00Z","releaseDate":"2026-06-14T07:17:23.000Z","artifactStatus":"verified"},{"id":109003,"version":"1.1.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-15T02:05:31.000Z","releaseDate":"2026-06-12T17:15:55.000Z","artifactStatus":null},{"id":109002,"version":"1.1.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-15T02:05:21.000Z","releaseDate":"2026-06-12T17:02:41.000Z","artifactStatus":null},{"id":109001,"version":"1.0.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-15T02:05:11.000Z","releaseDate":"2026-06-07T13:13:51.000Z","artifactStatus":null}],"findings":[{"id":1105259,"pluginId":"habit-heatmap-calendar","version":"1.2.0","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":41,"codeSnippet":"this.app.workspace.layoutReady","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/alt-forge/Habit-Heatmap-Calendar/blob/refs/tags/1.2.0/main.ts#L41"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.1.1","initialDiffTo":"1.2.0","summary":"Habit Heatmap Calendar appears to generate a local heatmap-style calendar for habit tracking inside Obsidian. In the reviewed build, it does not use Obsidian vault APIs, so it is not confirmed to read or modify vault notes through the standard file interfaces. No network activity was observed, so it does not send data to any remote service in the observed configuration.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.3.0","severity":"high","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","advisoryUrl":"https://github.com/advisories/GHSA-52cp-r559-cp3m","ghsaId":"GHSA-52cp-r559-cp3m","cveId":null,"vulnerableRange":">=4.0.0 <4.3.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":7,"directDeps":0,"transitiveDeps":0}}]]}]