:true,"dataDescription":"URL property targets openrouter.ai (https://openrouter.ai/api/v1)","endpointSource":"hardcoded-url"}],"initialDiff":null,"initialDiffFrom":"0.2.6","initialDiffTo":"0.2.7","summary":"The plugin reads all markdown files in your vault and can also read individual vault files from cache as needed to manage the annotations it tracks. It sends data to API endpoints for OpenAI, OpenRouter, DeepSeek, SiliconFlow, and a local server at 127.0.0.1:11434 when those options are used or triggered. The source code also indicates outbound network activity to one additional destination that could not be identified from the code.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"8.2.0","source":"npm-audit","isDirect":false,"path":"vite > esbuild"},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"svelte","packageVersion":"<=5.51.4","severity":"moderate","title":"Svelte SSR attribute spreading includes inherited properties from prototype chain","advisoryUrl":"https://github.com/advisories/GHSA-crpf-4hrx-3jrp","ghsaId":"GHSA-crpf-4hrx-3jrp","cveId":null,"vulnerableRange":"<=5.51.4","fixAvailable":"5.56.8","source":"npm-audit","isDirect":true,"path":null},{"packageName":"svelte","packageVersion":"<=5.51.4","severity":"moderate","title":"Svelte SSR does not validate dynamic element tag names in ``","advisoryUrl":"https://github.com/advisories/GHSA-m56q-vw4c-c2cp","ghsaId":"GHSA-m56q-vw4c-c2cp","cveId":null,"vulnerableRange":"<=5.51.4","fixAvailable":"5.56.8","source":"npm-audit","isDirect":true,"path":null},{"packageName":"svelte","packageVersion":"<=5.51.4","severity":"moderate","title":"Svelte affected by cross-site scripting via spread attributes in Svelte SSR","advisoryUrl":"https://github.com/advisories/GHSA-f7gr-6p89-r883","ghsaId":"GHSA-f7gr-6p89-r883","cveId":null,"vulnerableRange":"<=5.51.4","fixAvailable":"5.56.8","source":"npm-audit","isDirect":true,"path":null},{"packageName":"svelte","packageVersion":"<=5.53.4","severity":"moderate","title":"Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`","advisoryUrl":"https://github.com/advisories/GHSA-phwv-c562-gvmh","ghsaId":"GHSA-phwv-c562-gvmh","cveId":null,"vulnerableRange":"<=5.53.4","fixAvailable":"5.56.8","source":"npm-audit","isDirect":true,"path":null},{"packageName":"svelte","packageVersion":"<=5.55.6","severity":"moderate","title":"Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State","advisoryUrl":"https://github.com/advisories/GHSA-rcqx-6q8c-2c42","ghsaId":"GHSA-rcqx-6q8c-2c42","cveId":null,"vulnerableRange":"<=5.55.6","fixAvailable":"5.56.8","source":"npm-audit","isDirect":true,"path":null},{"packageName":"svelte","packageVersion":"<=5.55.6","severity":"moderate","title":"Svelte SSR vulnerable to cross-site scripting via spread attributes","advisoryUrl":"https://github.com/advisories/GHSA-pr6f-5x2q-rwfp","ghsaId":"GHSA-pr6f-5x2q-rwfp","cveId":null,"vulnerableRange":"<=5

ToWrite Open Questions