aintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/mattmaiorana/calendar-plus/blob/refs/tags/2.1.13/src/ui/file-suggest.ts#L26"},{"id":1062039,"pluginId":"calendar-plus","version":"2.1.13","category":"permissions_scope","severity":"info","filePath":"src/view.ts","lineNumber":295,"codeSnippet":"this.app.fileManager.trashFile","explanation":"Accesses Obsidian API: app.fileManager","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/mattmaiorana/calendar-plus/blob/refs/tags/2.1.13/src/view.ts#L295"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"2.1.12","initialDiffTo":"2.1.13","summary":"Calendar Plus confirms it can read a specific vault file by path and access all files in your vault, which it uses to build calendar views and manage daily, weekly, monthly, quarterly, and yearly notes. In practice, that means it can inspect your note contents and file structure within the vault as part of its normal operation. It does not have documented network activity, so it does not send data to any external service based on the available information.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=3.0.0 <5.0.7","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=3.0.0 <5.0.7","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=4.0.0 <5.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.3.0","severity":"high","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","advisoryUrl":"https://github.com/advisories/GHSA-52cp-r559-cp3m","ghsaId":"GHSA-52cp-r559-cp3m","cveId":null,"vulnerableRange":">=4.0.0 <4.3.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":18,"directDeps":2,"transitiveDeps":0}}]]}]