GitLens — Git supercharged
eamodio.gitlens
· published by eamodio
verified
HIGH
2 findings detected for eamodio.gitlens — 2 high.
2 HIGH
2026.5.261305
latest version
2026-05-26 17:26 UTC
last scanned
Source coverage
- marketplace v2026.5.261305 verified
- open-vsx vpre-release verified
Findings
HIGH outbound-http-non-ms Outbound HTTP request to non-Microsoft host: huggingface.co
dist/ai.js :1
`{file_path}` issues an HTTP call to `{url}`. Confirm this is a documented integration; outbound calls to arbitrary hosts widen the extension's trust surface.
▶ line 1: …eProvider});var r=n(8170),i=n(2028);let HuggingFaceProvider=class HuggingFaceProvider extends i.t{id=r.xS.id;name=r.xS.name;descriptor=r.xS;config={keyUrl:"https://huggingface.co/settings/tokens",keyValidator:/(?:hf_)?[a-zA-Z0-9]{32,}/};async getModels(){let e=new URLSearchParams({filter:"text-generation,conversational",inference:"warm",sort:"trendingScore",limit:"30"}),t=await this.context.fetch(`https://huggingface.co/api/models?${e.toString()}`,{headers:{Accept:"application/json","Content-Type":"application/json"},method:"GET"});return(await t.json()).map(e=>({id:e.id,name:e.id.split("/").pop(),maxTokens:{input:4096,output:4096},provider:r.xS,temperature:null}))}getUrl(e){return`https://api-inference.huggingface.co/models/${e.id}/v1/chat/completions`}}},4811(e,t,n){n.r(t),n.d(t,{Mistral…
Affected versions
marketplace 2026.5.170538, 2026.5.180137, 2026.5.180633, 2026.5.182232, 2026.5.190620, 2026.5.191814, 2026.5.201040, 2026.5.210618, 2026.5.220608, 2026.5.230538, 2026.5.240540, 2026.5.250404, 2026.5.251435, 2026.5.260402, 2026.5.261257, 2026.5.261305
open-vsx 2026.5.170538, 2026.5.171822, 2026.5.180137, 2026.5.180633, 2026.5.182232, 2026.5.190620, 2026.5.191814, 2026.5.201040, 2026.5.210618, 2026.5.220608, 2026.5.230538, 2026.5.240540, 2026.5.250404, 2026.5.251435, 2026.5.252009, 2026.5.260402, 2026.5.261257, 2026.5.261305
HIGH outbound-http-non-ms Outbound HTTP request to non-Microsoft host: huggingface.co
dist/browser/gitlens.js :1566
`{file_path}` issues an HTTP call to `{url}`. Confirm this is a documented integration; outbound calls to arbitrary hosts widen the extension's trust surface.
▶ line 1566: …eProvider});var r=i(8170),s=i(2028);let HuggingFaceProvider=class HuggingFaceProvider extends s.t{id=r.xS.id;name=r.xS.name;descriptor=r.xS;config={keyUrl:"https://huggingface.co/settings/tokens",keyValidator:/(?:hf_)?[a-zA-Z0-9]{32,}/};async getModels(){let e=new URLSearchParams({filter:"text-generation,conversational",inference:"warm",sort:"trendingScore",limit:"30"}),t=await this.context.fetch(`https://huggingface.co/api/models?${e.toString()}`,{headers:{Accept:"application/json","Content-Type":"application/json"},method:"GET"});return(await t.json()).map(e=>({id:e.id,name:e.id.split("/").pop(),maxTokens:{input:4096,output:4096},provider:r.xS,temperature:null}))}getUrl(e){return`https://api-inference.huggingface.co/models/${e.id}/v1/chat/completions`}}},4811(e,t,i){i.r(t),i.d(t,{Mistral…
Affected versions
marketplace 2026.5.170538, 2026.5.180137, 2026.5.180633, 2026.5.182232, 2026.5.190620, 2026.5.191814, 2026.5.201040, 2026.5.210618, 2026.5.220608, 2026.5.230538, 2026.5.240540, 2026.5.250404, 2026.5.251435, 2026.5.260402, 2026.5.261257, 2026.5.261305
open-vsx 2026.5.170538, 2026.5.171822, 2026.5.180137, 2026.5.180633, 2026.5.182232, 2026.5.190620, 2026.5.191814, 2026.5.201040, 2026.5.210618, 2026.5.220608, 2026.5.230538, 2026.5.240540, 2026.5.250404, 2026.5.251435, 2026.5.252009, 2026.5.260402, 2026.5.261257, 2026.5.261305
Embed this verdict

[](https://vsxplorer.veryserious.systems/report/eamodio.gitlens)