{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_informational_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"Multiple versions of thiserror-impl (1.0.69 and 2.0.18) are present in the dependency tree. This is caused by sarif_rust and sarif-to-md-core depending on different thiserror major versions. There is no security impact — thiserror is a compile-time proc-macro crate for deriving error types.","title":"Summary"},{"category":"description","text":"Clippy multiple_crate_versions lint (allowed in this project) and rust-doctor both flag the presence of thiserror-impl 1.0.69 and 2.0.18 in the dependency tree. This occurs because sarif_rust v0.3 and sarif-to-md-core v1.2 transitively depend on different major versions of thiserror. The thiserror crate is a purely compile-time proc-macro that generates Display and Error trait implementations — it contributes zero bytes to the runtime binary and has no security surface. The duplicate will resolve naturally when upstream crates align on thiserror 2.x.","title":"Detailed Description"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"external","summary":"thiserror crate on crates.io","url":"https://crates.io/crates/thiserror"},{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://ndaal.eu/csaf/2026/ndaal-sa-2026-014.json"}],"title":"thiserror-impl multiple versions in dependency tree — no impact","tracking":{"current_release_date":"2026-04-12T08:00:00Z","id":"ndaal-sa-2026-014","initial_release_date":"2026-04-12T08:00:00Z","revision_history":[{"date":"2026-04-12T08:00:00Z","number":"1","summary":"Initial assessment: no impact"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal GmbH & Co KG","branches":[{"category":"product_name","name":"mimetype-cli","branches":[{"category":"product_version","name":"0.1.0","product":{"name":"mimetype-cli 0.1.0","product_id":"CSAFPID-mimetype-cli-0.1.0"}}]}]}]}}