ndaal Information Advisory: mimetype-cli 0.1.3 — cap-std / cap-tempfile v3 → v4 supported-major bump (3.4.5 → 4.0.2) + 5 transitive crates drop off the dependency graph
Metadata
| Tracking ID | ndaal-sa-2026-079 |
|---|---|
| Category | csaf_informational_advisory |
| CSAF Version | 2.1 |
| Status | final |
| Version | 1.1.0 |
| Publisher | ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG |
| TLP | CLEAR |
| Initial Release | 2026-05-27T00:00:00.000Z |
| Current Release | 2026-08-09T20:00:00.000Z |
Vulnerabilities (0)
No vulnerabilities.
Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_informational_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "mimetype-cli 0.1.3 (Rust binary + library crate published from ndaal_public_mediatypes-cli) lifts the capability-secure filesystem layer onto the upstream-supported cap-std / cap-tempfile v4 line. The 3.x line — which 0.1.2 had just introduced (see ndaal-sa-2026-078) — is now off the Bytecode Alliance's supported-major cadence; this release moves to v4 to stay inside the security-backport window for `openat2(RESOLVE_BENEATH)` correctness fixes and future capability-handle hardening. The v3 → v4 jump is API-quiet at the surface mimetype-cli uses (`Dir::open`, `Dir::open_ambient_dir`, `Dir::create`, `Dir::open_dir`, `Dir::entries`, `Dir::rename`, `Dir::read_to_string`, `TempDir::new` — all unchanged). No source-file edits were needed to compile or pass the existing 60-vector path-traversal regression suite from 0.1.2.\n\nDependency-graph diff vs 0.1.2 (cargo update lockfile):\n cap-std 3 → 4 (3.4.5 → 4.0.2 on the lockfile)\n cap-tempfile 3 → 4 (3.4.5 → 4.0.2 on the lockfile)\n io-extras 0.18.4 → 0.19.0 (new minor)\n io-lifetimes -- → 3.0.1 (new transitive)\n rand 0.8.6 → -- (no longer pulled in by the v4 line)\n rand_chacha 0.3.1 → -- (same)\n rand_core 0.6.4 → -- (same)\n getrandom 0.2.17 → -- (same)\n wasi 0.11.1 → -- (same)\n\nNet supply-chain effect: 5 transitive crates DROP off the graph (rand + 4 of its transitives), 1 crate is added (io-lifetimes), 1 crate is bumped (io-extras). The drop of rand/getrandom/wasi is a defence-in-depth win — fewer transitive crates means a smaller cargo-audit / cargo-vet surface."
},
{
"category": "description",
"text": "Detail per change:\n\n1. cap-std 3 → 4 (3.4.5 → 4.0.2 on the lockfile):\n * Upstream's v4 line is the current supported major. The Bytecode\n Alliance ships cap-std on a supported-major cadence — every\n major sees ~12 months of security backports, then floats off\n support. v3 has already started the float-off phase (last\n point release 3.4.5 was the supported-line terminator); v4 is\n where new openat2 / RESOLVE_BENEATH correctness fixes land\n going forward.\n * API surface mimetype-cli uses is byte-identical between 3.4.5\n and 4.0.2: `Dir::open`, `Dir::open_ambient_dir`, `Dir::create`,\n `Dir::open_dir`, `Dir::entries`, `Dir::rename`,\n `Dir::read_to_string` — all unchanged. The v4 major bump\n mainly drops the legacy `rand`-based RNG path for unguessable\n filename generation in favour of a direct `getrandom`-free\n algorithm, which is why the rand / rand_chacha / rand_core /\n getrandom / wasi transitives all leave the graph (see point\n 3 below).\n * mimetype-cli 0.1.2 source compiles unchanged against 4.0.2 —\n no code edits required. The 60-vector path-traversal\n regression suite (`tests/test_path_security.rs`) introduced in\n 0.1.2 still passes 56 named + 4 exhaustive sequences with no\n changes to the test vectors.\n\n2. cap-tempfile 3 → 4 (3.4.5 → 4.0.2 on the lockfile):\n * Lockstep with cap-std per the upstream invariant — the two\n crates share `cap-primitives` (also bumped to 4.x) and the\n skills/rust-path-security.md house rule mandates lockstep\n major-version bumps for this pair.