https://vulnerability.circl.lu/sightings/feed 2026-09-05T19:39:32.156678+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3d64e462-1ba8-4b36-9554-90c4279e9d3f/export 2026-09-05T19:39:32.179968+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3d64e462-1ba8-4b36-9554-90c4279e9d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73088", "type": "seen", "source": "https://gist.github.com/djlan/cceed0d99bfb6e25cf9c9ac2042ad728", "content": "# [\u5b89\u5168\u66f4\u65b0] \u5c06 `/sample/angular-host-app` \u4e2d\u7684 browserslist \u4ece 4.28.1 \u5347\u7ea7\u5230 4.28.8\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 Angular \u793a\u4f8b\u5bbf\u4e3b\u5e94\u7528\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06 `browserslist` \u53ca\u5176\u6d4f\u89c8\u5668\u6570\u636e\u76f8\u5173\u4f20\u9012\u4f9d\u8d56\u5347\u7ea7\u5230\u8f83\u65b0\u7248\u672c\uff0c\u4ee5\u4fee\u590d\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u53ef\u80fd\u63d0\u9ad8\u6784\u5efa\u73af\u5883\u6240\u9700\u7684\u6700\u4f4e Node.js \u7248\u672c\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 778333](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | \u6d3b\u8dc3\uff08\u975e\u8349\u7a3f\uff09\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\uff0c\u8868\u793a\u5f53\u524d\u53ef\u5408\u5e76\u6027\u68c0\u67e5\u6210\u529f\uff0c\u5e76\u4e0d\u4ee3\u8868\u5df2\u7ecf\u5408\u5e76 |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fangular-host-app/browserslist-4.28.8-757402` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-09-05 09:35:06 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 1 |\n| \u53d8\u66f4\u6587\u4ef6 | 1 |\n| \u5dee\u5f02\u7edf\u8ba1 | 31 \u884c\u65b0\u589e\uff0c25 \u884c\u5220\u9664\uff08\u6839\u636e\u5305\u5185 diff \u7edf\u8ba1\uff09 |\n| \u5dee\u5f02\u6765\u6e90 | `git-local` |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n6. [\u5206\u6790\u8986\u76d6\u8303\u56f4](#\u5206\u6790\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5\u53d8\u66f4\u7531 Dependabot \u521b\u5efa\uff0c\u76ee\u6807\u662f\u5904\u7406 Component Governance \u62a5\u544a\u7684\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027\u5b89\u5168\u544a\u8b66\uff1a`CVE-2026-73088` \u548c `CVE-2026-73089`\u3002\u5305\u5185\u4fe1\u606f\u8868\u660e\uff0c\u6838\u5fc3\u5347\u7ea7\u662f\u5c06 `browserslist` \u4ece `4.28.1` \u63d0\u5347\u5230 `4.28.8`\u3002\n\n\u552f\u4e00\u4fee\u6539\u7684\u6587\u4ef6\u662f [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333?path=/sample/angular-host-app/package-lock.json&_a=files)\u3002\u6ca1\u6709\u5e94\u7528\u6e90\u4ee3\u7801\u3001\u914d\u7f6e\u6e90\u7801\u6216\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\uff1b\u6b64\u6b21 PR \u901a\u8fc7\u66f4\u65b0\u9501\u6587\u4ef6\u56fa\u5b9a\u65b0\u7684\u4f9d\u8d56\u89e3\u6790\u7ed3\u679c\uff0c\u4f7f\u540e\u7eed\u4f7f\u7528\u9501\u6587\u4ef6\u5b89\u88c5\u4f9d\u8d56\u65f6\u83b7\u53d6\u4fee\u590d\u540e\u7684\u7248\u672c\u53ca\u914d\u5957\u6d4f\u89c8\u5668\u6570\u636e\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n[`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333?path=/sample/angular-host-app/package-lock.json&_a=files) \u5c06 `browserslist` \u4ece `4.28.1` \u5347\u7ea7\u81f3 `4.28.8`\uff0c\u5e76\u540c\u6b65\u66ff\u6362\u5185\u90e8 Azure Artifacts npm \u6e90\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u3002\n\n`browserslist` \u901a\u5e38\u7531\u524d\u7aef\u6784\u5efa\u5de5\u5177\u7528\u4e8e\u628a\u76ee\u6807\u6d4f\u89c8\u5668\u67e5\u8be2\u8f6c\u6362\u4e3a\u5177\u4f53\u6d4f\u89c8\u5668\u7248\u672c\u96c6\u5408\uff0c\u8fdb\u800c\u5f71\u54cd Babel\u3001Autoprefixer \u7b49\u5de5\u5177\u7684\u8f6c\u8bd1\u6216 CSS \u517c\u5bb9\u5904\u7406\u3002\u672c\u6b21\u5347\u7ea7\u7684\u4e3b\u8981\u52a8\u673a\u662f\u5b89\u5168\u4fee\u590d\uff1b\u5305\u5185 release notes \u8fd8\u660e\u786e\u63d0\u5230\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u95ee\u9898\u548c\u65e0\u754c\u5185\u5b58\u589e\u957f\u7b49\u4fee\u590d\u3002\u56e0\u6b64\uff0c\u65b0\u9501\u6587\u4ef6\u4f1a\u8ba9\u786e\u5b9a\u6027\u5b89\u88c5\u89e3\u6790\u5230\u5305\u542b\u8fd9\u4e9b\u4fee\u590d\u7684\u7248\u672c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u4f7f\u7528 `4.28.1`\u3002\n\n### 2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u94fe\u66f4\u65b0\n\n\u4e3a\u6ee1\u8db3\u65b0\u7248 `browserslist` \u7684\u4f9d\u8d56\u8303\u56f4\uff0c\u9501\u6587\u4ef6\u540c\u6b65\u66f4\u65b0\u4e86\u4ee5\u4e0b\u4f20\u9012\u4f9d\u8d56\uff1a\n\n| \u4f9d\u8d56 | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528\u4e0e\u53d8\u5316\u542b\u4e49 |\n|---|---:|---:|---|\n| `baseline-browser-mapping` | 2.9.15 | 2.11.20 | \u63d0\u4f9b Web Platform Baseline \u4e0e\u6d4f\u89c8\u5668\u7248\u672c\u6620\u5c04\uff1b\u547d\u4ee4\u5165\u53e3\u7531 `dist/cli.js` \u6539\u4e3a `dist/cli.cjs`\uff0c\u5e76\u65b0\u589e `node >=6.0.0` \u58f0\u660e |\n| `caniuse-lite` | 1.0.30001787 | 1.0.30001810 | \u66f4\u65b0\u6d4f\u89c8\u5668\u529f\u80fd\u652f\u6301\u6570\u636e\uff0c\u53ef\u80fd\u4f7f\u76f8\u540c\u67e5\u8be2\u5f97\u5230\u66f4\u65b0\u540e\u7684\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408 |\n| `electron-to-chromium` | 1.5.267 | 1.5.416 | \u66f4\u65b0 Electron \u4e0e Chromium \u7248\u672c\u6620\u5c04 |\n| `node-releases` | 2.0.27 | 2.0.54 | \u66f4\u65b0 Node.js \u53d1\u5e03\u7248\u672c\u6570\u636e\uff0c\u5e76\u65b0\u589e `node >=18` \u5f15\u64ce\u8981\u6c42 |\n| `update-browserslist-db` | 1.2.3 | 1.3.2 | \u66f4\u65b0 browserslist \u6570\u636e\u5e93\u7ef4\u62a4\u5de5\u5177 |\n\n\u8fd9\u4e9b\u66f4\u65b0\u5e76\u975e\u72ec\u7acb\u529f\u80fd\u5f00\u53d1\uff0c\u800c\u662f `browserslist 4.28.8` \u65b0\u4f9d\u8d56\u7ea6\u675f\u6240\u4ea7\u751f\u7684\u9501\u6587\u4ef6\u89e3\u6790\u7ed3\u679c\u3002\u5b83\u4eec\u5171\u540c\u786e\u4fdd\u6d4f\u89c8\u5668\u67e5\u8be2\u3001\u5b89\u5168\u4fee\u590d\u548c\u7248\u672c\u6570\u636e\u5904\u4e8e\u76f8\u4e92\u517c\u5bb9\u7684\u4e00\u7ec4\u7248\u672c\u3002\n\n### 3. \u5b89\u88c5\u53ef\u91cd\u590d\u6027\u4e0e\u5236\u54c1\u6765\u6e90\n\n\u9501\u6587\u4ef6\u4e2d\u7684\u6bcf\u4e2a\u5347\u7ea7\u5305\u90fd\u540c\u6b65\u66f4\u65b0\u4e86 `resolved` \u548c `integrity`\u3002`resolved` \u4ecd\u6307\u5411\u4ed3\u5e93\u73b0\u6709\u7684\u5185\u90e8 Azure Artifacts feed\uff0c\u56e0\u6b64\u6ca1\u6709\u89c2\u5bdf\u5230\u5207\u6362\u5230\u516c\u5171 npm \u6e90\u7684\u884c\u4e3a\uff1b\u65b0\u7684\u5b8c\u6574\u6027\u54c8\u5e0c\u5219\u7528\u4e8e\u6821\u9a8c\u4e0b\u8f7d\u5230\u7684 tarball \u4e0e\u9501\u5b9a\u5236\u54c1\u4e00\u81f4\u3002\n\n\u7531\u4e8e\u5305\u5185\u6ca1\u6709\u5305\u542b `package.json` \u7684\u4fee\u6539\u6216\u5185\u5bb9\uff0c\u65e0\u6cd5\u786e\u8ba4 `browserslist` \u662f\u76f4\u63a5\u4f9d\u8d56\u8fd8\u662f\u7531\u5176\u4ed6\u5de5\u5177\u5f15\u5165\u7684\u4f20\u9012\u4f9d\u8d56\uff0c\u4e5f\u65e0\u6cd5\u4ece\u672c\u5206\u6790\u5305\u5224\u65ad\u5176\u58f0\u660e\u7248\u672c\u8303\u56f4\u3002\u53ef\u4ee5\u786e\u8ba4\u7684\u662f\uff0c\u63d0\u4ea4\u540e\u7684\u9501\u5b9a\u5b89\u88c5\u7ed3\u679c\u4f1a\u4f7f\u7528 `4.28.8`\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6784\u5efa\u4e0e\u4ea7\u7269\n\n- \u8fd0\u884c\u65f6\u4e1a\u52a1\u903b\u8f91\u6ca1\u6709\u76f4\u63a5\u53d8\u66f4\uff0c\u5f71\u54cd\u96c6\u4e2d\u5728\u4f9d\u8d56\u5b89\u88c5\u548c\u524d\u7aef\u6784\u5efa\u9636\u6bb5\u3002\n- \u66f4\u65b0\u540e\u7684 `caniuse-lite`\u3001`electron-to-chromium` \u548c `node-releases` \u6570\u636e\u53ef\u80fd\u6539\u53d8 browserslist \u67e5\u8be2\u89e3\u6790\u51fa\u7684\u5177\u4f53\u76ee\u6807\u7248\u672c\uff0c\u56e0\u6b64\u6700\u7ec8 JavaScript \u8f6c\u8bd1\u6216 CSS \u524d\u7f00\u7ed3\u679c\u53ef\u80fd\u51fa\u73b0\u5c0f\u5e45\u53d8\u5316\u3002\n- `baseline-browser-mapping` \u4fee\u590d\u4e86 