/v1/* during each feeder cycle. v0.1.42 introduces `crates/vl-web/src/feeder_runtime.rs` with a `pub fn build_feeder_runtime()` helper, trims the HTTP runtime from `worker_threads = 4` to `worker_threads = 2`, rewires every `tokio::spawn(...)` in the feeder block of `main.rs` to `feeder_handle.spawn(...)` (25 sites), and adds `VL_FEEDER_WORKER_THREADS` for operator tuning. Total daemon capacity 4 → 6 worker threads (2 HTTP + 4 feeder); isolation enforced.
ndaal Informational Advisory: introduction of the dashboard-branding CSAF 2.1 vendor extension across the ndaal CSAF Trusted Provider feed. All 41 existing 2026 advisories (ndaal-sa-2026-001 through ndaal-sa-2026-041) gained one `document.x_extensions[]` element carrying operator-facing dashboard labels — `publisher_brand: 'ndaal Advisories Database'` (rendered in the nvulnlookup `/dashboards/<slug>` page <h1>) and `dashboard_short_name: 'ndaal'` (rendered in the navbar dropdown). Two new schema files ship at `csaf/extensions/dashboard-branding_1.0.0.json` (extension content schema, $id `https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json`, SemVer-suffixed per CSAF 2.1 extension URL regex) and `csaf/extensions/dashboard-branding-metadata_1.0.0.json` (extension metadata, `valid_locations: [{path: '/document/x_extensions', max_occurrence: 1}]`, `requirement: 'Optional'`). `csaf/provider-metadata.json` additionally carries `publisher.x_publisher_brand` + `publisher.x_dashboard_short_name` (provider.json schema does not set additionalProperties:false on publisher). All 123 sidecar files (41 advisories x SHA-256 / SHA-512 / SHA3-512) regenerated so on-disk hashes match the post-enrichment JSON bytes. Validator behaviour unchanged: 0 NEW errors per advisory after enrichment. Compliant with OASIS CSAF 2.1 Draft 2+.
ndaal Informational Advisory: strict CSAF 2.1 validation repair sweep across 41 prior 2026 advisories. Adds `csaf/repair_csaf_validation_errors.sh` (idempotent, 18 reparation patterns A-R) plus `repair_csaf_validation_errors.bats` (16-test bats sister). Repairs three categories of pre-existing schema violations: (1) CSAF 2.0 vestiges that 2.1 rejects (`cwe`->`cwes[]`, `scores`->`metrics`, `purl`->`purls[]`, missing `cwes[].version`); (2) §6.1.x semantic rules not previously enforced (informational must not have /vulnerabilities, security_advisory must have known_affected, vex must have per-vulnerability notes + cve/ids, known_not_affected needs flags[], conflicting product_status buckets, status/version/revision_history reconciliation, informational external reference); (3) CVSS v3/v4 misalignments (cvss_v4 v3-name fields, vectorString not decomposed into named properties, baseScore mismatches recomputable via the `cvss` Python module). Patterns N + O optionally consume the `cvss` Python module for v3/v4 score recompute + vector decomposition; both no-op if absent. Validation result post-sweep: 42 / 42 PASS strict csaf-validator 0.4.1 (no `--allow-validator-bugs` filter) + 42 / 42 PASS OASIS-hosted jsonschema (Python jsonschema Draft 2020-12). Important spec correction: an earlier note in CLAUDE.md claimed `purl` was a `csaf-validator 0.4.1` schema bug — it is NOT. CSAF 2.1 actually renamed `product_identification_helper.purl` (string) to `purls` (array of strings); Pattern H performs the migration. Idempotent: re-runs on a clean tree produce zero byte-changes. Sidecar checksums regenerated for all 41 modified advisories (123 sidecars across SHA-256 / SHA-512 / SHA3-512).
ndaal Informational Advisory: strict CSAF 2.1 stance pinned for non-UTF-8 advisories + per-distribution resilience added to the CSAF importer. (1) 77 of 85,559 (0.09%) openSUSE/SUSE CSAF advisories ship non-UTF-8 bytes inside JSON string fields, violating RFC 8259 §8.1 and CSAF 2.1 §9.1.5; `crates/vl-feeders/src/csaf_generic.rs` now skips these advisories cleanly with an RFC-cited `tracing::warn!` and a pinning unit test (`test_read_to_string_rejects_non_utf8`) freezes the strict-decode contract. (2) TuxCare's provider-metadata.json advertises 144 distributions of which 4 (on repo.tuxcare.com — centos7-els + oraclelinux7-els × advisories+vex) return HTTP 404 on both index.txt and changes.csv; `crates/vl-feeders/src/csaf_downloader.rs` no longer propagates the first per-distribution discovery failure with `?` — it logs a warning, increments `report.failed`, and continues with sibling distributions, so the 140 working TuxCare distributions on security.tuxcare.com now import successfully instead of being aborted by the first 404. Byte distribution across the 77 non-UTF-8 files: 30× 0xae (®), 26× 0xe9 (é), 20× 0xa0 (NBSP), 16× 0xf6 (ö), 10× 0xb3 (³), 10× 0xb9 (¹), 9× 0xa7 (§), 4× 0xea (ê), 3× 0xfc (ü), 3× 0xb0 (°), 2× 0xe1 (á), 1× 0xb6 (¶), 1× 0xf8 (ø), 1× 0xb2 (²), 1× 0xed (í). Year distribution: 2019:1, 2020:7, 2021:3, 2022:6, 2023:12, 2024:5, 2025:17, 2026:23. Not a security vulnerability under CVSS — no CIA impact; severity informational. Sidecar checksums (.sha-256/.sha-512/.sha3-512/.blake3-512/.shake256-512) regenerated.
ndaal Information Advisory: ndaal_public_nvulnlookup vl-web — JSON-API full-text search (/api/v1/vulnerabilities/search) returned 503/empty without Meilisearch and rejected the limit query parameter; embedded redb fallback + limit parsing restore parity with the HTML /search page
grundschutz-oscal-viewer 1.6.40 — release announcement: CMMI Maturity Level field on annotations (six levels 0 Incomplete … 5 Innovating), the exhaustive fifteen-version --seed-demo / test sequence walking the maturity level, full endpoint Bruno coverage and proptest/fuzz/cargo-mutants/Miri verification, and a parse_args complexity refactor; the release also carries fifteen Low-severity hardening fixes tracked in ndaal-sa-2026-234 through -248
ndaal Security Advisory: Encryption key rotation was impossible and attempting it silently orphaned every sealed value (grundschutz-oscal-viewer < 1.6.54)