orkEndpoints":[{"host":"","url":null,"filePath":"src/services/renderer.ts","lineNumber":1274,"codeSnippet":" 1271 | \n 1272 | try {\n 1273 | // Use Obsidian''s requestUrl function to fetch the image without CORS issues\n> 1274 | const response = await requestUrl({ url: url });\n 1275 | \n 1276 | // Check if the response is an image\n 1277 | if (response.arrayBuffer && response.status === 200) {","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"user-configured"}],"initialDiff":{"pluginId":"data-cards","fromVersion":"1.0.4","toVersion":"1.1.0","files":[{"path":"src/main.ts","hunks":"@@ -449,6 +449,9 @@ export default class DataCardsPlugin extends Plugin {\n const child = new MarkdownRenderChild(el);\n ctx.addChild(child); // ctx.addChild expects a MarkdownRenderChild\n \n+ // Set the current query in the renderer for tag extraction\n+ this.rendererService.setCurrentQuery(query);\n+\n // If not empty, render the cards with the extracted data, passing the child component\n // MarkdownRenderChild is a subclass of Component, so it's compatible with the renderCards signature\n this.rendererService.renderCards(el, dataToRender, settings, child); // Pass child\n","securityAnnotations":[]},{"path":"src/models/settings.ts","hunks":"$21","securityAnnotations":[]},{"path":"src/services/renderer.ts","hunks":"$22","securityAnnotations":[]},{"path":"src/ui/settings-tab.ts","hunks":"$23","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":5}},"initialDiffFrom":"1.0.4","initialDiffTo":"1.1.0","summary":"The data-cards plugin reads files from your Obsidian vault to transform Dataview query results into card layouts. It performs network requests to fetch external content without standard browser security restrictions, meaning it can retrieve URLs that a regular webpage would be blocked from accessing due to CORS policies. The plugin does not appear to exfiltrate data to external servers beyond these configured URL fetches, and its unobfuscated code is available for review.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has protot