"id":19403,"version":"1.0.1","score":100,"privacyLevel":null,"analyzedAt":"2025-03-12T11:17:17.000Z","releaseDate":"2025-03-12T11:17:17.000Z","artifactStatus":"divergent"},{"id":19402,"version":"1.0.0","score":100,"privacyLevel":null,"analyzedAt":"2025-03-02T19:25:38.000Z","releaseDate":"2025-03-02T19:25:38.000Z","artifactStatus":"divergent"}],"findings":[],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"mathtype","fromVersion":"1.0.1","toVersion":"1.0.2","files":[{"path":"main.ts","hunks":"@@ -249,15 +249,15 @@ class MathTypeSuggest extends EditorSuggest {\n \t\tconst editor = this.context.editor;\n \t\tconst lineContent = editor.getLine(this.context.start.line);\n \n-\t\tif (!lineContent.startsWith(\"$\") && !lineContent.endsWith(\"$\")) {\n+\t\tif (lineContent.startsWith(\"$\") && lineContent.endsWith(\"$\")) {\n \t\t\teditor.replaceRange(\n-\t\t\t\t`$${value}$`,\n+\t\t\t\tvalue,\n \t\t\t\tthis.context.start,\n \t\t\t\tthis.context.end\n \t\t\t);\n \t\t} else {\n \t\t\teditor.replaceRange(\n-\t\t\t\tvalue,\n+\t\t\t\t`$${value}$`,\n \t\t\t\tthis.context.start,\n \t\t\t\tthis.context.end\n \t\t\t);\n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":-15}},"initialDiffFrom":"1.0.1","initialDiffTo":"1.0.2","summary":"The mathtype plugin provides MathJax syntax suggestions from natural language input without accessing vault APIs or performing any detected network activity. Since it generates suggestions locally with no network calls, it likely processes text entirely within the plugin using bundled language models or pattern matching. No data leaves the vault. The undefined privacy level reflects missing documentation about internal input handling, but the lack of network activity means generated suggestions remain local to Obsidian.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.1.3","severity":"high","title":"minimatch has