e":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"user-configured"},{"host":"api.github.com","url":"https://api.github.com/repos/${owner}/${repo}/git/ref/${kind}/${ref.split(","filePath":"src/main.ts","lineNumber":299,"codeSnippet":" 296 | for (const kind of [\"heads\", \"tags\"]) {\n 297 | try {\n 298 | requestBudget.consume(`refs/${kind}/${ref}`);\n> 299 | const response = await requestUrl({\n 300 | url: `https://api.github.com/repos/${owner}/${repo}/git/ref/${kind}/${ref.split(\"/\").map(encodeURIComponent).join(\"/\")}`,\n 301 | throw: false\n 302 | });","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"user-configured"}],"initialDiff":null,"initialDiffFrom":"0.1.0","initialDiffTo":"0.2.0","summary":"This plugin does not use Obsidian Vault APIs, so it is not directly reading or writing vault content through the standard API layer. It can send data to the GitHub API at api.github.com, and it can retrieve data from a configured endpoint. It also runs a shell command with `child_process.execFile()`, which could enable additional network-related behavior depending on what that command does.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","advisoryUrl":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","ghsaId":"GHSA-4w7w-66w2-5vf9","cveId":null,"vulnerableRange":"<=6.4.1","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"high","title":"vite: `server.fs.deny` bypass on Windows alternate paths","advisoryUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","ghsaId":"GHSA-fx2h-pf6j-xcff","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vitest","packageVersion":"<3.2.6","severity":"critical","title":"When Vitest UI server is listening, arbitrary file can be read and executed","advisoryUrl":"https://github.com/advisories/GHSA-5xrq-8626-4rwp","ghsaId":"GHSA-5xrq-8626-4rwp","cveId":null,"vulnerableRange":"<3.2.6","fixAvailable":"4.1.10","source":"npm-audit","isDirect":true,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":6,"directDeps":0,"transitiveDeps":0}}]]}]

Banshan Skill Hub