\n * `TempDir::new(&Dir)` and `TempDir::new_in(&Dir)` signatures and\n drop semantics are unchanged at the API surface mimetype-cli\n uses.\n\n3. Transitive dependency graph cleanup:\n * REMOVED (5 crates, no longer pulled by the v4 line):\n rand 0.8.6\n rand_chacha 0.3.1\n rand_core 0.6.4\n getrandom 0.2.17\n wasi 0.11.1\n The drop chain is rooted in cap-tempfile v3.x using `rand` to\n generate unguessable temp-file names; v4 uses a direct\n `*at` syscall pattern that doesn't need a userspace RNG.\n * ADDED (1 crate, new transitive):\n io-lifetimes 3.0.1\n Pulled in by cap-std v4's tighter OwnedFd / BorrowedFd handle\n model.\n * BUMPED (1 crate, new minor):\n io-extras 0.18.4 → 0.19.0\n Same dependency-tree shift as io-lifetimes; the io-extras\n 0.19 line is the partner of io-lifetimes 3.x.\n\n4. Supply-chain audit (all changes):\n * cargo audit — no advisories on any of the new versions.\n * cargo deny check — licences + sources + bans all OK; the\n dropped `wasi` transitive removes the BSD-3-Clause-Patent\n licence row from the workspace's licence inventory (was\n already allowed; just shrinks the list).\n * cargo vet check — no fresh suggestions; cap-std v4 + cap-\n tempfile v4 + io-lifetimes 3.0.1 + io-extras 0.19.0 are all\n covered by the workspace's existing audit store reuse from\n the parent workspace's cap-std v4 entries (the parent already\n uses the v4 line for its own filesystem-touching crates).\n * No transitive crates gained `aws-lc-sys` / `aws-lc-rs` /\n `openssl-sys` as a result of any of these changes. The\n ring-only TLS posture is preserved.\n\nWhat this release does NOT change: CLI flags, output formats\n(text + markdown + JSON + native SARIF 2.1.0), exit codes, library\nAPI at the documented boundary (`mimetype_cli::detect`,\n`mimetype_cli::path_security::safe_join`, `mimetype_cli::fs::DataDir`,\netc.), the embedded MIME corpus, magic-byte fallback ordering, or\nany of the documented integration points. The 60-vector\npath-traversal regression suite from 0.1.2 is preserved bit-exact.\n\nOperators on the binary release ship just need the new tarball /\n.deb / .rpm; library consumers can bump `mimetype-cli = \"0.1.3\"`\nin their `Cargo.toml` and rebuild without source edits. No\nconfiguration change is required."
},
{
"category": "details",
"text": "Verification (0.1.3):\n cargo update # lockfile picks cap-std 4.0.2 + cap-tempfile 4.0.2\n cargo tree -i rand 2>&1 | wc -l # 0 (rand dropped from the graph)\n cargo tree -i io-lifetimes # io-lifetimes 3.0.1 (new transitive)\n cargo build --release # clean\n cargo test --workspace --all-features # full suite passes\n cargo test --test test_path_security --all-features # 56 named + 4 exhaustive vectors pass\n cargo test --doc # doctests pass\n cargo clippy --workspace --all-targets --all-features -- -D warnings # rc=0\n cargo audit --deny warnings --deny unsound --deny unmaintained --deny yanked # no advisories\n cargo deny check # licenses + sources + bans + advisories OK\n cargo vet check # supply-chain store accepts every dep\n cargo +nightly fuzz run fuzz_detect_bytes -- -max_total_time=60 # no crashes\n cargo +nightly fuzz run fuzz_safe_join -- -max_total_time=300 # no crashes\n\nUpgrade path: drop-in upgrade from 0.1.2. Library consumers who use\nthe capability-secure `DataDir` codepath introduced in 0.1.2 will\nsee the underlying cap-std / cap-tempfile internals move to v4\nautomatically when they bump the mimetype-cli pin — no signature\nchanges at the mimetype-cli boundary. Operators concerned about\nthe cap-std v3 → v4 major bump can audit the delta in their own\ncargo-vet store by running `cargo vet diff cap-std 3.4.5 4.0.2`\nand `cargo vet diff cap-tempfile 3.4.5 4.0.2`."
