[dependabot]

Bumps ssvc from e3b00a2 to bf3213b.

Commits

• bf3213b Merge branch 'publish' into main
• 0f8dea1 Write generated data files as UTF-8 with LF instead of the locale encoding (#...
• c42c1b2 Combine seven Dependabot uv.lock bumps into a single update (#1262)
• 7717618 Bump uv.lock: soupsieve, anyio, mkdocs-table-reader-plugin, pandas, scikit-le...
• b1b2b05 Fix namespace abnf (#1251)
• 11e6fdf Run makedoctools
• 968f940 Updates to .markdownlint
• d677210 Updated to resolve conflicts
• 8728fb3 Correct HI:2.0.2 value definitions to match the DT_HI:1.0.0 decision table (#...
• 5136302 Trigger PR workflows
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

🟢 Approval recommended

No active review issues were identified for the SSVC schema, generated validator, and decision-point data updates.

No open issues 🎉

What changed in this PR

Updates bundled SSVC schemas, generated Rust validators, and decision-point data to reflect upstream changes from e3b00a2 to bf3213b.

Changes:

• Updates namespace patterns in both schemas and generated Rust validators, including support for single-character private-use language subtags.
• Corrects Human Impact 2.0.2 definitions to align with the upstream decision table.

File	Description
src/​generated/​ssvc/​selection_list.rs	Updates namespace validation and its error text.
src/​generated/​ssvc/​decision_point.rs	Updates namespace validation and its error text.
assets/​ssvc_decision_points/​ssvc/​human_impact_2_0_2.json	Corrects Low, Medium, and High impact definitions.
assets/​SelectionList_2_0_0.schema.json	Updates the selection-list namespace pattern.
assets/​DecisionPoint_2_0_0.schema.json	Updates the decision-point namespace pattern.

_{Review effort: Balanced}

[peinjoh]

Relevant changes:

• Human Impact definitions corrected -> updating the assets should be enough
• Should ssvc/ be allowed? CERTCC/SSVC#1233 was fixed: empty language extension (ssvc/) is rejected unless followed by an extension segment now. Regex will catch this, our custom namespace parser now provides a seperate error message.
• [CSAF] Pattern wrong CERTCC/SSVC#1239 was fixed: private use subtags regex now follows RFC 5646 -> updating the asset should be enough, we don't validate bcp47 in the custom namespace parser so far, so no changes are necessary there

We should probably add tests for both, and check if our validator does this right.