tally/blob/refs/tags/0.1.44/src/main.ts#L1742"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.1.43","initialDiffTo":"0.1.44","summary":"Tag and Tally reads files inside your vault: it can open a specific note by path and also loop through vault files one by one, likely to power its rulebook, NPC, table, and deck features. No network activity was observed, so there is no confirmed behavior showing it sends data to any external service. It also decodes some built-in base64 strings with `atob()`, which is a local text-processing step.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.2","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=2.0.0 <2.1.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"linkify-it","packageVersion":"<=5.0.0","severity":"high","title":"LinkifyIt#match scan loop has quadratic algorithmic complexity","advisoryUrl":"https://github.com/advisories/GHSA-22p9-wv53-3rq4","ghsaId":"GHSA-22p9-wv53-3rq4","cveId":null,"vulnerableRange":"<=5.0.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"linkify-it","packageVersion":"<=5.0.1","severity":"high","title":"linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text","advisoryUrl":"https://github.com/advisories/GHSA-v245-v573-v5vm","ghsaId":"GHSA-v245-v573-v5vm","cveId":null,"vulnerableRange":"<=5.0.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"markdown-it","packageVersion":"<=14.1.1","severity":"moderate","title":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","advisoryUrl":"https://github.com/advisories/GHSA-6v5v-wf23-fmfq","ghsaId":"GHSA-6v5v-wf23-fmfq","cveId":null,"vulnerableRange":"<=14.1.1","fixAvailable":null,"source":"npm-audit","isDirect":true,"path":null},{"packageName":"mathjs","packageVersion":">=13.1.1 <15.2.0","severity":"high","title":"Unsafe object property setter in mathjs","advisoryUrl":"https://github.com/advisories/GHSA-29qv-4j9f-fjw5","ghsaId":"GHSA-29qv-4j9f-fjw5","cveId":null,"vulnerableRange":">=13.1.1 <15.2.0","fixAvailable":"5.5.0","source":"npm-audit","isDirect":false,"path":"@dice-roller/rpg-dice-roller > mathjs"},{"packageName":"mathjs","packageVersion":">=13.1.0 <15.2.0","severity":"high","title":"mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes","advisoryUrl":"https://github.com/advisories/GHSA-jvff-x2qm-6286","ghsaId":"GHSA-jvff-x2qm-6286","cveId":null,"vulnerableRange":">=13.1.0 <15.2.0","fixAvailable":"5.5.0","source":"npm-audit","isDirect":false,"path":"@dice-roller/rpg-dice-roller > mathjs"},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17