Skip to content

0.5.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Sep 08:40
v0.5.0
747edbe

cvss-rs 0.5.0

This release improves CVSS vector fidelity, makes handling of optional and Not Defined metrics consistent across CVSS versions, and adds a shared severity-banding API. It also introduces an online CVSS vector validator.

Breaking changes

  • The minimum supported Rust version is now 1.88, and the workspace uses Rust edition 2024.
  • CvssV2, CvssV3, and CvssV4 are now #[non_exhaustive]. Downstream code should parse or deserialize CVSS values instead of constructing these structs with exhaustive struct literals.

Highlights

  • Added the public score_to_severity and score_to_severity_v2 helpers for consistent severity banding.
  • Added the public Defined trait, providing a shared way to treat absent and explicitly Not Defined metrics as equivalent during calculations.
  • Added schema-required version fields to CVSS v2 and v4 values while retaining compatibility with documents that omit them during deserialization.
  • Corrected CVSS v3 roundup behavior using specification-aligned integer arithmetic, including boundary-focused tests.
  • Aligned CVSS v3 scoring variable names, ordering, and documentation more closely with the specification.
  • Corrected CVSS v4 nomenclature when optional metrics are explicitly set to Not Defined.
  • Expanded Display implementations to preserve complete temporal and environmental vectors across CVSS v2, v3, and v4 parse/display round trips.
  • Preserved whether a CVSS v2 vector originally included the optional CVSS:2.0/ prefix, including across serde round trips.
  • Added the web-based CVSS vector validator.

Validation

  • Tested on Rust 1.88 and stable across Linux, macOS, and Windows.
  • Compared the merged changes against the current cvelistV5 corpus without finding scoring regressions relative to main or v0.4.0.
  • Verified the crates.io package with cargo publish --dry-run --locked.

Thanks to @ctron, @gronke, and @peinjoh for their contributions, reviews, issue reports, and earlier implementation work that informed this release.

Commit log

Features

  • #17 add Defined trait for NotDefined metric equivalence (fab6054)
  • Add score-to-severity helpers (2035eba)
  • Add web-based CVSS vector string validator (463ba6e)

Fixes

  • Allow release workflow OIDC publishing (747edbe)
  • Preserve v2 prefix across serde round trips (0bedc4c)
  • #34 v2 Display includes temporal/environmental metrics and round-trips all versions (8979406)
  • Use integer arithmetic for v3 roundup (98aa4de)
  • Handle undefined metrics consistently (6cf7cd0)
  • Add required version fields to CVSS v2 and v4 (f5ff63c)
  • #23 make ProviderUrgency (U) metric parsing case-insensitive (998aec9)

Full changelog: v0.4.0...v0.5.0

Assets 2
Loading