(.*)<\\\\/title>/.exec(res)?.[1] || \"\";","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"user-configured"}],"initialDiff":{"pluginId":"obsidian-quiet-outline","fromVersion":"0.5.11","toVersion":"0.5.12","files":[{"path":"src/navigators/markdown.ts","hunks":"@@ -73,6 +73,7 @@ export class MarkDownNav extends Nav {\n plugin.outlineView?.vueInstance.onPosChange(key);\n \n setTimeout(() => {\n+ this.view.app.workspace.setActiveLeaf(this.view.leaf, { focus: true });\n this.view.setEphemeralState(state);\n });\n }\n","securityAnnotations":[]},{"path":"src/settings.ts","hunks":"@@ -96,7 +96,7 @@ const DEFAULT_SETTINGS: QuietOutlineSettings = {\n auto_scroll_into_view: true,\n \n // Canvas settings\n- vimlize_canvas: true,\n+ vimlize_canvas: false,\n canvas_sort_by: \"area\",\n shown_node_types: [\"file\", \"group\", \"text\", \"link\"],\n heading_truncate_length: 20,\n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":5}},"initialDiffFrom":"0.5.11","initialDiffTo":"0.5.12","summary":"obsidian-quiet-outline reads and parses JSON data from your Obsidian vault files. The plugin makes HTTP requests to external URLs embedded in canvas files to fetch page titles for display purposes, sending those URLs to remote servers without obfuscation. No telemetry or vault content transmission is evident beyond the explicit URL fetches. The privacy impact depends on which URLs you include in your canvas files and what data their servers collect.","dependencyVulnerabilities":[{"packageName":"lodash","packageVersion":">=4.0.0 <=4.17.22","severity":"moderate","title":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","advisoryUrl":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","ghsaId":"GHSA-xxjr-mmjv-4gpg","cveId":null,"vulnerableRange":">=4.0.0 <=4.17.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"lodash","packageVersion":">=4.0.0 <=4.17.23","severity":"high","title":"lodash vulnerable to Code Injection via `_.template` imports key names","advisoryUrl":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","ghsaId":"GHSA-r5fr-rjxr-66jc","cveId":null,"vulnerableRange":">=4.0.0 <=4.17.23","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"lodash","packageVersion":"<=4.17.23","severity":"moderate","title":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","advisoryUrl":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","ghsaId":"GHSA-f23m-r3pf-42rh","cveId":null,"vulnerableRange":"<=4.17.23","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"lodash-es","packageVersion":">=4.0.0 <=4.17.22","severity":"moderate","title":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","advisoryUrl":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","ghsaId":"GHSA-xxjr-mmjv-4gpg","cveId":null,"vulnerableRange":">=4.0.0 <=4.17.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},</article></body></html>

d":866010,"pluginId":"obsidian-quiet-outline","version":"0.5.12","category":"permissions_scope","severity":"info","filePath":"src/utils/update-heading-links.ts","lineNumber":94,"codeSnippet":"this.app.fileManager.updateInternalLinks","explanation":"Accesses Obsidian API: app.fileManager","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/guopenghui/obsidian-quiet-outline/blob/0.5.12/src/utils/update-heading-links.ts#L94"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"src/navigators/canvas.ts","lineNumber":241,"codeSnippet":" 238 | text = cacheTitle[node.url];\n 239 | } else {\n 240 | text = node.url;\n> 241 | request(node.url)\n 242 | .then((res) => {\n 243 | cacheTitle[node.url] =\n 244 | /(.*)<\\\\/title>/.exec(res)?.[1] || \"\";","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"user-configured"}],"initialDiff":{"pluginId":"obsidian-quiet-outline","fromVersion":"0.5.11","toVersion":"0.5.12","files":[{"path":"src/navigators/markdown.ts","hunks":"@@ -73,6 +73,7 @@ export class MarkDownNav extends Nav {\n plugin.outlineView?.vueInstance.onPosChange(key);\n \n setTimeout(() => {\n+ this.view.app.workspace.setActiveLeaf(this.view.leaf, { focus: true });\n this.view.setEphemeralState(state);\n });\n }\n","securityAnnotations":[]},{"path":"src/settings.ts","hunks":"@@ -96,7 +96,7 @@ const DEFAULT_SETTINGS: QuietOutlineSettings = {\n auto_scroll_into_view: true,\n \n // Canvas settings\n- vimlize_canvas: true,\n+ vimlize_canvas: false,\n canvas_sort_by: \"area\",\n shown_node_types: [\"file\", \"group\", \"text\", \"link\"],\n heading_truncate_length: 20,\n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":5}},"initialDiffFrom":"0.5.11","initialDiffTo":"0.5.12","summary":"obsidian-quiet-outline reads and parses JSON data from your Obsidian vault files. The plugin makes HTTP requests to external URLs embedded in canvas files to fetch page titles for display purposes, sending those URLs to remote servers without obfuscation. No telemetry or vault content transmission is evident beyond the explicit URL fetches. The privacy impact depends on which URLs you include in your canvas files and what data their servers collect.","dependencyVulnerabilities":[{"packageName":"lodash","packageVersion":">=4.0.0 <=4.17.22","severity":"moderate","title":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","advisoryUrl":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","ghsaId":"GHSA-xxjr-mmjv-4gpg","cveId":null,"vulnerableRange":">=4.0.0 <=4.17.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"lodash","packageVersion":">=4.0.0 <=4.17.23","severity":"high","title":"lodash vulnerable to Code Injection via `_.template` imports key names","advisoryUrl":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","ghsaId":"GHSA-r5fr-rjxr-66jc","cveId":null,"vulnerableRange":">=4.0.0 <=4.17.23","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"lodash","packageVersion":"<=4.17.23","severity":"moderate","title":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","advisoryUrl":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","ghsaId":"GHSA-f23m-r3pf-42rh","cveId":null,"vulnerableRange":"<=4.17.23","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"lodash-es","packageVersion":">=4.0.0 <=4.17.22","severity":"moderate","title":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","advisoryUrl":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","ghsaId":"GHSA-xxjr-mmjv-4gpg","cveId":null,"vulnerableRange":">=4.0.0 <=4.17.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},</article></body></html>

Quiet Outline