tive"},"versions":[{"id":122574,"version":"1.0.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-21T13:23:45.000Z","releaseDate":"2026-07-20T23:56:12.000Z","artifactStatus":"unavailable"},{"id":122573,"version":"1.0.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-21T13:23:33.000Z","releaseDate":"2026-07-20T15:12:36.000Z","artifactStatus":null}],"findings":[{"id":1192057,"pluginId":"todo-calendar","version":"1.0.1","category":"permissions_scope","severity":"info","filePath":"src/FileSuggestModal.ts","lineNumber":13,"codeSnippet":"this.app.vault.getMarkdownFiles","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/itzqingyu/todo-calendar/blob/refs/tags/1.0.1/src/FileSuggestModal.ts#L13"},{"id":1192058,"pluginId":"todo-calendar","version":"1.0.1","category":"vault_access","severity":"medium","filePath":"src/FileSuggestModal.ts","lineNumber":13,"codeSnippet":" 10 | }\n 11 | \n 12 | getItems(): TFile[] {\n> 13 | return this.app.vault.getMarkdownFiles();\n 14 | }\n 15 | \n 16 | getItemText(file: TFile): string {","explanation":"Reads all markdown files in your vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/itzqingyu/todo-calendar/blob/refs/tags/1.0.1/src/FileSuggestModal.ts#L13"},{"id":1192059,"pluginId":"todo-calendar","version":"1.0.1","category":"vault_access","severity":"info","filePath":"src/parser.ts","lineNumber":11,"codeSnippet":" 8 | const TASK_REGEX = /^- \\[( |x|X)\\] (.*?) @ (\\d{4}-\\d{2}-\\d{2}|none)$/;\n 9 | \n 10 | export async function parseTodoFile(app: App, filePath: string): Promise {\n> 11 | const file = app.vault.getAbstractFileByPath(filePath);\n 12 | if (!(file instanceof TFile)) {\n 13 | return null;\n 14 | }","explanation":"Reads a single vault file by path","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/itzqingyu/todo-calendar/blob/refs/tags/1.0.1/src/parser.ts#L11"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.0.0","initialDiffTo":"1.0.1","summary":"This plugin reads all markdown files in your vault and can also read a specific vault file by path, which it uses to build a visual calendar from your `to-do-calendar.md` content. It has no observed network activity, so it does not send data to any external service in its current behavior.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"svelte","packageVersion":"<=5.51.4","severity":"moderate","title":"Svelte SSR attribute spreading includes inherited properties from prototype chain","advisoryUrl":"https://github.com/advisories/GHSA-crpf-4hrx-3jrp","ghsaId":"GHSA-crpf-4hrx-3jrp","cveId":null,"vulnerableRange":"<=5.51.4","fixAvailable":"5.56.8","source":"npm-audit","isDirect":true,"path":null},{"packageName":"svelte","packageVersion":"<=5.51.4","severity":"m

Todo Calendar