l({\n 32 | \t\t\turl: url.toString(),\n 33 | \t\t\theaders: {\n 34 | \t\t\t\t''Accept'': ''application/json'',","explanation":"Sends a network request to a specified URL to test the connection","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/Talal-A/obsidian-immich/blob/0.2.1/main.ts#L31"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"main.ts","lineNumber":31,"codeSnippet":" 28 | \tnew Notice(\"Testing connection to \" + url);\n 29 | \ttry {\n 30 | \t\tconst startTime = Date.now();\n> 31 | \t\tconst result = await requestUrl({\n 32 | \t\t\turl: url.toString(),\n 33 | \t\t\theaders: {\n 34 | \t\t\t\t''Accept'': ''application/json'',","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"unresolved"}],"initialDiff":{"pluginId":"immich","fromVersion":"0.1.6","toVersion":"0.2.1","files":[{"path":"main.ts","hunks":"$21","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":5}},"initialDiffFrom":"0.1.6","initialDiffTo":"0.2.1","summary":"The immich plugin establishes connections to a user-specified Immich instance and sends network requests to test connectivity to that endpoint. It does not access Obsidian vault APIs or local vault data, limiting its operations to external network communication. No code obfuscation is present. Privacy considerations are not formally documented for this plugin.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"cross-spawn","packageVersion":">=7.0.0 <7.0.5","severity":"high","title":"Regular Expression Denial of Service (ReDoS) in cross-spawn","advisoryUrl":"https://github.com/advisories/GHSA-3xgq-45jj-v275","ghsaId":"GHSA-3xgq-45jj-v275","cveId":null,"vulnerableRange":">=7.0.0 <7.0.5","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4