acyLevel":null,"analyzedAt":"2025-01-15T17:03:53.000Z","releaseDate":"2025-01-15T17:03:53.000Z","artifactStatus":"verified"},{"id":39079,"version":"1.0.0","score":100,"privacyLevel":null,"analyzedAt":"2025-01-13T20:35:09.000Z","releaseDate":"2025-01-13T20:35:09.000Z","artifactStatus":"verified"}],"findings":[],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"sankey","fromVersion":"1.0.2","toVersion":"1.1.0","files":[{"path":"src/main.ts","hunks":"$21","securityAnnotations":[]},{"path":"src/render.ts","hunks":"@@ -20,6 +20,10 @@ export class RenderSankey extends MarkdownRenderChild {\n \n display(): void {\n this.containerEl.empty();\n- this.containerEl.appendChild(createSankey(this.source, this.plugin.settings));\n+ try {\n+ this.containerEl.appendChild(createSankey(this.source, this.plugin.settings));\n+ } catch (e) {\n+ this.containerEl.createEl('p', { text: `Sankey error: ${e.message}` });\n+ }\n }\n }\n\\ No newline at end of file\n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.0.2","initialDiffTo":"1.1.0","summary":"The Sankey plugin creates flow diagrams within Obsidian notes without accessing vault APIs or making any network requests. All diagram rendering and data processing occurs locally within the note file. The plugin does not exfiltrate note content, contact external services, or require authentication to remote endpoints.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.1.3","severity":"high","title":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","advisoryUrl":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","ghsaId":"GHSA-3ppc-4f35-3m26","cveId":null,"vulnerableRange":"<3.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersio