{"uuid": "3d64e462-1ba8-4b36-9554-90c4279e9d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73088", "type": "seen", "source": "https://gist.github.com/djlan/cceed0d99bfb6e25cf9c9ac2042ad728", "content": "# [\u5b89\u5168\u66f4\u65b0] \u5c06 `/sample/angular-host-app` \u4e2d\u7684 browserslist \u4ece 4.28.1 \u5347\u7ea7\u5230 4.28.8\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 Angular \u793a\u4f8b\u5bbf\u4e3b\u5e94\u7528\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06 `browserslist` \u53ca\u5176\u6d4f\u89c8\u5668\u6570\u636e\u76f8\u5173\u4f20\u9012\u4f9d\u8d56\u5347\u7ea7\u5230\u8f83\u65b0\u7248\u672c\uff0c\u4ee5\u4fee\u590d\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u53ef\u80fd\u63d0\u9ad8\u6784\u5efa\u73af\u5883\u6240\u9700\u7684\u6700\u4f4e Node.js \u7248\u672c\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 778333](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | \u6d3b\u8dc3\uff08\u975e\u8349\u7a3f\uff09\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\uff0c\u8868\u793a\u5f53\u524d\u53ef\u5408\u5e76\u6027\u68c0\u67e5\u6210\u529f\uff0c\u5e76\u4e0d\u4ee3\u8868\u5df2\u7ecf\u5408\u5e76 |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fangular-host-app/browserslist-4.28.8-757402` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-09-05 09:35:06 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 1 |\n| \u53d8\u66f4\u6587\u4ef6 | 1 |\n| \u5dee\u5f02\u7edf\u8ba1 | 31 \u884c\u65b0\u589e\uff0c25 \u884c\u5220\u9664\uff08\u6839\u636e\u5305\u5185 diff \u7edf\u8ba1\uff09 |\n| \u5dee\u5f02\u6765\u6e90 | `git-local` |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n6. [\u5206\u6790\u8986\u76d6\u8303\u56f4](#\u5206\u6790\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5\u53d8\u66f4\u7531 Dependabot \u521b\u5efa\uff0c\u76ee\u6807\u662f\u5904\u7406 Component Governance \u62a5\u544a\u7684\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027\u5b89\u5168\u544a\u8b66\uff1a`CVE-2026-73088` \u548c `CVE-2026-73089`\u3002\u5305\u5185\u4fe1\u606f\u8868\u660e\uff0c\u6838\u5fc3\u5347\u7ea7\u662f\u5c06 `browserslist` \u4ece `4.28.1` \u63d0\u5347\u5230 `4.28.8`\u3002\n\n\u552f\u4e00\u4fee\u6539\u7684\u6587\u4ef6\u662f [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333?path=/sample/angular-host-app/package-lock.json&_a=files)\u3002\u6ca1\u6709\u5e94\u7528\u6e90\u4ee3\u7801\u3001\u914d\u7f6e\u6e90\u7801\u6216\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\uff1b\u6b64\u6b21 PR \u901a\u8fc7\u66f4\u65b0\u9501\u6587\u4ef6\u56fa\u5b9a\u65b0\u7684\u4f9d\u8d56\u89e3\u6790\u7ed3\u679c\uff0c\u4f7f\u540e\u7eed\u4f7f\u7528\u9501\u6587\u4ef6\u5b89\u88c5\u4f9d\u8d56\u65f6\u83b7\u53d6\u4fee\u590d\u540e\u7684\u7248\u672c\u53ca\u914d\u5957\u6d4f\u89c8\u5668\u6570\u636e\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n[`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333?path=/sample/angular-host-app/package-lock.json&_a=files) \u5c06 `browserslist` \u4ece `4.28.1` \u5347\u7ea7\u81f3 `4.28.8`\uff0c\u5e76\u540c\u6b65\u66ff\u6362\u5185\u90e8 Azure Artifacts npm \u6e90\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u3002\n\n`browserslist` \u901a\u5e38\u7531\u524d\u7aef\u6784\u5efa\u5de5\u5177\u7528\u4e8e\u628a\u76ee\u6807\u6d4f\u89c8\u5668\u67e5\u8be2\u8f6c\u6362\u4e3a\u5177\u4f53\u6d4f\u89c8\u5668\u7248\u672c\u96c6\u5408\uff0c\u8fdb\u800c\u5f71\u54cd Babel\u3001Autoprefixer \u7b49\u5de5\u5177\u7684\u8f6c\u8bd1\u6216 CSS \u517c\u5bb9\u5904\u7406\u3002\u672c\u6b21\u5347\u7ea7\u7684\u4e3b\u8981\u52a8\u673a\u662f\u5b89\u5168\u4fee\u590d\uff1b\u5305\u5185 release notes \u8fd8\u660e\u786e\u63d0\u5230\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u95ee\u9898\u548c\u65e0\u754c\u5185\u5b58\u589e\u957f\u7b49\u4fee\u590d\u3002\u56e0\u6b64\uff0c\u65b0\u9501\u6587\u4ef6\u4f1a\u8ba9\u786e\u5b9a\u6027\u5b89\u88c5\u89e3\u6790\u5230\u5305\u542b\u8fd9\u4e9b\u4fee\u590d\u7684\u7248\u672c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u4f7f\u7528 `4.28.1`\u3002\n\n### 2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u94fe\u66f4\u65b0\n\n\u4e3a\u6ee1\u8db3\u65b0\u7248 `browserslist` \u7684\u4f9d\u8d56\u8303\u56f4\uff0c\u9501\u6587\u4ef6\u540c\u6b65\u66f4\u65b0\u4e86\u4ee5\u4e0b\u4f20\u9012\u4f9d\u8d56\uff1a\n\n| \u4f9d\u8d56 | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528\u4e0e\u53d8\u5316\u542b\u4e49 |\n|---|---:|---:|---|\n| `baseline-browser-mapping` | 2.9.15 | 2.11.20 | \u63d0\u4f9b Web Platform Baseline \u4e0e\u6d4f\u89c8\u5668\u7248\u672c\u6620\u5c04\uff1b\u547d\u4ee4\u5165\u53e3\u7531 `dist/cli.js` \u6539\u4e3a `dist/cli.cjs`\uff0c\u5e76\u65b0\u589e `node >=6.0.0` \u58f0\u660e |\n| `caniuse-lite` | 1.0.30001787 | 1.0.30001810 | \u66f4\u65b0\u6d4f\u89c8\u5668\u529f\u80fd\u652f\u6301\u6570\u636e\uff0c\u53ef\u80fd\u4f7f\u76f8\u540c\u67e5\u8be2\u5f97\u5230\u66f4\u65b0\u540e\u7684\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408 |\n| `electron-to-chromium` | 1.5.267 | 1.5.416 | \u66f4\u65b0 Electron \u4e0e Chromium \u7248\u672c\u6620\u5c04 |\n| `node-releases` | 2.0.27 | 2.0.54 | \u66f4\u65b0 Node.js \u53d1\u5e03\u7248\u672c\u6570\u636e\uff0c\u5e76\u65b0\u589e `node >=18` \u5f15\u64ce\u8981\u6c42 |\n| `update-browserslist-db` | 1.2.3 | 1.3.2 | \u66f4\u65b0 browserslist \u6570\u636e\u5e93\u7ef4\u62a4\u5de5\u5177 |\n\n\u8fd9\u4e9b\u66f4\u65b0\u5e76\u975e\u72ec\u7acb\u529f\u80fd\u5f00\u53d1\uff0c\u800c\u662f `browserslist 4.28.8` \u65b0\u4f9d\u8d56\u7ea6\u675f\u6240\u4ea7\u751f\u7684\u9501\u6587\u4ef6\u89e3\u6790\u7ed3\u679c\u3002\u5b83\u4eec\u5171\u540c\u786e\u4fdd\u6d4f\u89c8\u5668\u67e5\u8be2\u3001\u5b89\u5168\u4fee\u590d\u548c\u7248\u672c\u6570\u636e\u5904\u4e8e\u76f8\u4e92\u517c\u5bb9\u7684\u4e00\u7ec4\u7248\u672c\u3002\n\n### 