Clear the community-catalog "potentially vulnerable dependency" warnings.
All flagged packages are dev-only transitives (runtime deps are only
force-graph, immer, zod) and never ship in main.js, but the reviewer wants
them out of their advisory ranges.
Add a resolutions block (yarn-style; Bun does not support nested overrides)
pinning each flagged package to a patched version, scoping ajv (eslint needs
v6 / commitlint needs v8) and picomatch (micromatch needs v2 / fdir needs v4)
per parent. Also pin obsidian to 1.10.3 and zod to 4.1.13: applying the
scoped resolutions forces a full re-resolve that would otherwise float
obsidian "latest" to 1.13.1 (removes Bases-view types the plugin imports,
breaking tsc) and bump runtime zod. The resulting tree has no version inside
any flagged advisory range; the shipped bundle is unchanged.
- Issue 1: Restore saved exploredFilter from config on init, save on change
- Issue 2: Store plugin instance, use global settings as fallback for exploredProperty
- Issue 3: Store searchMatchIds in GraphCanvas, apply search dimming in paintNode
- Issue 4: Recalculate isDark in paintNode and getLinkColor for theme reactivity
- Issue 5: Fix package.json metadata and version to match manifest.json
- Issue 6: Show empty state when no nodes to display
- Issue 7: Track setTimeout with zoomTimer field, clear on unload
- Issue 8: Replace O(n) entries.find() with Map lookup in graph-data-builder
- Issue 9: Remove unused containerEl field from GraphSidePanel