},
{
"category": "general",
"text": "Recommended action: upgrade to mimetype-cli 0.1.3 or later to stay inside the cap-std / cap-tempfile v4 support window — the v3 line is past its supported-major cutoff and will not receive future `openat2(RESOLVE_BENEATH)` correctness fixes or capability-handle hardening from upstream. The bonus supply-chain win is the 5 transitive crates that DROP off the graph (rand 0.8.6, rand_chacha 0.3.1, rand_core 0.6.4, getrandom 0.2.17, wasi 0.11.1), shrinking the cargo-audit / cargo-vet surface accordingly. No configuration change is required. Library consumers receive identical API at the documented boundary; CLI users receive identical flags + output formats."
},
{
"category": "other",
"text": "Severity classification: this is a security-hygiene maintenance release. No known exploitable CVE was previously present in mimetype-cli 0.1.2 against the cap-std / cap-tempfile v3 line; the bump to v4 is forward-looking — it puts the crate inside the upstream-supported-major window so future security backports flow in without a major-version dance later. The advisory is informational and is published so downstream consumers + SBOM tooling can trace the dependency-graph shift between 0.1.2 and 0.1.3 (5 transitive crates removed, 1 added, 1 bumped — see the dependency table in the description). Status: final."
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
},
{
"category": "general",
"text": "Follow-up recorded 2026-08-09. The capability-secure filesystem layer this advisory describes — cap-std / cap-tempfile, mimetype_cli::path_security::safe_join and mimetype_cli::fs::DataDir — was REMOVED from the source tree after 0.1.3 and was therefore absent from mimetype-cli 1.1.4, which was published to crates.io on 2026-08-08. The removal happened in the unpublished 0.1.4 development version, so 0.1.2 and 0.1.3 shipped the layer exactly as described above; no statement in the original text of this advisory is retracted. Verified against the crates.io dependency API: 0.1.2 declares cap-std ^3 and cap-tempfile ^3, 0.1.3 declares cap-std ^4 and cap-tempfile ^4, and 1.1.4 declares neither. Impact of the gap: for the duration of 1.1.4 the tool performed all filesystem access through ambient authority (bare std::fs and walkdir) rather than through a cap-std Dir handle. The practical exposure is narrow — mimetype-cli is a local, single-user CLI that inspects paths its own operator names, so there is no privilege boundary for a traversal to cross, and no CVE or RUSTSEC advisory applies. It is recorded because the control was a documented property of the product and its silent loss is a supply-chain fact, not because it is known to be exploitable. Remediation: cap-std 4.0.2 and cap-tempfile 4.0.2 were restored in 1.1.5 together with a 57-vector path-traversal regression corpus, and the report-writing path now runs through a single DataDir capability handle. The restoration is mutation-checked: removing the containment guard fails 11 of the 57 vectors and removing the NUL guard fails 5.",
"title": "Status update — capability layer removed in 1.1.4, restored in 1.1.5"
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_mediatypes-cli/-/raw/main/csaf/2026/079/ndaal-sa-2026-079.json"
},
{
"category": "external",
"summary": "mimetype-cli on crates.io",
"url": "https://crates.io/crates/mimetype-cli"
},
{
"category": "external",
"summary": "ndaal_public_mediatypes-cli repository",
"url": "https://gitlab.com/vPierre/ndaal_public_mediatypes-cli"
},
{
"category": "external",
"summary": "Previous release advisory — mimetype-cli 0.1.2 capability-secure filesystem layer",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/078/ndaal-sa-2026-078.json"
