et":"this.app.metadataCache.on","explanation":"Accesses Obsidian API: app.metadataCache","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/shu307/obsidian-nav-weight/blob/1.1.3/src/main.ts#L51"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"nav-weight","fromVersion":"1.1.2","toVersion":"1.1.3","files":[{"path":"src/main.ts","hunks":"$21","securityAnnotations":[]},{"path":"src/patcher.ts","hunks":"$22","securityAnnotations":[]},{"path":"src/sorter.ts","hunks":"$23","securityAnnotations":[]},{"path":"src/types/obsidian.d.ts","hunks":"@@ -16,8 +16,8 @@ declare module \"obsidian\" {\n }\n \n interface Item {\n- file?: TAbstractFile;\n- selfEl?: HTMLElement;\n+ file: TAbstractFile;\n+ selfEl: HTMLElement;\n vChildren?: {\n setChildren(items: Item[]): void;\n };\n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.1.2","initialDiffTo":"1.1.3","summary":"This plugin reads markdown frontmatter metadata from vault files to reorder navigation items locally, without accessing sensitive Obsidian APIs or transmitting data externally. It performs no network operations and contains no obfuscated code, making it purely a client-side sorting utility. The plugin's data access is limited to parsing frontmatter in markdown files to extract weight or sort values for organizational purposes.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"cross-spawn","packageVersion":">=7.0.0 <7.0.5","severity":"high","title":"Regular Expression Denial of Service (ReDoS) in cross-spawn","advisoryUrl":"https://github.com/advisories/GHSA-3xgq-45jj-v275","ghsaId":"GHSA-3xgq-45jj-v275","cveId":null,"vulnerableRange":">=7.0.0 <7.0.5","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0

Nav Weight