{"vulnerability": "cve-2026-1367", "sightings": [{"uuid": "90eabea6-3c19-4d17-b265-79fe2e9b9a27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1367", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mfjkwrkbhp2h", "content": "", "creation_timestamp": "2026-02-23T11:39:33.230879Z"}, {"uuid": "9b418288-cc3e-47de-97e6-e4389509bf36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1367", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfj7u65vlr2x", "content": "", "creation_timestamp": "2026-02-23T08:21:15.279616Z"}, {"uuid": "ecf9f0ec-ba9c-4c5d-9515-03419b17f93d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1367", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mfj7u77mar2v", "content": "", "creation_timestamp": "2026-02-23T08:21:16.000053Z"}, {"uuid": "7dcee20b-bb0e-4772-af41-e7cdaa73e363", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13676", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mpgm2jo5sk2k", "content": "\ud83d\udea8 High-severity security fix in fast-uri 3.1.3 and 4.0.1 just released!\n\nPatches CVE-2026-13676. fast-uri vulnerable to host confusion via failed IDN canonicalization.\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-06-29T13:33:30.292642Z"}, {"uuid": "1d57e058-9d55-4bb5-b73a-32c0f684bd5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13676", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpguk3mdpl2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-13676 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 fast-uri: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/8EF0E361-300A-4DEC-8690-B6EDFEC2908D", "creation_timestamp": "2026-06-29T16:05:22.265017Z"}, {"uuid": "032d2526-2765-4b6d-995e-64f75164ff06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13676", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcltx2ull2c", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-13676 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 fast-uri: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/877B7D88-5CF3-4E76-BD51-B3B98FE47EA0", "creation_timestamp": "2026-07-10T16:44:21.902751Z"}, {"uuid": "9342591a-4f80-4431-aaa3-03b8e1bc3620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13676", "type": "seen", "source": "https://gist.github.com/djlan/7d5224724e2c83bdaf53ab4fffe9a376", "content": "# [SECURITY][SFI] \u4fee\u590d fast-uri \u6f0f\u6d1e\uff08CVE-2026-13676\uff09\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u5728 9 \u4e2a npm \u9879\u76ee\u4e2d\u901a\u8fc7 `overrides` \u5c06\u4f20\u9012\u4f9d\u8d56 `fast-uri` \u7cbe\u786e\u56fa\u5b9a\u5230 `3.1.4`\uff0c\u5e76\u91cd\u751f\u6210\u5bf9\u5e94\u9501\u6587\u4ef6\uff0c\u4ee5\u6d88\u9664\u4ecd\u89e3\u6790\u5230 `3.1.2` \u7684\u5b89\u88c5\u7ed3\u679c\uff1b\u5b83\u4fee\u590d\u4e86\u4e24\u4e2a\u5df2\u77e5\u9ad8\u5371\u544a\u8b66\uff0c\u4f46\u5305\u4e2d\u660e\u786e\u8bf4\u660e\u53e6\u4e00\u4e2a\u9700\u8981 `3.1.5` \u6216 `4.1.2` \u7684\u544a\u8b66\u4ecd\u672a\u89e3\u51b3\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 766458](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458) |\n| \u4f5c\u8005 | Agency |\n| \u72b6\u6001 | Active\uff0c\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `copilot/api-690bd71d-61a9e58c` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-05 09:50:21 |\n| \u63d0\u4ea4 | 1 \u4e2a |\n| \u8fed\u4ee3 | 2 \u6b21 |\n| \u6587\u4ef6 | 18 \u4e2a\u6587\u4ef6\uff0c\u5747\u4e3a\u4fee\u6539\uff1b9 \u4e2a `package.json` \u4e0e 9 \u4e2a `package-lock.json` |\n| \u53ef\u89c1\u5dee\u5f02\u7edf\u8ba1 | \u5206\u6790\u5305\u5185\u53ef\u89c1\u81f3\u5c11\u65b0\u589e 332 \u884c\u3001\u5220\u9664 530 \u884c\uff1b\u603b\u5dee\u5f02 124,728 \u5b57\u8282 |\n| \u8986\u76d6\u9650\u5236 | \u603b\u5dee\u5f02\u88ab\u6807\u8bb0\u4e3a\u622a\u65ad\uff1b\u4ec5 `sample/angular-host-app/package-lock.json` \u8fbe\u5230 65,536 \u5b57\u8282\u5355\u6587\u4ef6\u4e0a\u9650\uff0c\u5176\u4f59 17 \u4e2a\u6587\u4ef6\u7684\u5dee\u5f02\u5b8c\u6574 |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u5de5\u4f5c\u539f\u7406](#\u5de5\u4f5c\u539f\u7406)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [\u793a\u4f8b\u5bbf\u4e3b\u4e0e\u6e32\u67d3\u5668](#\u793a\u4f8b\u5bbf\u4e3b\u4e0e\u6e32\u67d3\u5668)\n  - [\u6269\u5c55\u793a\u4f8b](#\u6269\u5c55\u793a\u4f8b)\n  - [\u901a\u7528\u6269\u5c55](#\u901a\u7528\u6269\u5c55)\n  - [\u670d\u52a1\u7aef\u7ec8\u7aef\u6269\u5c55](#\u670d\u52a1\u7aef\u7ec8\u7aef\u6269\u5c55)\n  - [\u4e3b\u5ba2\u6237\u7aef](#\u4e3b\u5ba2\u6237\u7aef)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027)\n- [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n- [\u622a\u65ad\u5dee\u5f02\u8986\u76d6\u8bf4\u660e](#\u622a\u65ad\u5dee\u5f02\u8986\u76d6\u8bf4\u660e)\n\n## \u53d8\u66f4\u6982\u89c8\n\n`fast-uri` \u5e76\u4e0d\u662f\u8fd9\u4e9b\u9879\u76ee\u76f4\u63a5\u58f0\u660e\u7684\u5e38\u89c4\u4e1a\u52a1\u4f9d\u8d56\uff0c\u800c\u662f\u7531\u4f9d\u8d56\u94fe\u4e2d\u7684 `ajv` \u95f4\u63a5\u5f15\u5165\u3002\u4ec5\u66f4\u65b0\u4e0a\u5c42\u4f9d\u8d56\u7684\u5bbd\u677e\u7248\u672c\u8303\u56f4\uff0c\u65e0\u6cd5\u4fdd\u8bc1\u6240\u6709\u72ec\u7acb npm \u9879\u76ee\u90fd\u89e3\u6790\u5230\u5df2\u4fee\u590d\u7248\u672c\uff0c\u56e0\u6b64\u672c PR \u5728\u6bcf\u4e2a\u9879\u76ee\u7684\u6839 `package.json` \u4e2d\u4f7f\u7528 npm `overrides`\uff0c\u5f3a\u5236\u6574\u68f5\u4f9d\u8d56\u6811\u91c7\u7528\u7cbe\u786e\u7248\u672c `3.1.4`\u3002\n\n\u5bf9\u5e94\u7684 `package-lock.json` \u968f\u540e\u88ab\u91cd\u751f\u6210\u6216\u6821\u51c6\uff1a\u53ef\u89c1\u5dee\u5f02\u5c06 `fast-uri` \u7684\u7248\u672c\u3001\u79c1\u6709 Azure Artifacts \u6e90\u5730\u5740\u548c\u5b8c\u6574\u6027\u6458\u8981\u4ece `3.1.2` \u66f4\u65b0\u4e3a `3.1.4`\uff1b\u90e8\u5206\u9501\u6587\u4ef6\u8fd8\u628a\u4f9d\u8d56\u8282\u70b9\u5185\u539f\u6765\u7684 `^3.0.1` \u89e3\u6790\u7ed3\u679c\u6536\u7d27\u4e3a `3.1.4`\u3002\u8fd9\u6837\uff0c\u65e0\u8bba `fast-uri` \u4f4d\u4e8e\u4f9d\u8d56\u6811\u7684\u54ea\u4e2a\u5c42\u7ea7\uff0c\u53d7\u9501\u6587\u4ef6\u7ea6\u675f\u7684\u5b89\u88c5\u90fd\u5e94\u89e3\u6790\u5230\u540c\u4e00\u4fee\u590d\u7248\u672c\u3002\n\nPR \u63cf\u8ff0\u7ed9\u51fa\u7684\u5b89\u5168\u7ed3\u8bba\u662f\uff1a\n\n- CVE-2026-13676\uff1a\u7531 `3.1.4` \u4fee\u590d\u3002\n- CVE-2026-16221\uff1a\u7531 `3.1.4` \u4fee\u590d\u3002\n- CVE-2026-18446\uff1a\u4ecd\u672a\u4fee\u590d\uff1b\u9700\u8981 `3.1.5` \u6216 `4.1.2`\uff0c\u4f46\u751f\u6210 PR \u65f6 AzureNotebooksEntry \u79c1\u6709\u6e90\u5c1a\u672a\u63d0\u4f9b\u8fd9\u4e9b\u7248\u672c\u3002\n\n## \u5de5\u4f5c\u539f\u7406\n\n1. **\u6839\u7ea7\u8986\u76d6\u4f20\u9012\u4f9d\u8d56\uff1a** `overrides.fast-uri = \"3.1.4\"` \u8986\u76d6\u4e0a\u6e38\u5305\u58f0\u660e\u7684\u517c\u5bb9\u8303\u56f4\uff0c\u907f\u514d npm \u518d\u9009\u62e9\u5b58\u5728\u544a\u8b66\u7684 `3.1.2`\u3002\n2. **\u4f7f\u7528\u7cbe\u786e\u7248\u672c\u800c\u975e\u8303\u56f4\uff1a** \u7cbe\u786e\u503c\u907f\u514d\u672a\u6765\u5b89\u88c5\u5728\u672a\u5ba1\u67e5\u7684\u60c5\u51b5\u4e0b\u81ea\u52a8\u6f02\u79fb\u5230\u5176\u4ed6 `3.x` \u7248\u672c\uff0c\u4e5f\u4f7f 9 \u4e2a\u9879\u76ee\u7684\u89e3\u6790\u7ed3\u679c\u4fdd\u6301\u4e00\u81f4\u3002\n3. **\u540c\u6b65\u9501\u6587\u4ef6\uff1a** \u9501\u6587\u4ef6\u8bb0\u5f55 `3.1.4` \u7684\u5b9e\u9645 tarball URL \u4e0e integrity \u503c\uff0c\u4f7f CI \u548c\u4f7f\u7528\u9501\u6587\u4ef6\u7684\u672c\u5730\u5b89\u88c5\u53ef\u590d\u73b0\u3002\n4. **\u4fdd\u6301\u4e3b\u7248\u672c\u517c\u5bb9\uff1a** \u53d8\u66f4\u505c\u7559\u5728 `3.x`\uff0c\u6ca1\u6709\u5207\u6362\u5230 `4.x`\uff0c\u4ece\u800c\u964d\u4f4e\u4f20\u9012\u4f9d\u8d56\u53d1\u751f\u4e3b\u7248\u672c\u4e0d\u517c\u5bb9\u7684\u6982\u7387\uff1b\u4f46\u8fd9\u4e5f\u610f\u5473\u7740\u65e0\u6cd5\u987a\u5e26\u89e3\u51b3\u5fc5\u987b\u5347\u7ea7\u5230\u66f4\u9ad8\u4fee\u590d\u7248\u672c\u7684 CVE-2026-18446\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### \u793a\u4f8b\u5bbf\u4e3b\u4e0e\u6e32\u67d3\u5668\n\n\u6d89\u53ca\uff1a\n\n- [`sample/angular-host-app/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/angular-host-app/package.json&_a=files)\n- [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/angular-host-app/package-lock.json&_a=files)\n- [`sample/aznb-custom-renderer-sample/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/aznb-custom-renderer-sample/package.json&_a=files)\n- [`sample/aznb-custom-renderer-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/aznb-custom-renderer-sample/package-lock.json&_a=files)\n\n\u4e24\u4e2a\u793a\u4f8b\u5e94\u7528\u90fd\u5728\u5df2\u6709 `overrides` \u5bf9\u8c61\u4e2d\u52a0\u5165 `fast-uri: 3.1.4`\u3002\u9501\u6587\u4ef6\u628a\u53ef\u89c1\u7684 `fast-uri` \u5b9e\u4f8b\u4ece `3.1.2` \u66ff\u6362\u4e3a `3.1.4`\uff1b\u81ea\u5b9a\u4e49\u6e32\u67d3\u5668\u6837\u4f8b\u4e2d\u8fd8\u53ef\u89c1\u5d4c\u5957\u4f9d\u8d56\u7ea6\u675f\u7531 `^3.0.1` \u56fa\u5b9a\u4e3a `3.1.4`\u3002\n\nAngular \u5bbf\u4e3b\u7684\u9501\u6587\u4ef6\u6709\u8f83\u5927\u91cd\u751f\u6210\u5dee\u5f02\uff0c\u53ef\u89c1\u90e8\u5206\u9664 `fast-uri` \u5347\u7ea7\u5916\u8fd8\u5220\u9664\u4e86 `@emnapi/core`\u3001`@emnapi/runtime` \u548c `@emnapi/wasi-threads` \u8282\u70b9\u3002\u4e0d\u8fc7\u8be5\u6587\u4ef6\u5dee\u5f02\u88ab\u622a\u65ad\uff0c\u4e0d\u80fd\u636e\u6b64\u65ad\u8a00\u8fd9\u662f\u5176\u5168\u90e8\u9644\u5e26\u53d8\u5316\uff0c\u4e5f\u65e0\u6cd5\u4ece\u5305\u4e2d\u786e\u8ba4\u8fd9\u4e9b\u8282\u70b9\u4e3a\u4f55\u88ab\u6e05\u7406\u3002\n\n### \u6269\u5c55\u793a\u4f8b\n\n\u6d89\u53ca\uff1a\n\n- [`sample/extension-sample/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extension-sample/package.json&_a=files)\n- [`sample/extension-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extension-sample/package-lock.json&_a=files)\n\n\u8be5\u9879\u76ee\u6b64\u524d\u6ca1\u6709\u6839\u7ea7 `overrides`\uff0c\u672c PR \u65b0\u5efa\u8be5\u914d\u7f6e\u5e76\u56fa\u5b9a `fast-uri@3.1.4`\u3002\u9501\u6587\u4ef6\u5b8c\u6210\u76ee\u6807\u7248\u672c\u66ff\u6362\uff0c\u540c\u65f6\u5220\u9664\u4e86\u53ef\u89c1\u7684 `builtins`\u3001`eslint-plugin-n` \u53ca\u5176\u5d4c\u5957 `eslint-plugin-es`\u3001`eslint-utils`\u3001`eslint-visitor-keys` \u8282\u70b9\u3002\u8fd9\u4e9b\u5220\u9664\u770b\u8d77\u6765\u5c5e\u4e8e\u91cd\u65b0\u89e3\u6790\u6216\u6e05\u7406\u9501\u6587\u4ef6\u7684\u526f\u4f5c\u7528\uff0c\u800c\u4e0d\u662f\u6f0f\u6d1e\u4fee\u590d\u672c\u8eab\uff1b\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u5b89\u88c5\u547d\u4ee4\u6216\u4f9d\u8d56\u6811\u8f93\u51fa\uff0c\u65e0\u6cd5\u8fdb\u4e00\u6b65\u786e\u8ba4\u5b83\u4eec\u662f\u5426\u5747\u4e3a\u4e0d\u53ef\u8fbe\u8282\u70b9\u3002\n\n### \u901a\u7528\u6269\u5c55\n\n\u6d89\u53ca\u56db\u4e2a\u72ec\u7acb\u6269\u5c55\uff1a\n\n- NotebookGrader\uff1a[`package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/common-extensions/NotebookGrader/package.json&_a=files)\u3001[`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/common-extensions/NotebookGrader/package-lock.json&_a=files)\n- PowerQueryCellTest\uff1a[`package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/common-extensions/PowerQueryCellTest