ourceUrl":"https://github.com/obsidian-ttrpg-community/Relations/blob/refs/tags/0.25.0/src/codeblock.ts#L551"},{"id":1166922,"pluginId":"relations","version":"0.25.0","category":"vault_access","severity":"info","filePath":"src/codeblock.ts","lineNumber":80,"codeSnippet":" 77 | \t\tif (this.options.id) return this.options.id;\n 78 | \t\tconst info = this.ctx.getSectionInfo(this.containerEl);\n 79 | \t\tif (!info) return null;\n> 80 | \t\tconst file = this.app.vault.getAbstractFileByPath(this.sourcePath);\n 81 | \t\tif (!(file instanceof TFile)) return null;\n 82 | \n 83 | \t\tconst id = generateBlockId();","explanation":"Reads a single vault file by path","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/obsidian-ttrpg-community/Relations/blob/refs/tags/0.25.0/src/codeblock.ts#L80"},{"id":1166923,"pluginId":"relations","version":"0.25.0","category":"vault_access","severity":"medium","filePath":"src/graph.ts","lineNumber":59,"codeSnippet":" 56 | \t}\n 57 | \n 58 | \tconst typeMap = buildTypeMap(settings);\n> 59 | \tconst files = app.vault.getMarkdownFiles().filter((f) => inScope(f, settings));\n 60 | \n 61 | \tconst notePaths = new Set();\n 62 | \tconst rawEdges: GraphEdge[] = [];","explanation":"Reads all markdown files in your vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/obsidian-ttrpg-community/Relations/blob/refs/tags/0.25.0/src/graph.ts#L59"},{"id":1166924,"pluginId":"relations","version":"0.25.0","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":223,"codeSnippet":"this.app.workspace.getLeavesOfType","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/obsidian-ttrpg-community/Relations/blob/refs/tags/0.25.0/src/main.ts#L223"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.24.0","initialDiffTo":"0.25.0","summary":"This plugin reads note content from your vault, including all markdown files and a specific file by path, so it can build a local view of how notes relate to each other. Based on the reported behavior, it does not make any network requests and does not send data to external services. In practice, it can generate relationship visualizations from the notes it can access, but any such processing appears to stay within Obsidian and your local vault.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.3.0","severity":"high","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","advisoryUrl":"https://github.com/advisories/GHSA-52cp-r559-cp3m","ghsaId":"GHSA-52cp-r559-cp3m","cveId":null,"vulnerableRange":">=4.0.0 <4.3.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"Pos