{"uuid": "0aff0715-a674-4bf9-89a8-ab769af255c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/743daa778bbfdc3d824ba9bb99839c6f", "content": "# [SECURITY][SFI] \u4fee\u590d brace-expansion \u6f0f\u6d1e\uff08CVE-2026-13149\uff09\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u5728\u4e09\u4e2a npm \u9879\u76ee\u4e2d\u901a\u8fc7 `overrides`\uff08\u793a\u4f8b\u9879\u76ee\u540c\u65f6\u4f7f\u7528 `resolutions`\uff09\u5f3a\u5236\u5c06\u4f20\u9012\u4f9d\u8d56 `brace-expansion` \u7684 2.x \u548c 5.x \u5206\u652f\u56fa\u5b9a\u5230\u5df2\u4fee\u590d\u7248\u672c\uff0c\u5e76\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\uff1b\u4f46 NotebookExtensions \u7684\u9501\u6587\u4ef6\u8fd8\u5305\u542b\u5927\u91cf\u53ef\u89c1\u7684\u4f34\u968f\u4f9d\u8d56\u53d8\u66f4\uff0c\u4e14\u5176\u5dee\u5f02\u5728\u5206\u6790\u5305\u4e2d\u88ab\u622a\u65ad\uff0c\u9700\u8981\u91cd\u70b9\u590d\u6838\u3002\n\n| \u9879\u76ee | \u4fe1\u606f |\n|---|---|\n| PR | [766454](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454) |\n| \u4f5c\u8005 | Agency |\n| \u72b6\u6001 | Active\uff0c\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `copilot/api-690bd71d-4a5b24c4` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-05 09:49:58\uff08\u5206\u6790\u5305\u539f\u59cb\u65f6\u95f4\u683c\u5f0f\uff09 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 2 |\n| \u6587\u4ef6\u53d8\u66f4 | 6 \u4e2a\u6587\u4ef6\uff0c\u5168\u90e8\u4e3a\u7f16\u8f91 |\n| \u5dee\u5f02\u7edf\u8ba1 | \u5206\u6790\u5305\u8bb0\u5f55\u603b\u5dee\u5f02 77,622 \u5b57\u8282\uff1b\u672a\u63d0\u4f9b\u53ef\u9760\u7684\u65b0\u589e/\u5220\u9664\u884c\u6570 |\n| \u8986\u76d6\u72b6\u6001 | 5 \u4e2a\u6587\u4ef6\u5dee\u5f02\u5b8c\u6574\uff1b1 \u4e2a\u6587\u4ef6\u5dee\u5f02\u88ab\u622a\u65ad\uff0c\u56e0\u6b64\u6574\u4f53 `diffTruncated=true` |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [\u793a\u4f8b\u8f93\u51fa\u6e32\u67d3\u5668](#1-\u793a\u4f8b\u8f93\u51fa\u6e32\u67d3\u5668)\n  - [Web \u5ba2\u6237\u7aef](#2-web-\u5ba2\u6237\u7aef)\n  - [NotebookExtensions \u670d\u52a1\u4e0e\u6269\u5c55\u5de5\u4f5c\u533a](#3-notebookextensions-\u670d\u52a1\u4e0e\u6269\u5c55\u5de5\u4f5c\u533a)\n- [\u5b9e\u73b0\u673a\u5236](#\u5b9e\u73b0\u673a\u5236)\n- [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n- [\u5dee\u5f02\u8986\u76d6\u8303\u56f4\u4e0e\u9650\u5236](#\u5dee\u5f02\u8986\u76d6\u8303\u56f4\u4e0e\u9650\u5236)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5 PR \u9488\u5bf9 npm \u4f20\u9012\u4f9d\u8d56 `brace-expansion` \u7684 Component Governance \u5b89\u5168\u544a\u8b66\u3002PR \u63cf\u8ff0\u5217\u51fa 6 \u4e2a\u544a\u8b66\uff0c\u6d89\u53ca CVE-2026-13149 \u548c CVE-2026-14257\uff0c\u76ee\u6807\u7248\u672c\u4e3a\uff1a\n\n- `brace-expansion` 2.x \u2192 `2.1.3`\n- `brace-expansion` 5.x \u2192 `5.0.8`\n\n\u53d8\u66f4\u6ca1\u6709\u4fee\u6539\u4e1a\u52a1 TypeScript/JavaScript \u6e90\u7801\uff0c\u800c\u662f\u5728\u4e09\u4e2a\u72ec\u7acb npm \u4f9d\u8d56\u6811\u7684\u9876\u5c42\u6e05\u5355\u4e2d\u589e\u52a0\u7248\u672c\u8986\u76d6\u89c4\u5219\uff0c\u5e76\u66f4\u65b0\u5bf9\u5e94\u9501\u6587\u4ef6\uff0c\u4f7f\u5b89\u88c5\u5668\u4e0d\u518d\u4ec5\u4f9d\u8d56\u4e0a\u6e38\u5305\u58f0\u660e\u7684\u5bbd\u6cdb semver \u8303\u56f4\u6765\u9009\u62e9\u6613\u53d7\u5f71\u54cd\u7248\u672c\u3002\n\n\u6d89\u53ca\u6587\u4ef6\uff1a\n\n| \u6a21\u5757 | \u6e05\u5355\u6587\u4ef6 | \u9501\u6587\u4ef6 |\n|---|---|---|\n| \u793a\u4f8b\u8f93\u51fa\u6e32\u67d3\u5668 | [`sample/aznb-helloworld-output-renderer/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package.json&_a=files) | [`sample/aznb-helloworld-output-renderer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files) |\n| Web \u5ba2\u6237\u7aef | [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package.json&_a=files) | [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package-lock.json&_a=files) |\n| NotebookExtensions | [`src/service/aznb/NotebookExtensions/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package.json&_a=files) | [`src/service/aznb/NotebookExtensions/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package-lock.json&_a=files) |\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u793a\u4f8b\u8f93\u51fa\u6e32\u67d3\u5668\n\n\u5728 [`package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package.json&_a=files) \u4e2d\uff0c\u73b0\u6709\u7684 `resolutions` \u548c `overrides` \u90fd\u65b0\u589e\u4e86 `brace-expansion@2 = 2.1.3`\u3002\n\n**\u4e3a\u4ec0\u4e48\u540c\u65f6\u4fee\u6539\u4e24\u5904\uff1a**\n\n- `overrides` \u662f npm \u539f\u751f\u7684\u4f20\u9012\u4f9d\u8d56\u8986\u76d6\u673a\u5236\u3002\n- \u8be5\u9879\u76ee\u539f\u672c\u5df2\u540c\u65f6\u7ef4\u62a4 `resolutions`\uff0c\u56e0\u6b64\u540c\u6b65\u6dfb\u52a0\u540c\u4e00\u89c4\u5219\u53ef\u4fdd\u6301\u73b0\u6709\u5305\u7ba1\u7406\u7ea6\u5b9a\u4e00\u81f4\uff0c\u5e76\u964d\u4f4e\u4f7f\u7528\u4e0d\u540c\u5b89\u88c5\u5de5\u5177\u65f6\u89e3\u6790\u7ed3\u679c\u5206\u53c9\u7684\u53ef\u80fd\u6027\u3002\n\n\u5bf9\u5e94\u7684 [`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files) \u5c06\u53ef\u89c1\u7684 `brace-expansion` \u4ece `2.0.1` \u66f4\u65b0\u5230 `2.1.3`\uff0c\u540c\u65f6\u66f4\u65b0\u4e0b\u8f7d\u5730\u5740\u3001\u5b8c\u6574\u6027\u54c8\u5e0c\u548c\u8bb8\u53ef\u8bc1\u5143\u6570\u636e\uff1b\u4f9d\u8d56\u5b83\u7684\u82e5\u5e72\u9501\u6587\u4ef6\u8282\u70b9\u4e5f\u4ece\u8303\u56f4\u58f0\u660e\u6536\u7d27\u4e3a `2.1.3`\u3002\u6b64\u5916\uff0c\u9501\u6587\u4ef6\u4e2d\u51fa\u73b0\u4e86\u82e5\u5e72\u7a7a `requires` \u5bf9\u8c61\u7b49\u5e8f\u5217\u5316\u53d8\u5316\uff0c\u8fd9\u4e9b\u770b\u8d77\u6765\u662f\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u4ea7\u751f\u7684\u5143\u6570\u636e\u566a\u58f0\uff0c\u800c\u975e\u4e1a\u52a1\u884c\u4e3a\u4fee\u6539\u3002\n\n### 2. Web \u5ba2\u6237\u7aef\n\n\u5728 [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package.json&_a=files) \u7684\u73b0\u6709 `overrides` \u4e2d\u540c\u65f6\u52a0\u5165\uff1a\n\n- `brace-expansion@2 = 2.1.3`\n- `brace-expansion@5 = 5.0.8`\n\n\u8fd9\u8868\u793a\u5ba2\u6237\u7aef\u4f9d\u8d56\u6811\u540c\u65f6\u5b58\u5728 2.x \u548c 5.x \u4e24\u6761\u4f20\u9012\u4f9d\u8d56\u94fe\uff0c\u9700\u8981\u5206\u522b\u8986\u76d6\uff0c\u4e0d\u80fd\u7528\u5355\u4e00\u7248\u672c\u66ff\u6362\u6240\u6709\u4e3b\u7248\u672c\u3002\n\n\u5bf9\u5e94\u7684 [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package-lock.json&_a=files) \u4e2d\uff0c\u53ef\u89c1\u7684\u9876\u5c42 5.x \u8282\u70b9\u4ece `5.0.3` \u66f4\u65b0\u5230 `5.0.8`\uff0c`filelist` \u4e0b\u5d4c\u5957\u7684 2.x \u8282\u70b9\u4ece `2.0.2` \u66f4\u65b0\u5230 `2.1.3`\u3002\u9501\u6587\u4ef6\u8fd8\u663e\u793a\uff1a\n\n- `brace-expansion@5.0.8` \u7684 Node \u5f15\u64ce\u8981\u6c42\u53d8\u4e3a `20 || >=22`\uff0c\u4e0d\u518d\u5305\u542b Node 18\u3002\n- \u591a\u4e2a\u53ef\u9009\u539f\u751f\u5305\u548c\u8f85\u52a9\u5305\u7684 `dev` / `devOptional` \u6807\u8bb0\u53d1\u751f\u53d8\u5316\u3002\n\n\u8fd9\u4e9b\u53d8\u5316\u8bf4\u660e\u9501\u6587\u4ef6\u786e\u5b9e\u7ecf\u8fc7\u91cd\u65b0\u89e3\u6790\uff1b\u5b89\u5168\u7248\u672c\u5df2\u88ab\u9501\u5b9a\uff0c\u4f46 Node \u8fd0\u884c\u65f6\u517c\u5bb9\u6027\u548c\u751f\u4ea7\u4f9d\u8d56\u88c1\u526a\u884c\u4e3a\u9700\u8981\u7ed3\u5408\u9879\u76ee\u5b9e\u9645\u5b89\u88c5\u73af\u5883\u68c0\u67e5\u3002\n\n### 3. NotebookExtensions \u670d\u52a1\u4e0e\u6269\u5c55\u5de5\u4f5c\u533a\n\n\u5728 [`src/service/aznb/NotebookExtensions/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package.json&_a=files) \u7684 `overrides` \u4e2d\u52a0\u5165 2.x \u4e0e 5.x \u4e24\u6761\u56fa\u5b9a\u89c4\u5219\uff0c\u4e0e\u5ba2\u6237\u7aef\u7b56\u7565\u4e00\u81f4\u3002\n\n\u8be5\u6a21\u5757\u7684 [`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package-lock.json&_a=files) \u662f\u672c PR \u98ce\u9669\u6700\u9ad8\u7684\u90e8\u5206\u3002\u5206\u6790\u5305\u4e2d\u53ef\u89c1\u7684\u5185\u5bb9\u4e0d\u53ea\u662f `brace-expansion`\uff1a\n\n- \u591a\u4e2a\u5185\u90e8 workspace \u5305\u7248\u672c\u4ece `1.7.8-dev.20260531.1` \u53d8\u4e3a `1.7.9-dev.20260624.1`\uff0c\u5185\u90e8\u4f9d\u8d56\u5f15\u7528\u4e5f\u540c\u6b65\u53d8\u5316\u3002\n- \u5927\u91cf Babel\u3001ESLint\u3001API Extractor\u3001TypeScript \u53ca\u5176\u4ed6\u5de5\u5177\u94fe\u5305\u53d1\u751f\u5347\u7ea7\u3001\u964d\u7ea7\u3001\u53bb\u91cd\u6216\u91cd\u65b0\u5e03\u5c40\u3002\n- \u4e00\u4e9b\u5d4c\u5957\u4f9d\u8d56\u8282\u70b9\u88ab\u5220\u9664\uff0c\u53e6\u4e00\u4e9b 1.x `brace-expansion` \u8282\u70b9\u88ab\u91cd\u65b0\u5f15\u5165\u5230\u7279\u5b9a\u65e7\u7248 `minimatch` \u4f9d\u8d56\u6811\u4e2d\u3002\n- \u53ef\u89c1\u7684\u82e5\u5e72\u5305\u63d0\u9ad8\u4e86 Node \u5f15\u64ce\u8981\u6c42\uff0c\u4f8b\u5982\u90e8\u5206\u5de5\u5177\u94fe\u4f9d\u8d56\u8981\u6c42 Node 20 \u7684\u8f83\u65b0\u7248\u672c\u3002\n\n\u8fd9\u8868\u660e\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\uff0c\u4f9d\u8d56\u6811\u53d7\u5230\u5f53\u524d\u6e05\u5355\u3001workspace \u72b6\u6001\u3001npm \u7248\u672c\u6216\u89e3\u6790\u73af\u5883\u5f71\u54cd\uff0c\u4ea7\u751f\u4e86\u8fdc\u8d85\u4e24\u6761\u5b89\u5168\u8986\u76d6\u89c4\u5219\u7684\u53d8\u5316\u3002\u7531\u4e8e\u8be5\u6587\u4ef6\u5dee\u5f02\u88ab\u622a\u65ad\uff0c\u65e0\u6cd5\u4ece\u5206\u6790\u5305\u786e\u8ba4\u6240\u6709\u6700\u7ec8\u7248\u672c\u3001\u6240\u6709\u65b0\u589e/\u5220\u9664\u8282\u70b9\u4ee5\u53ca\u5b8c\u6574\u7684\u5b89\u5168\u4fee\u590d\u8986\u76d6\u60c5\u51b5\u3002\n\n## \u5b9e\u73b0\u673a\u5236\n\n\u6b64\u6b21\u4fee\u6539\u4f9d\u8d56 npm \u7684\u9876\u5c42\u8986\u76d6\u673a\u5236\u5de5\u4f5c\uff1a\n\n1. \u4e0a\u6e38\u5de5\u5177\u5305\uff08\u4f8b\u5982 `minimatch`\u3001`glob`\u3001`rimraf`\u3001`filelist` \u4ee5\u53ca PR \u63cf\u8ff0\u4e2d\u5217\u51fa\u7684\u5176\u4ed6\u5de5\u5177\u94fe\uff09\u95f4\u63a5\u58f0\u660e\u5bf9 `brace-expansion` \u7684\u4f9d\u8d56\u3002\n2. \u9879\u76ee\u9876\u5c42 `package.json` \u7528\u5e26\u4e3b\u7248\u672c\u9009\u62e9\u5668\u7684\u8986\u76d6\u89c4\u5219\uff0c\u5c06 2.x \u548c 5.x \u5206\u522b\u7ea6\u675f\u5230\u4fee\u590d\u7248\u672c\u3002\n3. \u91cd\u65b0\u751f\u6210\u7684 `package-lock.json` \u8bb0\u5f55\u5b9e\u9645\u89e3\u6790\u540e\u7684\u7cbe\u786e\u7248\u672c\u3001\u5305\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u3002\n4. \u540e\u7eed\u4f7f\u7528\u9501\u6587\u4ef6\u5b89\u88c5\u65f6\uff0cnpm \u5e94\u590d\u7528\u8be5\u89e3\u6790\u7ed3\u679c\uff0c\u4ece\u800c\u907f\u514d\u91cd\u65b0\u9009\u62e9\u88ab\u544a\u8b66\u7248\u672c\u3002\n\n\u6309\u4e3b\u7248\u672c\u5206\u522b\u8986\u76d6\u662f\u5fc5\u8981\u7684\uff1a2.x \u4e0e 5.x \u5177\u6709\u4e0d\u540c\u4f9d\u8d56\u548c\u8fd0\u884c\u65f6\u7ea6\u675f\uff0c\u5f3a\u884c\u7edf\u4e00\u6210\u4e00\u4e2a\u4e3b\u7248\u672c\u53ef\u80fd\u7834\u574f\u8c03\u7528\u65b9\u517c\u5bb9\u6027\u3002\u6b64\u6b21\u505a\u6cd5\u4fdd\u7559\u4e3b\u7248\u672c\u8fb9\u754c\uff0c\u53ea\u5728\u5404\u81ea\u5206\u652f\u5185\u5347\u7ea7\u5230\u4fee\u590d\u7248\u672c\uff0c\u539f\u5219\u4e0a\u6bd4\u8de8\u4e3b\u7248\u672c\u66ff\u6362\u66f4\u5b89\u5168\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u4e2d\u6ca1\u6709\u6d4b\u8bd5\u4ee3\u7801\u53d8\u66f4\uff0c\u4e5f\u6ca1\u6709\u5305\u542b\u6d41\u6c34\u7ebf\u8fd0\u884c\u8bb0\u5f55\u6216\u6d4b\u8bd5\u65e5\u5fd7\u3002\n\nPR \u63cf\u8ff0\u58f0\u79f0\u4e09\u4e2a\u9501\u6587\u4ef6\u5df2\u91cd\u65b0\u751f\u6210\u5e76\u4f7f\u7528 `npm ci` \u9a8c\u8bc1\uff0c\u4f46\u63cf\u8ff0\u7684\u201cVerification\u201d\u8868\u683c\u5728\u5305\u5185\u6587\u672c\u4e2d\u9014\u5f02\u5e38\u4e2d\u65ad\uff0c\u56e0\u6b64\u53ea\u80fd\u786e\u8ba4\u5b58\u5728\u8fd9\u9879\u58f0\u660e\uff0c\u4e0d\u80fd\u4ece\u672c\u5206\u6790\u5305\u72ec\u7acb\u786e\u8ba4\uff1a\n\n- \u6bcf\u4e2a\u76ee\u5f55\u662f\u5426\u90fd\u6267\u884c\u4e86 `npm ci`\uff1b\n- \u4f7f\u7528\u7684 npm \u4e0e Node \u7248\u672c\uff1b\n- \u6784\u5efa\u3001\u5355\u5143\u6d4b\u8bd5\u3001\u96c6\u6210\u6d4b\u8bd5\u6216\u7aef\u5230\u7aef\u6d4b\u8bd5\u662f\u5426\u901a\u8fc7\uff1b\n- Component Governance \u662f\u5426\u5df2\u91cd\u65b0\u626b\u63cf\u5e76\u5173\u95ed\u5168\u90e8 6 \u4e2a\u544a\u8b66\u3002\n\n\u5efa\u8bae\u8bc4\u5ba1\u65f6\u81f3\u5c11\u6838\u5bf9\u4e09\u4e2a\u76ee\u5f55\u7684\u5e72\u51c0\u73af\u5883\u5b89\u88c5\u7ed3\u679c\uff0c\u5e76\u5bf9 NotebookExtensions \u8fd0\u884c\u5176\u73b0\u6709\u6784\u5efa\u548c\u6d4b\u8bd5\u6d41\u7a0b\uff1b\u540c\u65f6\u786e\u8ba4\u5b89\u5168\u626b\u63cf\u7ed3\u679c\u786e\u5b9e\u4e0d\u518d\u62a5\u544a\u76ee\u6807 