/1.0.3/main.ts#L28"},{"id":731937,"pluginId":"comments","version":"1.0.3","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":46,"codeSnippet":"this.app.vault.on","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/JasperSurmont/obsidian-comments/blob/1.0.3/main.ts#L46"},{"id":731938,"pluginId":"comments","version":"1.0.3","category":"vault_access","severity":"info","filePath":"main.ts","lineNumber":97,"codeSnippet":" 94 | \tasync updateComments(file: TAbstractFile) {\n 95 | \t\tif (!(file instanceof TFile)) return\n 96 | \n> 97 | \t\tconst content = await file.vault.cachedRead(file)\n 98 | \t\tconst comments = this.findComments(file, content, { line: 0, ch: 0 })\n 99 | \n 100 | \t\tthis.app.workspace.getLeavesOfType(VIEW_TYPE_COMMENT).forEach(leaf => {","explanation":"Reads file contents from the vault and extracts comments from them","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/JasperSurmont/obsidian-comments/blob/1.0.3/main.ts#L97"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"comments","fromVersion":"1.0.2","toVersion":"1.0.3","files":[{"path":"main.ts","hunks":"$21","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.0.2","initialDiffTo":"1.0.3","summary":"The comments plugin reads file contents from your vault to extract and manage inline comments within notes, enabling collaborative annotation without leaving your local system. It operates entirely offline with no network connections, so all comment data remains on your device. The plugin applies no obfuscation to comments it processes.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.1.3","severity":"high","title":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","advisor