thiserror-impl multiple versions in dependency tree — no impact

Metadata

Vulnerabilities (0)

No vulnerabilities.

Raw JSON

{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_informational_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple versions of thiserror-impl (1.0.69 and 2.0.18) are present in the dependency tree. This is caused by sarif_rust and sarif-to-md-core depending on different thiserror major versions. There is no security impact — thiserror is a compile-time proc-macro crate for deriving error types.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "Clippy multiple_crate_versions lint (allowed in this project) and rust-doctor both flag the presence of thiserror-impl 1.0.69 and 2.0.18 in the dependency tree. This occurs because sarif_rust v0.3 and sarif-to-md-core v1.2 transitively depend on different major versions of thiserror. The thiserror crate is a purely compile-time proc-macro that generates Display and Error trait implementations — it contributes zero bytes to the runtime binary and has no security surface. The duplicate will resolve naturally when upstream crates align on thiserror 2.x.",
        "title": "Detailed Description"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "external",
        "summary": "thiserror crate on crates.io",
        "url": "https://crates.io/crates/thiserror"
      },
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://ndaal.eu/csaf/2026/ndaal-sa-2026-014.json"
      }
    ],
    "title": "thiserror-impl multiple versions in dependency tree — no impact",
    "tracking": {
      "current_release_date": "2026-04-12T08:00:00Z",
      "id": "ndaal-sa-2026-014",
      "initial_release_date": "2026-04-12T08:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-12T08:00:00Z",
          "number": "1",
          "summary": "Initial assessment: no impact"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "ndaal GmbH & Co KG",
        "branches": [
          {
            "category": "product_name",
            "name": "mimetype-cli",
            "branches": [
              {
                "category": "product_version",
                "name": "0.1.0",
                "product": {
                  "name": "mimetype-cli 0.1.0",
                  "product_id": "CSAFPID-mimetype-cli-0.1.0"
                }
              }
            ]
          }
        ]
      }
    ]
  }
}