3. \u5b89\u88c5\u53ef\u91cd\u590d\u6027\u4e0e\u5236\u54c1\u6765\u6e90\n\n\u9501\u6587\u4ef6\u4e2d\u7684\u6bcf\u4e2a\u5347\u7ea7\u5305\u90fd\u540c\u6b65\u66f4\u65b0\u4e86 `resolved` \u548c `integrity`\u3002`resolved` \u4ecd\u6307\u5411\u4ed3\u5e93\u73b0\u6709\u7684\u5185\u90e8 Azure Artifacts feed\uff0c\u56e0\u6b64\u6ca1\u6709\u89c2\u5bdf\u5230\u5207\u6362\u5230\u516c\u5171 npm \u6e90\u7684\u884c\u4e3a\uff1b\u65b0\u7684\u5b8c\u6574\u6027\u54c8\u5e0c\u5219\u7528\u4e8e\u6821\u9a8c\u4e0b\u8f7d\u5230\u7684 tarball \u4e0e\u9501\u5b9a\u5236\u54c1\u4e00\u81f4\u3002\n\n\u7531\u4e8e\u5305\u5185\u6ca1\u6709\u5305\u542b `package.json` \u7684\u4fee\u6539\u6216\u5185\u5bb9\uff0c\u65e0\u6cd5\u786e\u8ba4 `browserslist` \u662f\u76f4\u63a5\u4f9d\u8d56\u8fd8\u662f\u7531\u5176\u4ed6\u5de5\u5177\u5f15\u5165\u7684\u4f20\u9012\u4f9d\u8d56\uff0c\u4e5f\u65e0\u6cd5\u4ece\u672c\u5206\u6790\u5305\u5224\u65ad\u5176\u58f0\u660e\u7248\u672c\u8303\u56f4\u3002\u53ef\u4ee5\u786e\u8ba4\u7684\u662f\uff0c\u63d0\u4ea4\u540e\u7684\u9501\u5b9a\u5b89\u88c5\u7ed3\u679c\u4f1a\u4f7f\u7528 `4.28.8`\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6784\u5efa\u4e0e\u4ea7\u7269\n\n- \u8fd0\u884c\u65f6\u4e1a\u52a1\u903b\u8f91\u6ca1\u6709\u76f4\u63a5\u53d8\u66f4\uff0c\u5f71\u54cd\u96c6\u4e2d\u5728\u4f9d\u8d56\u5b89\u88c5\u548c\u524d\u7aef\u6784\u5efa\u9636\u6bb5\u3002\n- \u66f4\u65b0\u540e\u7684 `caniuse-lite`\u3001`electron-to-chromium` \u548c `node-releases` \u6570\u636e\u53ef\u80fd\u6539\u53d8 browserslist \u67e5\u8be2\u89e3\u6790\u51fa\u7684\u5177\u4f53\u76ee\u6807\u7248\u672c\uff0c\u56e0\u6b64\u6700\u7ec8 JavaScript \u8f6c\u8bd1\u6216 CSS \u524d\u7f00\u7ed3\u679c\u53ef\u80fd\u51fa\u73b0\u5c0f\u5e45\u53d8\u5316\u3002\n- `baseline-browser-mapping` \u4fee\u590d\u4e86 Baseline\u3001KaiOS \u548c\u5927\u5c0f\u5199\u76f8\u5173\u67e5\u8be2\u95ee\u9898\uff1b\u5982\u679c\u9879\u76ee\u4f7f\u7528\u8fd9\u4e9b\u67e5\u8be2\uff0c\u65b0\u7248\u672c\u53ef\u80fd\u4ea7\u751f\u6bd4\u65e7\u7248\u672c\u66f4\u51c6\u786e\u4f46\u4e0d\u540c\u7684\u7ed3\u679c\u3002\n\n### \u5b89\u5168\n\n- PR \u660e\u786e\u9488\u5bf9\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027 CG \u544a\u8b66\uff0c\u5e76\u5347\u7ea7\u5230\u5305\u542b\u76f8\u5173\u5b89\u5168\u4fee\u590d\u7684\u7248\u672c\u3002\n- \u5305\u5185\u6ca1\u6709\u6f0f\u6d1e\u5229\u7528\u8def\u5f84\u3001\u53d7\u5f71\u54cd\u8c03\u7528\u70b9\u6216\u4fee\u590d\u63d0\u4ea4\u7684\u5b8c\u6574\u5185\u5bb9\uff0c\u56e0\u6b64\u4e0d\u80fd\u4ec5\u51ed\u8be5\u5305\u65ad\u8a00\u5e94\u7528\u6b64\u524d\u53ef\u88ab\u5b9e\u9645\u5229\u7528\uff0c\u4e5f\u4e0d\u80fd\u72ec\u7acb\u8bc1\u660e\u4e24\u4e2a CVE \u5df2\u5728\u6240\u6709\u4f9d\u8d56\u8def\u5f84\u4e0a\u5b8c\u5168\u6d88\u9664\uff1b\u5e94\u4ee5\u5408\u5e76\u540e\u7684 