tries.ts#L5"},{"id":885909,"pluginId":"performosu","version":"1.8.1","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":33,"codeSnippet":"this.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/ruikurenaii/performium/blob/1.8.1/src/main.ts#L33"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"performosu","fromVersion":"1.8.0","toVersion":"1.8.1","files":[{"path":"src/functions/getPerformanceVersion.ts","hunks":"@@ -11,7 +11,8 @@ const performanceVersions: Record = {\n \"011726\": \"v20260117 (v1.6.1)\",\n \"020426\": \"v20260204 (v1.6.2)\",\n \"021426\": \"v20260214 (v1.7.0)\",\n- \"test\": `v${date.getFullYear()}${String(date.getMonth() + 1).padStart(2, \"0\")}${String(date.getDate()).padStart(2, \"0\")} (v1.8.0b)`\n+ \"031526\": \"v20260315 (v1.8.0)\",\n+ \"test\": `v${date.getFullYear()}${String(date.getMonth() + 1).padStart(2, \"0\")}${String(date.getDate()).padStart(2, \"0\")} (v1.9.0b)`\n };\n \n export async function getPerformanceVersion(version: string): Promise {\n","securityAnnotations":[]},{"path":"src/main.ts","hunks":"$21","securityAnnotations":[]},{"path":"src/options/base.ts","hunks":"$22","securityAnnotations":[]},{"path":"src/utils/pp/031526.ts","hunks":"$23","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.8.0","initialDiffTo":"1.8.1","summary":"The performosu plugin scans all markdown files in your vault and reads their metadata to analyze note-taking activity, then references a locally stored performance entry data file to calculate and assign osu! Performance Points as a gamification mechanic. All processing occurs locally with no network requests or external data transmission. The plugin does not obfuscate its code, making its operations directly inspectable.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7-rcm5-vvqj","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":9,"directDeps":1,"transitiveDeps":0}}]]}]

Performium