},
{
"category": "external",
"summary": "cap-std 4.0.2 — current supported-major line on crates.io",
"url": "https://crates.io/crates/cap-std/4.0.2"
},
{
"category": "external",
"summary": "cap-tempfile 4.0.2 — lockstep partner of cap-std v4",
"url": "https://crates.io/crates/cap-tempfile/4.0.2"
},
{
"category": "external",
"summary": "io-lifetimes 3.0.1 — new transitive added by cap-std v4",
"url": "https://crates.io/crates/io-lifetimes/3.0.1"
},
{
"category": "external",
"summary": "io-extras 0.19.0 — partner-bump of io-lifetimes 3.x",
"url": "https://crates.io/crates/io-extras/0.19.0"
},
{
"category": "external",
"summary": "skills/rust-path-security — house rule documenting cap-std/-tempfile minimum v4 + lockstep major-version policy",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/blob/main/skills/rust-path-security.md"
},
{
"category": "external",
"summary": "bytecodealliance/cap-std — upstream repository (release notes for 3.x → 4.0)",
"url": "https://github.com/bytecodealliance/cap-std"
}
],
"title": "ndaal Information Advisory: mimetype-cli 0.1.3 — cap-std / cap-tempfile v3 → v4 supported-major bump (3.4.5 → 4.0.2) + 5 transitive crates drop off the dependency graph",
"tracking": {
"current_release_date": "2026-08-09T20:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-079",
"initial_release_date": "2026-05-27T00:00:00.000Z",
"revision_history": [
{
"date": "2026-05-27T00:00:00.000Z",
"number": "1.0.0",
"summary": "Initial informational advisory announcing mimetype-cli 0.1.3. Lifts the capability-secure filesystem layer (introduced in 0.1.2 — see ndaal-sa-2026-078) from cap-std / cap-tempfile v3.x to v4.x so the crate stays inside the Bytecode Alliance's supported-major window for openat2(RESOLVE_BENEATH) correctness fixes and future capability-handle hardening. Lockfile bump: cap-std 3.4.5 → 4.0.2, cap-tempfile 3.4.5 → 4.0.2. Net dependency-graph diff: 5 transitive crates DROP (rand 0.8.6, rand_chacha 0.3.1, rand_core 0.6.4, getrandom 0.2.17, wasi 0.11.1 — no longer pulled by the v4 line); 1 crate ADDED (io-lifetimes 3.0.1, new transitive of cap-std v4); 1 crate BUMPED (io-extras 0.18.4 → 0.19.0, lockstep partner of io-lifetimes 3.x). API surface mimetype-cli uses is byte-identical between cap-std 3.4.5 and 4.0.2 — no source-file edits were needed. The 60-vector path-traversal regression suite from 0.1.2 still passes bit-exact (56 named + 4 exhaustive sequences). No CLI / library-API / on-disk-format / output-format change vs 0.1.2. Status: final."
},
{
"date": "2026-08-09T20:00:00.000Z",
"number": "1.1.0",
"summary": "Status update: the capability layer described here was removed after 0.1.3 and absent from 1.1.4; restored in 1.1.5. No original statement retracted."
}
],
"status": "final",
"version": "1.1.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "mimetype-cli",
"branches": [
{
"category": "product_version",
"name": "0.1.2",
"product": {
"name": "mimetype-cli 0.1.2 — cap-std 3.4.5, cap-tempfile 3.4.5, io-extras 0.18.4; pulls rand 0.8.6 + rand_chacha 0.3.1 + rand_core 0.6.4 + getrandom 0.2.17 + wasi 0.11.1 as transitives of the v3 cap-tempfile RNG path.",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "0.1.3",
"product": {
"name": "mimetype-cli 0.1.3 — cap-std 4.0.2, cap-tempfile 4.0.2, io-extras 0.19.0, io-lifetimes 3.0.1. rand 0.8.6 + rand_chacha 0.3.1 + rand_core 0.6.4 + getrandom 0.2.17 + wasi 0.11.1 dropped from the transitive graph. No CLI / library-API / on-disk-format change vs 0.1.2; 60-vector path-traversal regression suite preserved bit-exact.",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
}
}