CG/\u4f9d\u8d56\u626b\u63cf\u7ed3\u679c\u4e3a\u51c6\u3002\n\n### \u8fd0\u7ef4\u4e0e\u5f00\u53d1\u73af\u5883\n\n- \u4f9d\u8d56\u4ecd\u6765\u81ea\u65e2\u6709\u5185\u90e8 feed\uff0c\u5236\u54c1\u6765\u6e90\u6a21\u5f0f\u672a\u6539\u53d8\u3002\n- `node-releases 2.0.54` \u58f0\u660e `node >=18`\uff0c\u8fd9\u662f\u672c\u6b21\u53d8\u66f4\u6700\u5177\u4f53\u7684\u73af\u5883\u517c\u5bb9\u6027\u98ce\u9669\u3002\u82e5 CI\u3001\u5f00\u53d1\u673a\u6216\u793a\u4f8b\u6784\u5efa\u4ecd\u4f7f\u7528 Node.js 16 \u6216\u66f4\u65e9\u7248\u672c\uff0cnpm \u53ef\u80fd\u53d1\u51fa `EBADENGINE` \u8b66\u544a\uff1b\u5728\u542f\u7528\u4e25\u683c engine \u6821\u9a8c\u65f6\uff0c\u5b89\u88c5\u53ef\u80fd\u76f4\u63a5\u5931\u8d25\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9\n\n| \u98ce\u9669 | \u5177\u4f53\u8868\u73b0 | \u5efa\u8bae |\n|---|---|---|\n| Node.js \u6700\u4f4e\u7248\u672c\u53d8\u5316 | \u65b0\u9501\u5b9a\u7684 `node-releases` \u8981\u6c42 Node.js 18 \u6216\u66f4\u9ad8\uff1b\u65e7\u6784\u5efa\u4ee3\u7406\u53ef\u80fd\u8b66\u544a\u6216\u5b89\u88c5\u5931\u8d25 | \u786e\u8ba4 Angular \u793a\u4f8b\u53ca\u5176 CI \u4f7f\u7528 Node.js 18+\uff0c\u5e76\u68c0\u67e5\u662f\u5426\u542f\u7528\u4e86 `engine-strict` |\n| \u6d4f\u89c8\u5668\u76ee\u6807\u96c6\u5408\u53d8\u5316 | \u65b0\u7248\u517c\u5bb9\u6027\u6570\u636e\u5e93\u53ef\u80fd\u8ba9\u76f8\u540c browserslist \u67e5\u8be2\u8fd4\u56de\u4e0d\u540c\u6d4f\u89c8\u5668\u7248\u672c | \u5bf9\u6bd4\u5347\u7ea7\u524d\u540e\u7684 browserslist \u8f93\u51fa\uff0c\u5e76\u68c0\u67e5\u6784\u5efa\u4ea7\u7269\u6216\u5feb\u7167\u662f\u5426\u53d1\u751f\u9884\u671f\u5916\u53d8\u5316 |\n| CLI \u5165\u53e3\u53d8\u5316 | `baseline-browser-mapping` \u7684 bin \u4ece `dist/cli.js` \u6539\u4e3a `dist/cli.cjs` | \u82e5\u811a\u672c\u7ed5\u8fc7\u5305\u7684 bin \u6620\u5c04\u5e76\u76f4\u63a5\u5f15\u7528\u65e7\u8def\u5f84\uff0c\u4f1a\u5931\u6548\uff1b\u5305\u5185\u672a\u63d0\u4f9b\u76f8\u5173\u811a\u672c\u5185\u5bb9\uff0c\u65e0\u6cd5\u786e\u8ba4\u662f\u5426\u5b58\u5728\u6b64\u7528\u6cd5 |\n| \u4ec5\u9501\u6587\u4ef6\u53d8\u66f4 | \u5305\u5185\u6ca1\u6709 `package.json` \u53d8\u66f4\uff0c\u65e0\u6cd5\u786e\u8ba4\u58f0\u660e\u8303\u56f4\u662f\u5426\u5141\u8bb8\u6216\u7a33\u5b9a\u5730\u4ea7\u751f\u6b64\u89e3\u6790\u7ed3\u679c | \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 npm \u7248\u672c\u6267\u884c\u5e72\u51c0\u5b89\u88c5\uff0c\u5e76\u786e\u8ba4\u9501\u6587\u4ef6\u4e0d\u4f1a\u88ab\u518d\u6b21\u6539\u5199 |\n| \u5b89\u5168\u4fee\u590d\u9a8c\u8bc1\u4e0d\u8db3 | \u63cf\u8ff0\u5217\u51fa CVE\uff0c\u4f46\u5305\u5185\u6ca1\u6709 CG \u590d\u626b\u7ed3\u679c\u6216\u6f0f\u6d1e\u7ec6\u8282 | \u5408\u5e76\u524d\u786e\u8ba4 CG \u544a\u8b66\u5728\u8be5\u5206\u652f\u4e0a\u5df2\u6e05\u9664\uff0c\u5e76\u68c0\u67e5\u662f\u5426\u4ecd\u5b58\u5728\u5176\u4ed6\u8def\u5f84\u9501\u5b9a\u65e7\u7248\u672c |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u6d4b\u8bd5\u53d8\u66f4\u3001\u6d4b\u8bd5\u6267\u884c\u8bb0\u5f55\u3001CI \u6784\u5efa\u7ed3\u679c\u6216 Component Governance \u590d\u626b\u7ed3\u679c\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u672c PR \u5df2\u901a\u8fc7\u6d4b\u8bd5\u3002\u5efa\u8bae\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n1. \u5728\u9879\u76ee\u652f\u6301\u7684\u6700\u4f4e Node.js \u7248\u672c\u4ee5\u53ca Node.js 18+ \u73af\u5883\u4e2d\u6267\u884c\u9501\u6587\u4ef6\u9a71\u52a8\u7684\u5e72\u51c0\u5b89\u88c5\uff0c\u786e\u8ba4\u6ca1\u6709 engine \u6216\u5b8c\u6574\u6027\u9519\u8bef\u3002\n2. \u6784\u5efa `/sample/angular-host-app`\uff0c\u786e\u8ba4 Angular\u3001Babel/PostCSS \u7b49\u4f9d\u8d56 browserslist \u7684\u5de5\u5177\u94fe\u6b63\u5e38\u5de5\u4f5c\u3002\n3. \u8fd0\u884c\u8be5\u793a\u4f8b\u73b0\u6709\u7684\u5355\u5143\u6d4b\u8bd5\u3001lint \u548c\u7aef\u5230\u7aef\u6d4b\u8bd5\uff08\u5982\u679c\u4ed3\u5e93\u5df2\u6709\u5bf9\u5e94\u547d\u4ee4\uff09\u3002\n4. \u8f93\u51fa\u5e76\u6bd4\u8f83\u9879\u76ee browserslist \u67e5\u8be2\u7ed3\u679c\uff0c\u786e\u8ba4\u76ee\u6807\u6d4f\u89c8\u5668\u53d8\u5316\u7b26\u5408\u9884\u671f\u3002\n5. \u91cd\u65b0\u8fd0\u884c CG/\u4f9d\u8d56\u5b89\u5168\u626b\u63cf\uff0c\u786e\u8ba4 `CVE-2026-73088` \u548c `CVE-2026-73089` \u544a\u8b66\u5df2\u89e3\u51b3\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\n\n- \u5305\u5185\u5217\u51fa\u7684 1 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u6709 diff\uff0c\u4e14\u6587\u4ef6\u7ea7 `truncated` \u4e3a `false`\uff1b\u603b\u4f53 `diffTruncated` \u4e5f\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5206\u6790\u5305\u63d0\u4f9b\u7684\u5168\u90e8\u4ee3\u7801\u5dee\u5f02\u3002\n- diff \u5927\u5c0f\u4e3a 5,054 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5305\u8bb0\u5f55\u7684\u603b\u5dee\u5f02\u4e0a\u9650 524,288 \u5b57\u8282\u548c\u5355\u6587\u4ef6\u4e0a\u9650 65,536 \u5b57\u8282\u3002\n- PR \u63cf\u8ff0\u4e2d\u7684\u4e0a\u6e38 changelog \u6587\u672c\u4ee5 `https://gith...` \u7ed3\u675f\uff0c\u660e\u663e\u672a\u5b8c\u6574\u5305\u542b\u5728\u5305\u4e2d\u3002\u672c\u6587\u53ea\u4f7f\u7528\u4e86\u5305\u5185\u53ef\u89c1\u7684 release notes \u6458\u8981\uff0c\u6ca1\u6709\u58f0\u79f0\u5206\u6790\u88ab\u7701\u7565\u7684 changelog\u3001\u4e0a\u6e38\u63d0\u4ea4\u6216\u5b8c\u6574 CVE \u6280\u672f\u7ec6\u8282\u3002\n- \u5305\u5185\u6ca1\u6709 `package.json` \u5185\u5bb9\u3001\u6784\u5efa\u65e5\u5fd7\u3001\u6d4b\u8bd5\u7ed3\u679c\u3001\u7b56\u7565\u68c0\u67e5\u8be6\u60c5\u6216\u5b8c\u6574\u6f0f\u6d1e\u62a5\u544a\uff1b\u76f8\u5173\u7ed3\u8bba\u5747\u6309\u4e0a\u8ff0\u9650\u5236\u8868\u8ff0\u3002\n", "creation_timestamp": "2026-09-05T16:19:59.162776Z"}