nitialDiff":{"pluginId":"verovio-music-renderer","fromVersion":"1.0.8","toVersion":"1.0.9","files":[{"path":"src/global.d.ts","hunks":"@@ -0,0 +1,21 @@\n+declare interface VerovioToolkit {\n+ setOptions(options: Record): void;\n+ loadData(data: string): void;\n+ redoLayout(): void;\n+ select(opts: Record): void;\n+ renderToSVG(page?: number): string;\n+ renderToMIDI(): string | null;\n+ renderToTimemap(opts?: any): any;\n+ getMEI(): string;\n+ getPageCount(): number;\n+ getElementsAtTime(ms: number): any;\n+ renderData(data: string, options?: any): string;\n+}\n+\n+declare global {\n+ interface Window {\n+ VerovioToolkit: VerovioToolkit;\n+ }\n+}\n+\n+export {};\n","securityAnnotations":[]},{"path":"src/main.ts","hunks":"$20","securityAnnotations":[]},{"path":"src/musicEditorView.ts","hunks":"$21","securityAnnotations":[]},{"path":"src/settings.ts","hunks":"$22","securityAnnotations":[]},{"path":"src/verovioProcessor.ts","hunks":"$23","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.0.8","initialDiffTo":"1.0.9","summary":"The verovio-music-renderer plugin reads music notation files from your vault to render and playback musical content in MEI, MusicXML, and ABC formats. It makes outbound network requests to external websites to fetch resources needed for rendering functionality. No obfuscation is used, and the plugin lacks a defined privacy policy, leaving the specific target endpoints and data handling practices undocumented.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":"<3.1.3","severity":"high","title":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","advisoryUrl":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","ghsaId":"GHSA-3ppc-4f35-3m26","cveId":null,"vulnerableRange":"<3.1.3","fixAvailable":null,"source":"npm-audit","isDire

Verovio Music Renderer