Baseline\u3001KaiOS \u548c\u5927\u5c0f\u5199\u76f8\u5173\u67e5\u8be2\u95ee\u9898\uff1b\u5982\u679c\u9879\u76ee\u4f7f\u7528\u8fd9\u4e9b\u67e5\u8be2\uff0c\u65b0\u7248\u672c\u53ef\u80fd\u4ea7\u751f\u6bd4\u65e7\u7248\u672c\u66f4\u51c6\u786e\u4f46\u4e0d\u540c\u7684\u7ed3\u679c\u3002\n\n### \u5b89\u5168\n\n- PR \u660e\u786e\u9488\u5bf9\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027 CG \u544a\u8b66\uff0c\u5e76\u5347\u7ea7\u5230\u5305\u542b\u76f8\u5173\u5b89\u5168\u4fee\u590d\u7684\u7248\u672c\u3002\n- \u5305\u5185\u6ca1\u6709\u6f0f\u6d1e\u5229\u7528\u8def\u5f84\u3001\u53d7\u5f71\u54cd\u8c03\u7528\u70b9\u6216\u4fee\u590d\u63d0\u4ea4\u7684\u5b8c\u6574\u5185\u5bb9\uff0c\u56e0\u6b64\u4e0d\u80fd\u4ec5\u51ed\u8be5\u5305\u65ad\u8a00\u5e94\u7528\u6b64\u524d\u53ef\u88ab\u5b9e\u9645\u5229\u7528\uff0c\u4e5f\u4e0d\u80fd\u72ec\u7acb\u8bc1\u660e\u4e24\u4e2a CVE \u5df2\u5728\u6240\u6709\u4f9d\u8d56\u8def\u5f84\u4e0a\u5b8c\u5168\u6d88\u9664\uff1b\u5e94\u4ee5\u5408\u5e76\u540e\u7684 CG/\u4f9d\u8d56\u626b\u63cf\u7ed3\u679c\u4e3a\u51c6\u3002\n\n### \u8fd0\u7ef4\u4e0e\u5f00\u53d1\u73af\u5883\n\n- \u4f9d\u8d56\u4ecd\u6765\u81ea\u65e2\u6709\u5185\u90e8 feed\uff0c\u5236\u54c1\u6765\u6e90\u6a21\u5f0f\u672a\u6539\u53d8\u3002\n- `node-releases 2.0.54` \u58f0\u660e `node >=18`\uff0c\u8fd9\u662f\u672c\u6b21\u53d8\u66f4\u6700\u5177\u4f53\u7684\u73af\u5883\u517c\u5bb9\u6027\u98ce\u9669\u3002\u82e5 CI\u3001\u5f00\u53d1\u673a\u6216\u793a\u4f8b\u6784\u5efa\u4ecd\u4f7f\u7528 Node.js 16 \u6216\u66f4\u65e9\u7248\u672c\uff0cnpm \u53ef\u80fd\u53d1\u51fa `EBADENGINE` \u8b66\u544a\uff1b\u5728\u542f\u7528\u4e25\u683c engine \u6821\u9a8c\u65f6\uff0c\u5b89\u88c5\u53ef\u80fd\u76f4\u63a5\u5931\u8d25\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9\n\n| \u98ce\u9669 | \u5177\u4f53\u8868\u73b0 | \u5efa\u8bae |\n|---|---|---|\n| Node.js \u6700\u4f4e\u7248\u672c\u53d8\u5316 | \u65b0\u9501\u5b9a\u7684 `node-releases` \u8981\u6c42 Node.js 18 \u6216\u66f4\u9ad8\uff1b\u65e7\u6784\u5efa\u4ee3\u7406\u53ef\u80fd\u8b66\u544a\u6216\u5b89\u88c5\u5931\u8d25 | \u786e\u8ba4 Angular \u793a\u4f8b\u53ca\u5176 CI \u4f7f\u7528 Node.js 18+\uff0c\u5e76\u68c0\u67e5\u662f\u5426\u542f\u7528\u4e86 `engine-strict` |\n| \u6d4f\u89c8\u5668\u76ee\u6807\u96c6\u5408\u53d8\u5316 | \u65b0\u7248\u517c\u5bb9\u6027\u6570\u636e\u5e93\u53ef\u80fd\u8ba9\u76f8\u540c browserslist \u67e5\u8be2\u8fd4\u56de\u4e0d\u540c\u6d4f\u89c8\u5668\u7248\u672c | \u5bf9\u6bd4\u5347\u7ea7\u524d\u540e\u7684 browserslist \u8f93\u51fa\uff0c\u5e76\u68c0\u67e5\u6784\u5efa\u4ea7\u7269\u6216\u5feb\u7167\u662f\u5426\u53d1\u751f\u9884\u671f\u5916\u53d8\u5316 |\n| CLI \u5165\u53e3\u53d8\u5316 | `baseline-browser-mapping` \u7684 bin \u4ece `dist/cli.js` \u6539\u4e3a `dist/cli.cjs` | \u82e5\u811a\u672c\u7ed5\u8fc7\u5305\u7684 bin \u6620\u5c04\u5e76\u76f4\u63a5\u5f15\u7528\u65e7\u8def\u5f84\uff0c\u4f1a\u5931\u6548\uff1b\u5305\u5185\u672a\u63d0\u4f9b\u76f8\u5173\u811a\u672c\u5185\u5bb9\uff0c\u65e0\u6cd5\u786e\u8ba4\u662f\u5426\u5b58\u5728\u6b64\u7528\u6cd5 |\n| \u4ec5\u9501\u6587\u4ef6\u53d8\u66f4 | \u5305\u5185\u6ca1\u6709 `package.json` \u53d8\u66f4\uff0c\u65e0\u6cd5\u786e\u8ba4\u58f0\u660e\u8303\u56f4\u662f\u5426\u5141\u8bb8\u6216\u7a33\u5b9a\u5730\u4ea7\u751f\u6b64\u89e3\u6790\u7ed3\u679c | \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 npm \u7248\u672c\u6267\u884c\u5e72\u51c0\u5b89\u88c5\uff0c\u5e76\u786e\u8ba4\u9501\u6587\u4ef6\u4e0d\u4f1a\u88ab\u518d\u6b21\u6539\u5199 |\n| \u5b89\u5168\u4fee\u590d\u9a8c\u8bc1\u4e0d\u8db3 | \u63cf\u8ff0\u5217\u51fa CVE\uff0c\u4f46\u5305\u5185\u6ca1\u6709 CG \u590d\u626b\u7ed3\u679c\u6216\u6f0f\u6d1e\u7ec6\u8282 | \u5408\u5e76\u524d\u786e\u8ba4 CG \u544a\u8b66\u5728\u8be5\u5206\u652f\u4e0a\u5df2\u6e05\u9664\uff0c\u5e76\u68c0\u67e5\u662f\u5426\u4ecd\u5b58\u5728\u5176\u4ed6\u8def\u5f84\u9501\u5b9a\u65e7\u7248\u672c |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u6d4b\u8bd5\u53d8\u66f4\u3001\u6d4b\u8bd5\u6267\u884c\u8bb0\u5f55\u3001CI \u6784\u5efa\u7ed3\u679c\u6216 Component Governance \u590d\u626b\u7ed3\u679c\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u672c PR \u5df2\u901a\u8fc7\u6d4b\u8bd5\u3002\u5efa\u8bae\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n1. \u5728\u9879\u76ee\u652f\u6301\u7684\u6700\u4f4e Node.js \u7248\u672c\u4ee5\u53ca Node.js 18+ \u73af\u5883\u4e2d\u6267\u884c\u9501\u6587\u4ef6\u9a71\u52a8\u7684\u5e72\u51c0\u5b89\u88c5\uff0c\u786e\u8ba4\u6ca1\u6709 engine \u6216\u5b8c\u6574\u6027\u9519\u8bef\u3002\n2. \u6784\u5efa `/sample/angular-host-app`\uff0c\u786e\u8ba4 Angular\u3001Babel/PostCSS \u7b49\u4f9d\u8d56 browserslist \u7684\u5de5\u5177\u94fe\u6b63\u5e38\u5de5\u4f5c\u3002\n3. \u8fd0\u884c\u8be5\u793a\u4f8b\u73b0\u6709\u7684\u5355\u5143\u6d4b\u8bd5\u3001lint \u548c\u7aef\u5230\u7aef\u6d4b\u8bd5\uff08\u5982\u679c\u4ed3\u5e93\u5df2\u6709\u5bf9\u5e94\u547d\u4ee4\uff09\u3002\n4. \u8f93\u51fa\u5e76\u6bd4\u8f83\u9879\u76ee browserslist \u67e5\u8be2\u7ed3\u679c\uff0c\u786e\u8ba4\u76ee\u6807\u6d4f\u89c8\u5668\u53d8\u5316\u7b26\u5408\u9884\u671f\u3002\n5. \u91cd\u65b0\u8fd0\u884c CG/\u4f9d\u8d56\u5b89\u5168\u626b\u63cf\uff0c\u786e\u8ba4 `CVE-2026-73088` \u548c `CVE-2026-73089` \u544a\u8b66\u5df2\u89e3\u51b3\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\n\n- \u5305\u5185\u5217\u51fa\u7684 1 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u6709 diff\uff0c\u4e14\u6587\u4ef6\u7ea7 `truncated` \u4e3a `false`\uff1b\u603b\u4f53 `diffTruncated` \u4e5f\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5206\u6790\u5305\u63d0\u4f9b\u7684\u5168\u90e8\u4ee3\u7801\u5dee\u5f02\u3002\n- diff \u5927\u5c0f\u4e3a 5,054 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5305\u8bb0\u5f55\u7684\u603b\u5dee\u5f02\u4e0a\u9650 524,288 \u5b57\u8282\u548c\u5355\u6587\u4ef6\u4e0a\u9650 65,536 \u5b57\u8282\u3002\n- PR \u63cf\u8ff0\u4e2d\u7684\u4e0a\u6e38 changelog \u6587\u672c\u4ee5 `https://gith...` \u7ed3\u675f\uff0c\u660e\u663e\u672a\u5b8c\u6574\u5305\u542b\u5728\u5305\u4e2d\u3002\u672c\u6587\u53ea\u4f7f\u7528\u4e86\u5305\u5185\u53ef\u89c1\u7684 release notes \u6458\u8981\uff0c\u6ca1\u6709\u58f0\u79f0\u5206\u6790\u88ab\u7701\u7565\u7684 changelog\u3001\u4e0a\u6e38\u63d0\u4ea4\u6216\u5b8c\u6574 CVE \u6280\u672f\u7ec6\u8282\u3002\n- \u5305\u5185\u6ca1\u6709 `package.json` \u5185\u5bb9\u3001\u6784\u5efa\u65e5\u5fd7\u3001\u6d4b\u8bd5\u7ed3\u679c\u3001\u7b56\u7565\u68c0\u67e5\u8be6\u60c5\u6216\u5b8c\u6574\u6f0f\u6d1e\u62a5\u544a\uff1b\u76f8\u5173\u7ed3\u8bba\u5747\u6309\u4e0a\u8ff0\u9650\u5236\u8868\u8ff0\u3002\n", "creation_timestamp": "2026-09-05T16:19:59.162776Z"} 2026-09-05T16:19:59.162776+00:00 https://vulnerability.circl.lu/sighting/49609711-a796-4566-a2f1-c023991c63f8/export 2026-09-05T19:39:32.182272+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "49609711-a796-4566-a2f1-c023991c63f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73088", "type": "seen", "source": "https://gist.github.com/djlan/e3b6762435f262eb64ea25ec3f8c9d82", "content": "# [SECURITY] \u5c06 extension-sample \u7684 browserslist \u4ece 4.24.2 \u5347\u7ea7\u5230 4.28.8\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 `sample/extension-sample` \u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56 `browserslist` \u5347\u7ea7\u5230 4.28.8 \u5e76\u540c\u6b65\u5237\u65b0\u5176\u4f20\u9012\u4f9d\u8d56\uff0c\u4ee5\u5904\u7406\u4e24\u4e2a\u9ad8\u5371\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\uff0c\u540c\u65f6\u5f15\u5165\u66f4\u65b0\u7684\u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u4e0e\u67e5\u8be2\u5b9e\u73b0\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 