2.x/5.x \u8282\u70b9\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u5b89\u5168\u5f71\u54cd\n\n\u76ee\u6807\u662f\u6d88\u9664\u4e24\u4e2a\u53d7\u5f71\u54cd\u4e3b\u7248\u672c\u4e2d\u7684\u5df2\u77e5\u6f0f\u6d1e\u8282\u70b9\u3002\u8986\u76d6\u89c4\u5219\u4f4d\u4e8e\u9876\u5c42\uff0c\u53ef\u4f5c\u7528\u4e8e\u591a\u6761\u4f20\u9012\u4f9d\u8d56\u8def\u5f84\uff0c\u907f\u514d\u9010\u4e2a\u5347\u7ea7\u6240\u6709\u76f4\u63a5\u4f9d\u8d56\uff0c\u9002\u5408\u7d27\u6025\u5b89\u5168\u4fee\u590d\u3002\n\n### \u8fd0\u884c\u65f6\u4e0e\u4ea7\u54c1\u884c\u4e3a\n\nPR \u6ca1\u6709\u76f4\u63a5\u4fee\u6539\u4ea7\u54c1\u4ee3\u7801\u3002`brace-expansion` \u4e3b\u8981\u7531\u6587\u4ef6\u5339\u914d\u3001glob\u3001\u6e05\u7406\u3001\u6784\u5efa\u548c\u5305\u7ba1\u7406\u5de5\u5177\u94fe\u95f4\u63a5\u4f7f\u7528\uff0c\u56e0\u6b64\u9884\u671f\u4e3b\u8981\u5f71\u54cd\u5f00\u53d1\u3001\u6784\u5efa\u3001\u6d4b\u8bd5\u548c\u5b89\u88c5\u6d41\u7a0b\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u67d0\u6761\u751f\u4ea7\u4f9d\u8d56\u8def\u5f84\u5728\u8fd0\u884c\u65f6\u4f7f\u7528 glob/\u6a21\u5f0f\u5c55\u5f00\uff0c\u56fa\u5b9a\u7248\u672c\u4ecd\u53ef\u80fd\u6539\u53d8\u8fb9\u754c\u8f93\u5165\u7684\u5339\u914d\u884c\u4e3a\uff0c\u4e0d\u80fd\u4ec5\u56e0\u5176\u662f\u4f20\u9012\u4f9d\u8d56\u5c31\u65ad\u8a00\u5b8c\u5168\u6ca1\u6709\u8fd0\u884c\u65f6\u5f71\u54cd\u3002\n\n### \u6784\u5efa\u4e0e\u5f00\u53d1\u73af\u5883\n\n\u5ba2\u6237\u7aef\u53ef\u89c1\u7684 `brace-expansion@5.0.8` \u8981\u6c42 Node 20 \u6216\u66f4\u9ad8\u7248\u672c\uff08\u5141\u8bb8 >=22\uff09\u3002NotebookExtensions \u7684\u53ef\u89c1\u9501\u6587\u4ef6\u53d8\u5316\u8fd8\u5f15\u5165\u4e86\u5176\u4ed6\u66f4\u9ad8 Node \u5f15\u64ce\u8981\u6c42\u7684\u5de5\u5177\u5305\u3002\u56e0\u6b64\uff0c\u4ecd\u4f7f\u7528 Node 18 \u6216\u8f83\u65e7 Node 20 \u5c0f\u7248\u672c\u7684\u672c\u5730\u73af\u5883\u3001CI \u4ee3\u7406\u6216\u53d1\u5e03\u6784\u5efa\u53ef\u80fd\u9047\u5230\u5f15\u64ce\u8b66\u544a\u6216\u5b89\u88c5\u5931\u8d25\u3002\n\n### \u4f9d\u8d56\u53ef\u91cd\u590d\u6027\n\n\u63d0\u4ea4\u66f4\u65b0\u540e\u7684\u9501\u6587\u4ef6\u6709\u52a9\u4e8e\u786e\u4fdd\u540e\u7eed\u5b89\u88c5\u5f97\u5230\u56fa\u5b9a\u7684\u5b89\u5168\u7248\u672c\u3002\u4f46 NotebookExtensions \u9501\u6587\u4ef6\u7684\u5927\u8303\u56f4\u6f02\u79fb\u964d\u4f4e\u4e86\u6b64\u6b21\u5b89\u5168\u4fee\u590d\u7684\u53ef\u5ba1\u8ba1\u6027\uff0c\u4e5f\u6269\u5927\u4e86\u53ef\u91cd\u590d\u6027\u53d8\u5316\u7684\u8303\u56f4\uff1a\u5373\u4f7f\u5b89\u5168\u8986\u76d6\u672c\u8eab\u6b63\u786e\uff0c\u5176\u4ed6\u5de5\u5177\u94fe\u5347\u7ea7\u4e5f\u53ef\u80fd\u6539\u53d8\u7f16\u8bd1\u8f93\u51fa\u3001lint \u89c4\u5219\u3001API \u62bd\u53d6\u7ed3\u679c\u6216\u6d4b\u8bd5\u884c\u4e3a\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669 | \u5177\u4f53\u4f9d\u636e | \u5efa\u8bae\u5173\u6ce8 |\n|---|---|---|\n| NotebookExtensions \u9501\u6587\u4ef6\u53d1\u751f\u975e\u76ee\u6807\u4f9d\u8d56\u6f02\u79fb | \u53ef\u89c1\u5dee\u5f02\u5305\u542b workspace \u7248\u672c\u3001Babel\u3001ESLint\u3001API Extractor\u3001TypeScript \u7b49\u5927\u91cf\u53d8\u5316 | \u5224\u65ad\u8fd9\u4e9b\u53d8\u5316\u662f\u5426\u9884\u671f\uff1b\u82e5\u4e0d\u662f\uff0c\u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node/npm \u7248\u672c\u91cd\u65b0\u751f\u6210\u6700\u5c0f\u9501\u6587\u4ef6 |\n| Node 18 \u517c\u5bb9\u6027 | \u5ba2\u6237\u7aef\u9501\u6587\u4ef6\u4e2d `brace-expansion@5.0.8` \u7684\u5f15\u64ce\u8981\u6c42\u4e3a Node 20 \u6216 >=22\uff1bNotebookExtensions \u53ef\u89c1\u5de5\u5177\u94fe\u4e5f\u6709\u66f4\u9ad8\u8981\u6c42 | \u6838\u5bf9\u6240\u6709 CI\u3001\u5f00\u53d1\u673a\u548c\u53d1\u5e03\u4ee3\u7406\u7684 Node \u7248\u672c |\n| \u9501\u6587\u4ef6\u8bed\u4e49\u6807\u8bb0\u53d8\u5316 | \u5ba2\u6237\u7aef\u51fa\u73b0 `devOptional` \u2192 `dev`\uff0c\u591a\u4e2a\u53ef\u9009\u5305\u65b0\u589e `dev` \u6807\u8bb0 | \u9a8c\u8bc1\u751f\u4ea7\u5b89\u88c5\u3001`npm ci --omit=dev` \u6216\u7c7b\u4f3c\u88c1\u526a\u6d41\u7a0b\u6ca1\u6709\u9057\u6f0f/\u989d\u5916\u643a\u5e26\u4f9d\u8d56 |\n| npm/Yarn \u89e3\u6790\u4e00\u81f4\u6027 | \u793a\u4f8b\u9879\u76ee\u540c\u65f6\u7ef4\u62a4 `resolutions` \u4e0e `overrides`\uff0c\u53e6\u5916\u4e24\u4e2a\u9879\u76ee\u53ea\u4f7f\u7528 `overrides` | \u786e\u8ba4\u5404\u76ee\u5f55\u5b9e\u9645\u4f7f\u7528\u7684\u5305\u7ba1\u7406\u5668\u4e0e\u4ed3\u5e93\u7ea6\u5b9a\u4e00\u81f4 |\n| \u8986\u76d6\u89c4\u5219\u53ef\u80fd\u5f71\u54cd\u6240\u6709\u540c\u4e3b\u7248\u672c\u8c03\u7528\u65b9 | \u9876\u5c42\u89c4\u5219\u4f1a\u7edf\u4e00\u66ff\u6362\u4f9d\u8d56\u6811\u4e2d\u76f8\u5e94\u4e3b\u7248\u672c | \u8fd0\u884c glob\u3001\u6e05\u7406\u3001lint\u3001\u6253\u5305\u53ca\u76f8\u5173\u6d4b\u8bd5\uff0c\u5173\u6ce8\u6a21\u5f0f\u5c55\u5f00\u8fb9\u754c\u884c\u4e3a |\n| 1.x \u8282\u70b9\u4ecd\u5b58\u5728 | NotebookExtensions \u53ef\u89c1\u5dee\u5f02\u5305\u542b `brace-expansion@1.1.18` | PR \u63cf\u8ff0\u79f0 1.x \u4e0d\u5728\u544a\u8b66\u8303\u56f4\uff1b\u5e94\u4ee5 Component Governance \u626b\u63cf\u7ed3\u679c\u786e\u8ba4\uff0c\u800c\u975e\u5047\u8bbe\u6240\u6709 `brace-expansion` \u90fd\u5df2\u6d88\u5931 |\n| \u5b89\u5168\u4fee\u590d\u8986\u76d6\u65e0\u6cd5\u4ece\u622a\u65ad\u5dee\u5f02\u5b8c\u6574\u8bc1\u660e | \u6700\u5927\u6587\u4ef6\u5dee\u5f02\u88ab\u622a\u65ad | \u5728 Azure DevOps \u5b8c\u6574\u6587\u4ef6\u89c6\u56fe\u4e2d\u6838\u67e5\u6240\u6709 2.x/5.x \u8282\u70b9\u53ca\u6700\u7ec8\u89e3\u6790\u7248\u672c |\n\n## \u5dee\u5f02\u8986\u76d6\u8303\u56f4\u4e0e\u9650\u5236\n\n\u5206\u6790\u5305\u5217\u51fa\u7684 6 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u6709\u5dee\u5f02\u8bb0\u5f55\uff0c\u5176\u4e2d\u4ee5\u4e0b 5 \u4e2a\u6587\u4ef6\u7684\u5dee\u5f02\u6807\u8bb0\u4e3a\u5b8c\u6574\uff1a\n\n- [`sample/aznb-helloworld-output-renderer/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package.json&_a=files)\n- [`sample/aznb-helloworld-output-renderer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files)\n- [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package.json&_a=files)\n- [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package-lock.json&_a=files)\n- [`src/service/aznb/NotebookExtensions/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package.json&_a=files)\n\n[`src/service/aznb/NotebookExtensions/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package-lock.json&_a=files) \u7684\u539f\u59cb\u5dee\u5f02\u7ea6 322,703 \u5b57\u8282\uff0c\u4f46\u5206\u6790\u5305\u4ec5\u4fdd\u7559\u4e86\u53d7\u5355\u6587\u4ef6\u4e0a\u9650\u7ea6\u675f\u7684\u4e00\u90e8\u5206\uff0c\u5e76\u660e\u786e\u6807\u8bb0 `truncated=true`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u53ea\u8ba8\u8bba\u622a\u65ad\u524d\u5b9e\u9645\u53ef\u89c1\u7684\u53d8\u66f4\uff0c\u672a\u5bf9\u8be5\u9501\u6587\u4ef6\u672a\u5305\u542b\u90e8\u5206\u7684\u5177\u4f53\u5305\u7248\u672c\u3001\u4f9d\u8d56\u5173\u7cfb\u3001\u5b89\u5168\u72b6\u6001\u6216\u517c\u5bb9\u6027\u4f5c\u51fa\u7ed3\u8bba\u3002\n\n\u6b64\u5916\uff0c\u5305\u5185\u6ca1\u6709\u9519\u8bef\u6216\u8b66\u544a\u8bb0\u5f55\uff0c\u4f46\u8fd9\u53ea\u8868\u793a\u5bfc\u51fa\u8fc7\u7a0b\u672a\u62a5\u544a\u9519\u8bef\uff0c\u4e0d\u7b49\u540c\u4e8e PR \u6784\u5efa\u3001\u6d4b\u8bd5\u6216\u5b89\u5168\u626b\u63cf\u5747\u5df2\u901a\u8fc7\u3002\n", "creation_timestamp": "2026-08-31T16:11:35.445529Z"}