s#L583","occurrences":4,"additionalLocations":[{"filePath":"src/map-view.ts","lineNumber":583,"codeSnippet":" 580 | \t\tlet styleUrl: string;\n 581 | \t\tif (tileUrls.length === 0) {\n 582 | \t\t\t// No custom tiles configured, use default\n> 583 | \t\t\tstyleUrl = isDark ? 'https://tiles.openfreemap.org/styles/dark' : 'https://tiles.openfreemap.org/styles/bright';\n 584 | \t\t} else if (tileUrls.length === 1 && !this.isTileTemplateUrl(tileUrls[0])) {\n 585 | \t\t\t// Single URL that's not a tile template, treat as style URL\n 586 | \t\t\tstyleUrl = tileUrls[0];","sourceUrl":"https://github.com/obsidianmd/obsidian-maps/blob/0.1.5/src/map-view.ts#L583"},{"filePath":"src/settings.ts","lineNumber":55,"codeSnippet":" 52 | \t\tconst lightModeSetting = new Setting(contentEl)\n 53 | \t\t\t.setName('Light mode')\n 54 | \t\t\t.addText(text => text\n> 55 | \t\t\t\t.setPlaceholder('https://tiles.openfreemap.org/styles/bright')\n 56 | \t\t\t\t.setValue(this.tileSet.lightTiles)\n 57 | \t\t\t\t.onChange(value => {\n 58 | \t\t\t\t\tthis.tileSet.lightTiles = value;","sourceUrl":"https://github.com/obsidianmd/obsidian-maps/blob/0.1.5/src/settings.ts#L55"},{"filePath":"src/settings.ts","lineNumber":68,"codeSnippet":" 65 | \t\t\t.setName('Dark mode (optional)')\n 66 | \t\t\t.setDesc('Tile URL or style URL for dark mode. If not specified, light mode tiles will be used.')\n 67 | \t\t\t.addText(text => text\n> 68 | \t\t\t\t.setPlaceholder('https://tiles.openfreemap.org/styles/dark')\n 69 | \t\t\t\t.setValue(this.tileSet.darkTiles)\n 70 | \t\t\t\t.onChange(value => {\n 71 | \t\t\t\t\tthis.tileSet.darkTiles = value;","sourceUrl":"https://github.com/obsidianmd/obsidian-maps/blob/0.1.5/src/settings.ts#L68"}]}],"scoreChange":5}},"initialDiffFrom":"0.1.5","initialDiffTo":"0.1.6","summary":"The maps plugin retrieves map styling data from remote web sources to render its interactive map view feature. It does not access or process vault data through Obsidian APIs. The specific domains providing this map data are not publicly documented, though the network requests occur without obfuscation.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.1.3","severity":"high","title":"minimatch has a ReDoS via repeated wildcards with non-matching literal in patte

Maps