777936](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777936) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff1b\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001 `succeeded` |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fextension-sample/browserslist-4.28.8-757184` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-09-04 09:35:12\uff08\u5206\u6790\u5305\u539f\u59cb\u65f6\u95f4\u683c\u5f0f\u672a\u6ce8\u660e\u65f6\u533a\uff09 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 1 |\n| \u53d8\u66f4\u6587\u4ef6 | 1 |\n| \u5dee\u5f02\u7edf\u8ba1 | +65 / -42\uff0c\u5171 107 \u884c\u53d8\u66f4 |\n| \u5b89\u5168\u80cc\u666f | CG Alert 16633189\uff08CVE-2026-73088\uff09\u3001CG Alert 16633190\uff08CVE-2026-73089\uff09\uff0c\u5747\u6807\u8bb0\u4e3a High |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n6. [\u5206\u6790\u8986\u76d6\u8303\u56f4](#\u5206\u6790\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u53d8\u66f4\u6ca1\u6709\u4fee\u6539\u5e94\u7528\u6e90\u7801\u6216 `package.json`\uff0c\u552f\u4e00\u4fee\u6539\u7684\u662f [`sample/extension-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777936?path=/sample/extension-sample/package-lock.json&_a=files)\u3002\u9501\u6587\u4ef6\u628a `browserslist` \u4ece 4.24.2 \u56fa\u5b9a\u5230 4.28.8\uff0c\u5e76\u6309\u7167\u65b0\u7248\u672c\u7684\u4f9d\u8d56\u58f0\u660e\u91cd\u65b0\u89e3\u6790\u3001\u56fa\u5b9a\u76f8\u5173\u4f20\u9012\u4f9d\u8d56\u3002\n\n\u8fd9\u6837\u505a\u7684\u6838\u5fc3\u76ee\u7684\uff0c\u662f\u8ba9\u540e\u7eed\u57fa\u4e8e\u8be5\u9501\u6587\u4ef6\u6267\u884c\u7684 npm \u5b89\u88c5\u4e0d\u518d\u53d6\u5f97\u65e7\u7248 `browserslist`\uff0c\u4ece\u800c\u5e94\u7528\u5347\u7ea7\u7248\u672c\u4e2d\u5305\u542b\u7684\u5b89\u5168\u4fee\u590d\u3002PR \u63cf\u8ff0\u660e\u786e\u5c06\u6b64\u5347\u7ea7\u5173\u8054\u5230\u4e24\u4e2a\u9ad8\u5371\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\uff1b\u5305\u5185\u53ef\u89c1\u7684\u53d1\u5e03\u8bf4\u660e\u8fd8\u63d0\u5230 4.28.x \u4fee\u590d\u4e86\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u95ee\u9898\u548c\u65e0\u754c\u5185\u5b58\u589e\u957f\u3002\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u4fee\u590d\u63d0\u4ea4\u4e4b\u95f4\u7684\u9010\u9879\u6620\u5c04\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u6bcf\u4e2a CVE \u5206\u522b\u7531\u54ea\u4e00\u5904\u4ee3\u7801\u4fee\u590d\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n[`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777936?path=/sample/extension-sample/package-lock.json&_a=files) \u4e2d\u7684 `browserslist` \u7248\u672c\u3001\u79c1\u6709 npm \u6e90\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u5747\u4ece 4.24.2 \u5bf9\u5e94\u503c\u66f4\u65b0\u4e3a 4.28.8 \u5bf9\u5e94\u503c\u3002\n\n\u9501\u6587\u4ef6\u662f npm \u7684\u53ef\u590d\u73b0\u5b89\u88c5\u4f9d\u636e\u3002\u6309\u6b64\u9501\u6587\u4ef6\u5b89\u88c5\u65f6\uff0cnpm \u5c06\u91c7\u7528\u65b0\u7684\u7cbe\u786e\u7248\u672c\u548c\u54c8\u5e0c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u4f7f\u7528\u5b58\u5728\u544a\u8b66\u7684 4.24.2\u3002\u7531\u4e8e\u5206\u6790\u5305\u672a\u5305\u542b `package.json`\uff0c\u65e0\u6cd5\u786e\u8ba4\u9876\u5c42\u7248\u672c\u8303\u56f4\u6216\u5176\u4ed6\u89e3\u6790\u89c4\u5219\u4e3a\u4f55\u65e0\u9700\u540c\u6b65\u4fee\u6539\u3002\u8be5\u5305\u88ab\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u56e0\u6b64\u4e3b\u8981\u5f71\u54cd\u6784\u5efa\u3001\u8f6c\u8bd1\u3001CSS/JavaScript \u76ee\u6807\u73af\u5883\u8ba1\u7b97\u7b49\u5f00\u53d1\u6216\u6784\u5efa\u9636\u6bb5\uff0c\u800c\u4e0d\u662f\u4f5c\u4e3a\u5e94\u7528\u4e1a\u52a1\u4ee3\u7801\u76f4\u63a5\u52a0\u8f7d\u3002\n\n### 2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u94fe\u5237\u65b0\n\n`browserslist` 4.28.8 \u9700\u8981\u66f4\u65b0\u7684\u6570\u636e\u5305\u548c\u7248\u672c\u6620\u5c04\uff0c\u56e0\u6b64\u9501\u6587\u4ef6\u540c\u65f6\u5347\u7ea7\uff1a\n\n| \u4f9d\u8d56 | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528 |\n|---|---:|---:|---|\n| `caniuse-lite` | 1.0.30001687 | 1.0.30001810 | \u63d0\u4f9b\u6d4f\u89c8\u5668\u529f\u80fd\u652f\u6301\u6570\u636e |\n| `electron-to-chromium` | 1.5.72 | 1.5.416 | \u5c06 Electron \u7248\u672c\u6620\u5c04\u5230 Chromium \u7248\u672c |\n| `node-releases` | 2.0.19 | 2.0.54 | \u63d0\u4f9b Node.js \u53d1\u5e03\u7248\u672c\u6570\u636e |\n| `update-browserslist-db` | 1.1.1 | 1.3.2 | \u66f4\u65b0 Browserslist \u6570\u636e\u5e93 |\n\n\u8fd9\u4e9b\u7248\u672c\u4f1a\u5f71\u54cd Browserslist \u5bf9\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\u7684\u8ba1\u7b97\u7ed3\u679c\u3002\u5373\u4f7f\u9879\u76ee\u7684 Browserslist \u67e5\u8be2\u914d\u7f6e\u4e0d\u53d8\uff0c\u66f4\u65b0\u540e\u7684\u5e02\u573a\u6570\u636e\u3001Node/Electron \u6620\u5c04\u6216\u67e5\u8be2\u4fee\u590d\u4e5f\u53ef\u80fd\u4f7f\u6784\u5efa\u5de5\u5177\u9009\u51fa\u7565\u6709\u4e0d\u540c\u7684\u76ee\u6807\u96c6\u5408\uff0c\u8fdb\u800c\u6539\u53d8\u8f6c\u8bd1\u6216\u524d\u7f00\u5904\u7406\u7ed3\u679c\u3002\n\n### 3. Baseline \u67e5\u8be2\u652f\u6301\n\n\u65b0\u4f9d\u8d56\u56fe\u65b0\u589e `baseline-browser-mapping` 2.11.20\uff0c\u5e76\u7531 `browserslist` \u901a\u8fc7 `^2.11.12` \u5f15\u7528\u3002\u8be5\u5305\u4e3a Baseline \u6d4f\u89c8\u5668\u67e5\u8be2\u63d0\u4f9b\u6620\u5c04\u6570\u636e\u548c\u547d\u4ee4\u884c\u5165\u53e3\uff1b\u9501\u6587\u4ef6\u540c\u65f6\u8bb0\u5f55\u4e86\u5176\u8bb8\u53ef\u8bc1\u3001Node \u5f15\u64ce\u8981\u6c42\u548c\u79c1\u6709\u6e90\u5236\u54c1\u4fe1\u606f\u3002\n\n\u6b64\u65b0\u589e\u4f9d\u8d56\u89e3\u91ca\u4e86\u4e3a\u4f55\u4e00\u6b21\u770b\u4f3c\u5355\u5305\u5347\u7ea7\u4f1a\u589e\u52a0\u65b0\u7684\u9501\u6587\u4ef6\u8282\u70b9\uff1a`browserslist` \u65b0\u7248\u672c\u628a Baseline \u76f8\u5173\u80fd\u529b\u62c6\u5206\u6216\u63a5\u5165\u4e86\u4e13\u95e8\u7684\u6570\u636e\u6620\u5c04\u5305\u3002\u5305\u5185\u53ef\u89c1\u53d1\u5e03\u8bf4\u660e\u8fd8\u63d0\u5230 Baseline \u67e5\u8be2\u7684\u5927\u5c0f\u5199\u5904\u7406\u548c KaiOS \u5305\u542b\u903b\u8f91\u4fee\u590d\uff0c\u56e0\u6b64\u4f7f\u7528\u76f8\u5173\u67e5\u8be2\u65f6\uff0c\u7ed3\u679c\u53ef\u80fd\u6bd4\u65e7\u7248\u672c\u66f4\u51c6\u786e\u3002\n\n### 4. \u9501\u6587\u4ef6\u53cc\u7ed3\u6784\u540c\u6b65\n\n\u8be5\u9501\u6587\u4ef6\u540c\u65f6\u5305\u542b `node_modules/...` \u5305\u8bb0\u5f55\u548c\u8f83\u65e7\u517c\u5bb9\u7ed3\u6784\u4e2d\u7684\u4f9d\u8d56\u8bb0\u5f55\u3002\u5dee\u5f02\u5728\u4e24\u4e2a\u533a\u57df\u91cd\u590d\u66f4\u65b0\u540c\u4e00\u7ec4\u7248\u672c\u4e0e\u4f9d\u8d56\u5173\u7cfb\uff0c\u8fd9\u662f npm \u9501\u6587\u4ef6\u683c\u5f0f\u7684\u6b63\u5e38\u540c\u6b65\uff0c\u800c\u4e0d\u662f\u5b89\u88c5\u4e24\u4efd\u76f8\u540c\u4f9d\u8d56\u3002\n\n\u6b64\u5916\uff0c`update-browserslist-db` \u5bf9 `picocolors` \u7684\u7248\u672c\u8303\u56f4\u7531 `^1.1.0` \u8c03\u6574\u4e3a `^1.1.1`\uff1b\u5f53\u524d\u5dee\u5f02\u6ca1\u6709\u663e\u793a `picocolors` \u7684\u5b9e\u9645\u9501\u5b9a\u7248\u672c\u53d1\u751f\u53d8\u5316\uff0c\u56e0\u6b64\u8fd9\u91cc\u662f\u4f9d\u8d56\u58f0\u660e\u8303\u56f4\u7684\u540c\u6b65\uff0c\u800c\u4e0d\u662f\u53ef\u786e\u8ba4\u7684\u5305\u7248\u672c\u5347\u7ea7\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6b63\u9762\u5f71\u54cd\n\n- \u901a\u8fc7\u9501\u5b9a `browserslist` 4.28.8\uff0c\u9488\u5bf9 PR \u63cf\u8ff0\u5217\u51fa\u7684\u4e24\u4e2a\u9ad8\u5371\u5b89\u5168\u544a\u8b66\u5b8c\u6210\u4f9d\u8d56\u4fa7\u5347\u7ea7\u3002\n- \u83b7\u5f97\u5305\u5185\u53d1\u5e03\u8bf4\u660e\u6240\u5217\u7684\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u3001\u65e0\u754c\u5185\u5b58\u589e\u957f\u7b49\u4fee\u590d\u3002\n- \u66f4\u65b0\u6d4f\u89c8\u5668\u3001Electron \u548c Node.js \u7248\u672c\u6570\u636e\uff0c\u964d\u4f4e\u56e0\u8fc7\u671f\u517c\u5bb9\u6027\u6570\u636e\u5e93\u5bfc\u81f4\u76ee\u6807\u5224\u65ad\u4e0d\u51c6\u786e\u7684\u6982\u7387\u3002\n- \u4fee\u590d\u591a\u79cd\u67e5\u8be2\u884c\u4e3a\uff0c\u5305\u62ec Electron \u7248\u672c\u67e5\u8be2\u3001`>`/`>=` \u67e5\u8be2\u3001Baseline \u5927\u5c0f\u5199\u548c KaiOS \u76f8\u5173\u903b\u8f91\u3002\n- \u4ecd\u4ece AzureNotebooks \u7684\u5185\u90e8 npm \u6e90\u89e3\u6790\u4f9d\u8d56\uff0c\u6ca1\u6709\u6539\u53d8\u5236\u54c1\u6765\u6e90\u6a21\u578b\u3002\n\n### \u884c\u4e3a\u5f71\u54cd\n\n\u6b64 PR \u4e0d\u76f4\u63a5\u6539\u52a8\u8fd0\u884c\u65f6\u4e1a\u52a1\u903b\u8f91\uff0c\u4f46\u53ef\u80fd\u95f4\u63a5\u6539\u53d8\u6784\u5efa\u4ea7\u7269\u3002\u4efb\u4f55\u8c03\u7528 Browserslist \u7684\u5de5\u5177\uff08\u4f8b\u5982\u8f6c\u8bd1\u5668\u3001Autoprefixer \u6216\u5176\u4ed6\u524d\u7aef\u6784\u5efa\u63d2\u4ef6\uff09\u90fd\u53ef\u80fd\u56e0\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\u53d8\u5316\u800c\u751f\u6210\u4e0d\u540c\u7684\u8bed\u6cd5\u8f6c\u6362\u6216 CSS \u524d\u7f00\u3002\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u8be5\u793a\u4f8b\u7684\u6784\u5efa\u914d\u7f6e\u548c\u4ea7\u7269\u5dee\u5f02\uff0c\u56e0\u6b64\u65e0\u6cd5\u786e\u8ba4\u5b9e\u9645\u4ea7\u7269\u662f\u5426\u53d1\u751f\u53d8\u5316\u3002\n\n### \u8303\u56f4\u5f71\u54cd\n\n\u53d8\u66f4\u5c40\u9650\u4e8e `sample/extension-sample` \u7684\u9501\u6587\u4ef6\uff0c\u672a\u663e\u793a\u4ed3\u5e93\u5176\u4ed6\u793a\u4f8b\u6216\u4ea7\u54c1\u76ee\u5f55\u7684\u4f9d\u8d56\u88ab\u66f4\u65b0\u3002\u82e5\u5176\u4ed6\u76ee\u5f55\u4e5f\u5404\u81ea\u7ef4\u62a4 `browserslist` \u9501\u5b9a\u7248\u672c\uff0c\u672c PR \u4e0d\u4f1a\u81ea\u52a8\u4fee\u590d\u90a3\u4e9b\u72ec\u7acb\u4f9d\u8d56\u6811\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669 | \u5177\u4f53\u539f\u56e0 | \u5efa\u8bae\u5173\u6ce8 |\n|---|---|---|\n| Node.js \u7248\u672c\u517c\u5bb9\u6027 | \u65b0\u9501\u5b9a\u7684 `node-releases` 2.0.54 \u58f0\u660e `node >=18`\uff0c\u65e7\u7248\u672c\u5728\u5dee\u5f02\u4e2d\u6ca1\u6709\u8be5\u5f15\u64ce\u8981\u6c42 | \u82e5\u8be5\u793a\u4f8b\u6216 CI \u4ecd\u4f7f\u7528 Node 16 \u6216\u66f4\u65e9\u7248\u672c\uff0cnpm \u53ef\u80fd\u4ea7\u751f `EBADENGINE` \u8b66\u544a\uff1b\u542f\u7528 `engine-strict` \u65f6\u53ef\u80fd\u5b89\u88c5\u5931\u8d25\u3002\u5e94\u4ee5 Node 18+ \u6267\u884c\u5b89\u88c5\u9a8c\u8bc1 |\n| \u6784\u5efa\u8f93\u51fa\u53d8\u5316 | `caniuse-lite`\u3001Electron/Node \u6620\u5c04\u548c\u67e5\u8be2\u5b9e\u73b0\u5747\u8de8\u591a\u4e2a\u7248\u672c\u66f4\u65b0 | \u6bd4\u8f83\u5347\u7ea7\u524d\u540e\u7684\u76ee\u6807\u6d4f\u89c8\u5668\u5217\u8868\u4e0e\u6784\u5efa\u4ea7\u7269\uff0c\u7279\u522b\u5173\u6ce8 polyfill\u3001\u8bed\u6cd5\u964d\u7ea7\u548c CSS \u524d\u7f00\u53d8\u5316 |\n| \u67e5\u8be2\u8bed\u4e49\u53d8\u5316 | \u65b0\u7248\u672c\u4fee\u590d `>`\u3001`>=`\u3001Electron\u3001Baseline \u7b49\u67e5\u8be2 | \u5982\u679c\u914d\u7f6e\u4f9d\u8d56\u65e7\u7248\u9519\u8bef\u884c\u4e3a\uff0c\u76ee\u6807\u96c6\u5408\u53ef\u80fd\u53d8\u5316\uff1b\u5e94\u8fd0\u884c\u9879\u76ee\u5b9e\u9645\u4f7f\u7528\u7684 Browserslist \u67e5\u8be2 |\n| \u65b0\u4f20\u9012\u4f9d\u8d56 | \u65b0\u589e `baseline-browser-mapping`\uff0c\u589e\u52a0\u4e00\u4e2a\u5b89\u88c5\u8282\u70b9\u548c CLI \u5165\u53e3 | \u786e\u8ba4\u5185\u90e8\u6e90\u53ef\u6301\u7eed\u63d0\u4f9b\u8be5\u5236\u54c1\uff0c\u8bb8\u53ef\u8bc1 Apache-2.0 \u7b26\u5408\u9879\u76ee\u8981\u6c42 |\n| \u9501\u6587\u4ef6\u4e0e\u6e05\u5355\u4e00\u81f4\u6027 | \u5305\u5185\u53ea\u663e\u793a\u9501\u6587\u4ef6\u53d8\u66f4\uff0c\u672a\u663e\u793a `package.json` | \u5e94\u786e\u8ba4\u9876\u5c42\u7248\u672c\u8303\u56f4\u5141\u8bb8\u5e76\u9884\u671f\u89e3\u6790\u5230 4.28.8\uff1b\u5426\u5219\u672a\u6765\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\u53ef\u80fd\u56de\u9000\u6216\u4ea7\u751f\u4e0d\u540c\u7ed3\u679c |\n| \u5b8c\u6574\u6027\u54c8\u5e0c\u5f62\u5f0f | \u65b0\u65e7\u76f8\u5173\u5236\u54c1\u5747\u663e\u793a SHA-1 \u5f62\u5f0f\u7684 `integrity` \u503c\uff0c\u4e14\u6765\u81ea\u5185\u90e8\u6e90 | \u8fd9\u770b\u8d77\u6765\u662f\u73b0\u6709\u6e90/\u9501\u6587\u4ef6\u6a21\u5f0f\u7684\u5ef6\u7eed\uff0c\u4f46\u5b89\u5168\u5ba1\u67e5\u53ef\u786e\u8ba4\u5185\u90e8\u6e90\u662f\u5426\u8fd8\u63d0\u4f9b\u66f4\u5f3a\u7684 SRI \u54c8\u5e0c |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u6d4b\u8bd5\u6587\u4ef6\u4fee\u6539\u3001\u81ea\u52a8\u5316\u6d4b\u8bd5\u7ed3\u679c\u3001\u6784\u5efa\u65e5\u5fd7\u6216\u7b56\u7565\u68c0\u67e5\u8be6\u60c5\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u6d4b\u8bd5\u5df2\u7ecf\u901a\u8fc7\u3002`mergeStatus: succeeded` \u4ec5\u8868\u660e\u5305\u4e2d\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u6210\u529f\uff0c\u4e0d\u80fd\u66ff\u4ee3\u6784\u5efa\u548c\u6d4b\u8bd5\u8bc1\u636e\u3002\n\n\u9488\u5bf9\u672c\u6b21\u53d8\u66f4\uff0c\u6700\u6709\u4ef7\u503c\u7684\u9a8c\u8bc1\u5305\u62ec\uff1a\n\n1. \u5728\u4ed3\u5e93\u652f\u6301\u7684 Node.js \u7248\u672c\u4e0a\u5bf9 `sample/extension-sample` \u6267\u884c\u5e72\u51c0\u7684\u9501\u6587\u4ef6\u5b89\u88c5\uff0c\u786e\u8ba4\u5185\u90e8 npm \u6e90\u53ef\u89e3\u6790\u6240\u6709\u65b0\u7248\u672c\uff1b\u5c24\u5176\u5e94\u8986\u76d6 Node 18+\uff0c\u5e76\u68c0\u67e5\u65e7\u7248 Node \u662f\u5426\u51fa\u73b0\u5f15\u64ce\u9519\u8bef\u3002\n2. \u8fd0\u884c\u8be5\u793a\u4f8b\u73b0\u6709\u7684\u6784\u5efa\u548c\u6d4b\u8bd5\u547d\u4ee4\uff0c\u786e\u8ba4\u4f7f\u7528\u65b0\u7248 Browserslist \u540e\u65e0\u914d\u7f6e\u89e3\u6790\u9519\u8bef\u3002\n3. \u8f93\u51fa\u5e76\u6bd4\u8f83\u9879\u76ee\u5b9e\u9645 Browserslist \u67e5\u8be2\u7684\u89e3\u6790\u7ed3\u679c\uff0c\u786e\u8ba4\u76ee\u6807\u6d4f\u89c8\u5668\u53d8\u5316\u7b26\u5408\u9884\u671f\u3002\n4. \u82e5\u8be5\u793a\u4f8b\u751f\u6210\u524d\u7aef\u5305\uff0c\u6bd4\u8f83\u5173\u952e\u6784\u5efa\u4ea7\u7269\uff0c\u68c0\u67e5\u8f6c\u8bd1\u7ea7\u522b\u3001CSS \u524d\u7f00\u548c\u5305\u4f53\u79ef\u662f\u5426\u51fa\u73b0\u975e\u9884\u671f\u53d8\u5316\u3002\n5. \u5728\u7ec4\u4ef6\u6cbb\u7406\u626b\u63cf\u4e2d\u786e\u8ba4 CVE-2026-73088 \u548c CVE-2026-73089 \u544a\u8b66\u5747\u5df2\u6d88\u9664\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\n\n- \u5206\u6790\u5305\u58f0\u660e\u5171\u6709 1 \u4e2a\u53d8\u66f4\u6587\u4ef6\uff0c\u4e14\u63d0\u4f9b\u4e86\u8be5\u6587\u4ef6\u7684\u5dee\u5f02\uff1b\u6587\u4ef6\u7ea7 `truncated` \u548c\u5168\u5c40 `diffTruncated` \u5747\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u4e2d\u5217\u51fa\u7684 **1/1 \u4e2a\u6587\u4ef6\u5dee\u5f02**\uff0c\u6ca1\u6709\u5df2\u77e5\u7684\u622a\u65ad\u5dee\u5f02\u7f3a\u53e3\u3002\n- \u5dee\u5f02\u7531 `git-local` \u65b9\u6cd5\u751f\u6210\uff0c\u603b\u8ba1 9,598 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5305\u8bb0\u5f55\u7684\u5355\u6587\u4ef6\u548c\u603b\u4f53\u622a\u65ad\u4e0a\u9650\u3002\n- PR \u63cf\u8ff0\u4e2d\u7684\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u6587\u672c\u5728\u53ef\u89c1\u5185\u5bb9\u672b\u5c3e\u4ee5\u7701\u7565\u5f62\u5f0f\u4e2d\u65ad\uff0c\u56e0\u6b64\u672c\u6587\u53ea\u91c7\u7528\u5305\u5185\u660e\u786e\u53ef\u89c1\u7684\u53d1\u5e03\u8bf4\u660e\u6761\u76ee\uff0c\u6ca1\u6709\u63a8\u65ad\u672a\u63d0\u4f9b\u7684\u540e\u7eed\u7248\u672c\u8bf4\u660e\u3002\n- \u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u5b9e\u9645\u6e90\u7801\u3001`package.json` \u5185\u5bb9\u3001\u6784\u5efa\u914d\u7f6e\u3001\u6d4b\u8bd5\u7ed3\u679c\u6216\u5b8c\u6574\u7b56\u7565\u72b6\u6001\uff1b\u4e0e\u8fd9\u4e9b\u5185\u5bb9\u6709\u5173\u7684\u7ed3\u8bba\u5747\u9650\u5b9a\u4e3a\u98ce\u9669\u6216\u5efa\u8bae\uff0c\u800c\u975e\u5df2\u9a8c\u8bc1\u4e8b\u5b9e\u3002\n", "creation_timestamp": "2026-09-05T16:13:11.785872Z"} 2026-09-05T16:13:11.785872+00:00