{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"baconbao-dsh-mermaid-image-preview","slug":"baconbao-dsh-mermaid-image-preview","rank":935,"url":"https://github.com/baconbao/dsh-mermaid-image-preview","name":"baconbao/dsh-mermaid-image-preview","category":"docs","description":{"zh":"当 DSH Web 中的消息包含 Mermaid 语法时，通过本地渲染以图像形式预览 Mermaid Diagrams，并允许接入外部渲染服务器。","en":"Preview Mermaid diagrams as images via local rendering in DSH Web when the chat message contains a Mermaid fenced code block, and also allow integration with external rendering servers."},"stars":2,"starsCheckedAt":"2026-08-21","repository":{"owner":"baconbao","repo":"dsh-mermaid-image-preview","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:baconbao/dsh-mermaid-image-preview","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/baconbao/dsh-mermaid-image-preview/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"baconbao-dsh-mermaid-image-preview","slug":"baconbao-dsh-mermaid-image-preview","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:30:05.554Z","scanStatus":"static-complete","verdict":"review","score":84,"commit":"56f804e6af6cc6d3bdbb479918bf9c6eff94e52c","commitDate":"2026-08-18T02:23:27+08:00","artifactDigest":"sha256:6b5366a9f89ad71ce704647a7b0d5f80cffd618771c1acf9d27473c25bc36dcd","downloadUrl":"https://github.com/baconbao/dsh-mermaid-image-preview/archive/56f804e6af6cc6d3bdbb479918bf9c6eff94e52c.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:baconbao/dsh-mermaid-image-preview","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@baconbao/dsh-mermaid-image-preview","packageVersion":"0.3.2","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-ui-primitives"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-ui-primitives"]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"@baconbao/dsh-mermaid-image-preview","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"ui-dsh-mermaid-image-preview","name":"@baconbao/dsh-mermaid-image-preview","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","host-bundle","subprocess"],"outboundHosts":[{"host":"mermaid.ink","count":2},{"host":"your-own-server.example.com","count":1}],"findings":[{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"pnpm-lock.yaml","pathClass":"manifest","line":1,"evidence":"image-size@2.0.2 GHSA-5p2g-fcmc-qvqq (CVE-2025-71329)","remediation":"关注 GHSA-5p2g-fcmc-qvqq 的修复进展，并评估该依赖是否可移除。","layer":"vulnerability","hash":"c8fae5006b4f53c2c90b74c4","review":{"verdict":"unclear","reason":"提供的pnpm-lock.yaml片段（1-41行）中并未出现image-size依赖项，命中位置仅指向lockfileVersion声明行，无法确认image-size@2.0.2是否实际被解析安装及其在依赖树中的位置。","model":"sonnet","reviewedAt":"2026-08-21T11:01:54.896Z"}},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"pnpm-lock.yaml","pathClass":"manifest","line":1,"evidence":"image-size@2.0.2 GHSA-w3rx-r6r6-pgpr (CVE-2025-71330)","remediation":"关注 GHSA-w3rx-r6r6-pgpr 的修复进展，并评估该依赖是否可移除。","layer":"vulnerability","hash":"fed74e19c1f3c1a2699fadb3","review":{"verdict":"unclear","reason":"同上，可见的pnpm-lock.yaml内容未展示image-size条目，命中定位在文件头部通用行，缺乏证据证实该漏洞版本确实被引入并可达。","model":"sonnet","reviewedAt":"2026-08-21T11:01:54.896Z"}}],"counts":{"critical":0,"high":2,"medium":0,"low":0},"rawCounts":{"critical":0,"high":2,"medium":0,"low":0},"vulnerabilities":[{"id":"GHSA-5p2g-fcmc-qvqq","aliases":["CVE-2025-71329"],"package":"image-size","version":"2.0.2","severity":"high","fixed":null,"summary":"image-size: JXL and HEIF parsers allow denial of service through infinite loops"},{"id":"GHSA-w3rx-r6r6-pgpr","aliases":["CVE-2025-71330"],"package":"image-size","version":"2.0.2","severity":"high","fixed":null,"summary":"image-size: ICNS parser allows denial of service through an infinite loop"}],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":6,"bytesScanned":252945,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"markdown":1,"cordis":1,"source":2,"manifest":1,"yaml":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:30:05.555Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:30:05.554Z","commit":"56f804e6af6cc6d3bdbb479918bf9c6eff94e52c","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:32:58.216Z","commit":"56f804e6af6cc6d3bdbb479918bf9c6eff94e52c","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:01:54.896Z","commit":"56f804e6af6cc6d3bdbb479918bf9c6eff94e52c","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"56f804e6af6cc6d3bdbb479918bf9c6eff94e52c","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:30:05.554Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"56f804e6af6cc6d3bdbb479918bf9c6eff94e52c","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:32:58.216Z"},{"kind":"first-scan","from":null,"to":"review","commit":"56f804e6af6cc6d3bdbb479918bf9c6eff94e52c","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T11:01:54.896Z"}]}