foldhash multiple versions in dependency tree — no impact

Metadata

Vulnerabilities (0)

No vulnerabilities.

Raw JSON

{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_informational_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple versions of foldhash (0.1.5 and 0.2.0) are present in the dependency tree. This is caused by transitive dependencies pulling different major versions. foldhash is a hash function crate with no security surface — it has no I/O, no unsafe code exposure, and no runtime attack vector.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "rust-doctor and Clippy multiple_crate_versions lint flag foldhash 0.1.5 and 0.2.0 co-existing in the dependency tree. This occurs because different transitive dependencies have not aligned on a single foldhash major version. The foldhash crate provides hash functions used internally by hash maps — it contributes minimal code to the binary, has no network or I/O surface, and both versions are actively maintained. The duplication will resolve naturally when upstream crates align on foldhash 0.2.x.",
        "title": "Detailed Description"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "external",
        "summary": "foldhash crate on crates.io",
        "url": "https://crates.io/crates/foldhash"
      },
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://ndaal.eu/csaf/2026/ndaal-sa-2026-015.json"
      }
    ],
    "title": "foldhash multiple versions in dependency tree — no impact",
    "tracking": {
      "current_release_date": "2026-04-13T08:00:00Z",
      "id": "ndaal-sa-2026-015",
      "initial_release_date": "2026-04-13T08:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-13T08:00:00Z",
          "number": "1",
          "summary": "Initial assessment: no impact"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "ndaal GmbH & Co KG",
        "branches": [
          {
            "category": "product_name",
            "name": "mimetype-cli",
            "branches": [
              {
                "category": "product_version",
                "name": "0.1.0",
                "product": {
                  "name": "mimetype-cli 0.1.0",
                  "product_id": "CSAFPID-mimetype-cli-0.1.0"
                }
              }
            ]
          }
        ]
      }
    ]
  }
}