{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_informational_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"Multiple versions of foldhash (0.1.5 and 0.2.0) are present in the dependency tree. This is caused by transitive dependencies pulling different major versions. foldhash is a hash function crate with no security surface — it has no I/O, no unsafe code exposure, and no runtime attack vector.","title":"Summary"},{"category":"description","text":"rust-doctor and Clippy multiple_crate_versions lint flag foldhash 0.1.5 and 0.2.0 co-existing in the dependency tree. This occurs because different transitive dependencies have not aligned on a single foldhash major version. The foldhash crate provides hash functions used internally by hash maps — it contributes minimal code to the binary, has no network or I/O surface, and both versions are actively maintained. The duplication will resolve naturally when upstream crates align on foldhash 0.2.x.","title":"Detailed Description"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"external","summary":"foldhash crate on crates.io","url":"https://crates.io/crates/foldhash"},{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://ndaal.eu/csaf/2026/ndaal-sa-2026-015.json"}],"title":"foldhash multiple versions in dependency tree — no impact","tracking":{"current_release_date":"2026-04-13T08:00:00Z","id":"ndaal-sa-2026-015","initial_release_date":"2026-04-13T08:00:00Z","revision_history":[{"date":"2026-04-13T08:00:00Z","number":"1","summary":"Initial assessment: no impact"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal GmbH & Co KG","branches":[{"category":"product_name","name":"mimetype-cli","branches":[{"category":"product_version","name":"0.1.0","product":{"name":"mimetype-cli 0.1.0","product_id":"CSAFPID-mimetype-cli-0.1.0"}}]}]}]}}