123685,"version":"0.1.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-22T04:13:14.000Z","releaseDate":"2026-07-18T21:47:59.000Z","artifactStatus":null}],"findings":[{"id":1201920,"pluginId":"vault-tasks","version":"0.1.1","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":50,"codeSnippet":"this.app.workspace.onLayoutReady","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/savar-g/taskline/blob/refs/tags/0.1.1/src/main.ts#L50"},{"id":1201921,"pluginId":"vault-tasks","version":"0.1.1","category":"permissions_scope","severity":"info","filePath":"src/store.ts","lineNumber":55,"codeSnippet":"this.app.vault.on","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/savar-g/taskline/blob/refs/tags/0.1.1/src/store.ts#L55"},{"id":1201922,"pluginId":"vault-tasks","version":"0.1.1","category":"vault_access","severity":"info","filePath":"src/store.ts","lineNumber":88,"codeSnippet":" 85 | \n 86 | private async reparseFile(path: string): Promise {\n 87 | const generation = this.invalidate(path);\n> 88 | const file = this.app.vault.getAbstractFileByPath(path);\n 89 | if (!(file instanceof TFile)) {\n 90 | if (this.disposed || this.reparseGeneration.get(path) !== generation) return false;\n 91 | this.tasksByFile.set(path, []);","explanation":"Reads a single vault file by path","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/savar-g/taskline/blob/refs/tags/0.1.1/src/store.ts#L88"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.1.0","initialDiffTo":"0.1.1","summary":"Taskline reads a single file from your Obsidian vault by path to capture tasks and build its Today view. In the documented behavior, it does not make any network connections and does not send data to any external service.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=4.0.0 <5.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.9","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=4.0.0 <5.0.9","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severit