tSource":"unresolved"},{"host":"","url":null,"filePath":"_test/capture-hover.js","lineNumber":43,"codeSnippet":" 40 | if (!target) throw new Error(\"No Obsidian target\");\n 41 | console.log(`[CDP] connected to ${target.title}`);\n 42 | \n> 43 | const ws = new WebSocket(target.webSocketDebuggerUrl);\n 44 | let msgId = 0;\n 45 | const pending = new Map();\n 46 | ","networkType":"active-outbound","sendsData":true,"dataDescription":"new WebSocket() opens a persistent network connection","endpointSource":"unresolved"},{"host":"","url":null,"filePath":"_test/exec.js","lineNumber":66,"codeSnippet":" 63 | \n 64 | function fetchJson(url) {\n 65 | return new Promise((resolve, reject) => {\n> 66 | http\n 67 | .get(url, (res) => {\n 68 | let data = \"\";\n 69 | res.on(\"data\", (c) => (data += c));","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"unresolved"},{"host":"","url":null,"filePath":"_test/exec.js","lineNumber":109,"codeSnippet":" 106 | const target = await findObsidianTarget();\n 107 | console.error(`[CDP] target: ${target.title || target.url}`);\n 108 | const wsUrl = target.webSocketDebuggerUrl;\n> 109 | const ws = new WebSocket(wsUrl);\n 110 | let msgId = 0;\n 111 | const pending = new Map();\n 112 | ","networkType":"active-outbound","sendsData":true,"dataDescription":"new WebSocket() opens a persistent network connection","endpointSource":"unresolved"}],"initialDiff":null,"initialDiffFrom":"0.1.2","initialDiffTo":"0.1.3","summary":"Lore Graph reads a single vault file by path and decodes some base64-encoded data with `Buffer.from()` as part of its local processing. It also can make outbound HTTP GET requests, so it can send data to whatever URL it is configured or triggered to request. Based on the listed APIs, it is focused on graph-view behavior rather than broad vault access, and no specific network endpoints were identified here.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","advisoryUrl":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","ghsaId":"GHSA-4w7w-66w2-5vf9","cveId":null,"vulnerableRange":"<=6.4.1","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vi