ccurrences":4,"additionalLocations":[{"filePath":"src/map-view.ts","lineNumber":583,"codeSnippet":" 580 | \t\tlet styleUrl: string;\n 581 | \t\tif (tileUrls.length === 0) {\n 582 | \t\t\t// No custom tiles configured, use default\n> 583 | \t\t\tstyleUrl = isDark ? 'https://tiles.openfreemap.org/styles/dark' : 'https://tiles.openfreemap.org/styles/bright';\n 584 | \t\t} else if (tileUrls.length === 1 && !this.isTileTemplateUrl(tileUrls[0])) {\n 585 | \t\t\t// Single URL that's not a tile template, treat as style URL\n 586 | \t\t\tstyleUrl = tileUrls[0];","sourceUrl":"https://github.com/obsidianmd/obsidian-maps/blob/0.1.5/src/map-view.ts#L583"},{"filePath":"src/settings.ts","lineNumber":55,"codeSnippet":" 52 | \t\tconst lightModeSetting = new Setting(contentEl)\n 53 | \t\t\t.setName('Light mode')\n 54 | \t\t\t.addText(text => text\n> 55 | \t\t\t\t.setPlaceholder('https://tiles.openfreemap.org/styles/bright')\n 56 | \t\t\t\t.setValue(this.tileSet.lightTiles)\n 57 | \t\t\t\t.onChange(value => {\n 58 | \t\t\t\t\tthis.tileSet.lightTiles = value;","sourceUrl":"https://github.com/obsidianmd/obsidian-maps/blob/0.1.5/src/settings.ts#L55"},{"filePath":"src/settings.ts","lineNumber":68,"codeSnippet":" 65 | \t\t\t.setName('Dark mode (optional)')\n 66 | \t\t\t.setDesc('Tile URL or style URL for dark mode. If not specified, light mode tiles will be used.')\n 67 | \t\t\t.addText(text => text\n> 68 | \t\t\t\t.setPlaceholder('https://tiles.openfreemap.org/styles/dark')\n 69 | \t\t\t\t.setValue(this.tileSet.darkTiles)\n 70 | \t\t\t\t.onChange(value => {\n 71 | \t\t\t\t\tthis.tileSet.darkTiles = value;","sourceUrl":"https://github.com/obsidianmd/obsidian-maps/blob/0.1.5/src/settings.ts#L68"}]}],"scoreChange":5}},"initialDiffFrom":"0.1.5","initialDiffTo":"0.1.6","summary":"The maps plugin adds a map layout view to Obsidian bases without accessing vault APIs directly. It fetches styling configuration data from a user-specified URL to render the map display. No code obfuscation is present, making the network behavior transparent. The confirmed network activity is limited to retrieving configuration data, with no indication of vault content transmission.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.1.3","severity":"high","title":"minimat

Maps