s/v4","filePath":"src/ai-provider.ts","lineNumber":62,"codeSnippet":" 59 | \t},\n 60 | \tzhipu: {\n 61 | \t\tname: \"智谱 AI (GLM)\",\n> 62 | \t\tbaseUrl: \"https://open.bigmodel.cn/api/paas/v4\",\n 63 | \t\tmodels: [\"glm-4\", \"glm-4-flash\", \"glm-4-air\", \"glm-4-long\"],\n 64 | \t\tdefaultModel: \"glm-4\",\n 65 | \t},","networkType":"active-outbound","sendsData":true,"dataDescription":"URL property targets open.bigmodel.cn (https://open.bigmodel.cn/api/paas/v4)","endpointSource":"hardcoded-url"},{"host":"spark-api-open.xf-yun.com","url":"https://spark-api-open.xf-yun.com/v1","filePath":"src/ai-provider.ts","lineNumber":68,"codeSnippet":" 65 | \t},\n 66 | \tspark: {\n 67 | \t\tname: \"讯飞星火\",\n> 68 | \t\tbaseUrl: \"https://spark-api-open.xf-yun.com/v1\",\n 69 | \t\tmodels: [\"lite\", \"pro\", \"pro-128k\", \"max\", \"4.0-ultra\"],\n 70 | \t\tdefaultModel: \"pro\",\n 71 | \t},","networkType":"active-outbound","sendsData":true,"dataDescription":"URL property targets spark-api-open.xf-yun.com (https://spark-api-open.xf-yun.com/v1)","endpointSource":"hardcoded-url"}],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"1.0.1","summary":"SmartScribe reads a single file from your vault, likely the note you’re working on, to generate metadata like titles, tags, categories, and summaries. When its AI features are used, it can send that note content to external AI services including Anthropic, OpenAI, DeepSeek, Alibaba DashScope, Zhipu, and iFlytek Spark. It also sends data to one destination that could not be determined from the source code.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <=4.1.1","severity":"moderate","title":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","advisoryUrl":"https://github.com/advisories/GHSA-h67p-54hq-rp68","ghsaId":"GHSA-h67p-54hq-rp68","cveId":null,"vulnerableRange":">=4.0.0 <=4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.3.0","severity":"high","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","advisoryUrl":"https://github.com/advisories/GHSA-52cp-r559-cp3m","ghsaId":"GHSA-52cp-r559-cp3m","cveId":null,"vulnerableRange":">=4.0.0 <4.3.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":7,"directDeps":0,"transitiveDeps":0}}]]}]