ot specified\n 101 | if (!version) {\n 102 | const releaseUrl = `https://api.github.com/repos/${REPO_OWNER}/${REPO_NAME}/releases/latest`;\n> 103 | const releaseResp = await requestUrl({ url: releaseUrl });\n 104 | version = (releaseResp.json as { tag_name: string }).tag_name.replace(/^v/, \"\");\n 105 | }\n 106 | ","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"hardcoded-url"},{"host":"github.com","url":null,"filePath":"src/binary-manager.ts","lineNumber":115,"codeSnippet":" 112 | \n 113 | // Download checksums — required; abort if unavailable\n 114 | this.setStatus(\"downloading\", \"Downloading checksums...\");\n> 115 | const checksumResp = await requestUrl({ url: `${baseUrl}/checksums.json` });\n 116 | const checksums = checksumResp.json as Record;\n 117 | \n 118 | // Download binary zip","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"hardcoded-url"},{"host":"github.com","url":null,"filePath":"src/binary-manager.ts","lineNumber":120,"codeSnippet":" 117 | \n 118 | // Download binary zip\n 119 | this.setStatus(\"downloading\", `Downloading ${assetName}...`);\n> 120 | const zipResp = await requestUrl({\n 121 | url: `${baseUrl}/${assetName}`,\n 122 | contentType: \"application/octet-stream\",\n 123 | });","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"hardcoded-url"}],"initialDiff":null,"initialDiffFrom":"1.1.15","initialDiffTo":"1.1.16","summary":"Hermes Console can access all files in your vault and read individual files by path, and when you trigger the share action it can send highlighted note text to Hermes Agent. Separately, it makes allowlisted network requests to GitHub to check the latest release and download a checksums file. In other words, its confirmed network use is for update-related GitHub lookups, while its main content-handling capability is forwarding selected note text to Hermes Agent when you choose to do so.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":">=0.27.3 <0.28.1","severity":"low","title":"esbuild allows arbitrary file read when running the development server on Windows","advisoryUrl":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","ghsaId":"GHSA-g7r4-m6w7-qqqr","cveId":null,"vulnerableRange":">=0.27.3 <0.28.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=7.0.0 <=7.3.4","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":">=7.0.0 <=7.3.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=7.0.0 <=7.3.4","severity":"high","title":"vite: `server.fs.deny` bypass on Windows alternate paths","advisoryUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","ghsaId":"GHSA-fx2h-pf6j-xcff","cveId":null,"vulnerableRange":">=7.0.0 <=7.3.4","fixAvailable":null,