/package.json&_a=files)\u3001[`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/common-extensions/PowerQueryCellTest/package-lock.json&_a=files)\n- ReactViewTest\uff1a[`package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/common-extensions/ReactViewTest/package.json&_a=files)\u3001[`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/common-extensions/ReactViewTest/package-lock.json&_a=files)\n- SystemMonitor\uff1a[`package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/common-extensions/SystemMonitor/package.json&_a=files)\u3001[`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/common-extensions/SystemMonitor/package-lock.json&_a=files)\n\nNotebookGrader\u3001PowerQueryCellTest \u548c SystemMonitor \u65b0\u589e\u6839\u7ea7 `overrides`\uff1bReactViewTest \u5728\u5df2\u6709\u8986\u76d6\u914d\u7f6e\u4e2d\u8ffd\u52a0 `fast-uri`\u3002\u56db\u4e2a\u9501\u6587\u4ef6\u5747\u5c06\u76ee\u6807\u5305\u5347\u7ea7\u5230 `3.1.4`\u3002PowerQueryCellTest \u4e0e ReactViewTest \u7684\u5b8c\u6574\u5dee\u5f02\u8fd8\u663e\u793a\uff0c\u9501\u6587\u4ef6\u5185\u591a\u4e2a\u5d4c\u5957\u4f4d\u7f6e\u7684 `fast-uri` \u7ea6\u675f\u88ab\u7edf\u4e00\u56fa\u5b9a\uff0c\u907f\u514d\u540c\u4e00\u9879\u76ee\u51fa\u73b0\u591a\u4e2a\u89e3\u6790\u7248\u672c\u3002\n\nSystemMonitor \u7684\u5b8c\u6574\u5dee\u5f02\u8fd8\u5220\u9664\u4e86 `crypto`\u3001`react-dom@17.0.2` \u548c `scheduler@0.20.2` \u9501\u8282\u70b9\uff0c\u5e76\u6709\u82e5\u5e72\u4ec5\u6d89\u53ca\u7a7a `requires` \u6216 JSON \u9017\u53f7\u7684\u89c4\u8303\u5316\u53d8\u5316\u3002\u8fd9\u6269\u5927\u4e86\u9a8c\u8bc1\u8303\u56f4\uff1a\u5373\u4f7f\u6e90\u7801\u672a\u6539\uff0c\u4e5f\u5e94\u786e\u8ba4\u91cd\u65b0\u5b89\u88c5\u540e\u8be5\u6269\u5c55\u7684\u6784\u5efa\u548c\u8fd0\u884c\u4f9d\u8d56\u4ecd\u5b8c\u6574\u3002\n\n### \u670d\u52a1\u7aef\u7ec8\u7aef\u6269\u5c55\n\n\u6d89\u53ca\uff1a\n\n- [`sample/extensions/server-extensions/Terminal/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/server-extensions/Terminal/package.json&_a=files)\n- [`sample/extensions/server-extensions/Terminal/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/extensions/server-extensions/Terminal/package-lock.json&_a=files)\n\nTerminal \u65b0\u589e\u6839\u7ea7\u8986\u76d6\uff0c\u5e76\u5728\u9501\u6587\u4ef6\u7684\u591a\u4e2a\u4f9d\u8d56\u4f4d\u7f6e\u7edf\u4e00\u4f7f\u7528 `fast-uri@3.1.4`\u3002\u5176\u4f59\u53ef\u89c1\u53d8\u5316\u4e3b\u8981\u662f npm \u91cd\u5199\u7a7a `requires` \u548c JSON \u5206\u9694\u7b26\uff0c\u6ca1\u6709\u770b\u5230\u4e1a\u52a1\u4ee3\u7801\u3001\u7ec8\u7aef\u534f\u8bae\u6216\u670d\u52a1\u7aef\u903b\u8f91\u4fee\u6539\u3002\n\n### \u4e3b\u5ba2\u6237\u7aef\n\n\u6d89\u53ca\uff1a\n\n- [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/src/client/package.json&_a=files)\n- [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/src/client/package-lock.json&_a=files)\n\n\u4e3b\u5ba2\u6237\u7aef\u539f\u672c\u5df2\u6709 `fast-uri` \u8986\u76d6\uff0c\u4f46\u503c\u4e3a `^3.1.2`\u3002\u672c PR \u5c06\u5176\u6539\u4e3a\u7cbe\u786e\u7684 `3.1.4`\uff0c\u6d88\u9664\u8303\u56f4\u89e3\u6790\u7684\u4e0d\u786e\u5b9a\u6027\uff1b\u9501\u6587\u4ef6\u540c\u6b65\u66ff\u6362\u7248\u672c\u3001\u4e0b\u8f7d\u5730\u5740\u548c integrity\u3002\u8fd9\u91cc\u6ca1\u6709\u65b0\u589e\u8986\u76d6\u673a\u5236\uff0c\u53ea\u662f\u628a\u73b0\u6709\u7b56\u7565\u6536\u7d27\u5e76\u63a8\u8fdb\u5230\u4fee\u590d\u7248\u672c\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6b63\u5411\u5f71\u54cd\n\n- 9 \u4e2a\u72ec\u7acb npm \u5b89\u88c5\u8fb9\u754c\u91c7\u7528\u4e00\u81f4\u7684\u5b89\u5168\u7248\u672c\u7b56\u7565\uff0c\u907f\u514d\u53ea\u4fee\u590d\u4e3b\u5ba2\u6237\u7aef\u800c\u9057\u6f0f\u6837\u4f8b\u6216\u6269\u5c55\u9879\u76ee\u3002\n- \u9501\u6587\u4ef6\u4e0d\u518d\u6307\u5411\u5305\u5185\u53ef\u89c1\u7684 `fast-uri-3.1.2.tgz`\uff0c\u63d0\u5347 CI \u4e0e\u5f00\u53d1\u673a\u5b89\u88c5\u7ed3\u679c\u7684\u4e00\u81f4\u6027\u3002\n- \u4fdd\u6301\u5728 `fast-uri` 3.x \u4e3b\u7248\u672c\uff0c\u9884\u671f\u6bd4\u76f4\u63a5\u5347\u7ea7 4.x \u66f4\u5c11\u5f15\u5165 API \u6216\u884c\u4e3a\u4e0d\u517c\u5bb9\u3002\n- \u4e0d\u6d89\u53ca TypeScript/JavaScript \u4e1a\u52a1\u6e90\u7801\u3001\u516c\u5171 API\u3001\u914d\u7f6e\u534f\u8bae\u6216 UI \u884c\u4e3a\u7684\u76f4\u63a5\u4fee\u6539\u3002\n\n### \u53ef\u80fd\u53d7\u5f71\u54cd\u7684\u6d41\u7a0b\n\n- \u6240\u6709\u5bf9\u4e0a\u8ff0 9 \u4e2a\u76ee\u5f55\u6267\u884c `npm install` \u6216 `npm ci` \u7684\u672c\u5730\u5f00\u53d1\u3001\u793a\u4f8b\u6784\u5efa\u548c CI \u6d41\u7a0b\u3002\n- \u4f9d\u8d56\u79c1\u6709 `AzureNotebooksEntry` npm \u6e90\u4e0b\u8f7d tarball \u7684\u73af\u5883\u3002\n- \u4f7f\u7528\u8f83\u65e7 npm \u5ba2\u6237\u7aef\u7684\u73af\u5883\uff1a\u5982\u679c\u5ba2\u6237\u7aef\u4e0d\u652f\u6301 `overrides`\uff0c\u5b83\u53ef\u80fd\u65e0\u6cd5\u6309\u6e05\u5355\u5f3a\u5236\u6267\u884c\u8986\u76d6\uff1b\u4f7f\u7528\u9501\u6587\u4ef6\u7684\u5b89\u88c5\u662f\u5426\u6210\u529f\u4ecd\u9700\u7531\u5b9e\u9645 CI \u5de5\u5177\u94fe\u786e\u8ba4\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\n\n| \u98ce\u9669 | \u5177\u4f53\u8868\u73b0 | \u5efa\u8bae |\n|---|---|---|\n| \u5269\u4f59\u5b89\u5168\u544a\u8b66 | PR \u63cf\u8ff0\u660e\u786e\u6307\u51fa CVE-2026-18446 \u9700\u8981 `3.1.5` \u6216 `4.1.2`\uff0c\u5f53\u524d `3.1.4` \u4e0d\u80fd\u4fee\u590d | \u79c1\u6709\u6e90\u955c\u50cf\u53ef\u7528\u540e\u7acb\u5373\u5347\u7ea7\u5e76\u91cd\u65b0\u8dd1 Component Governance |\n| \u672a\u6267\u884c\u6784\u5efa\u4e0e\u6d4b\u8bd5 | \u5305\u4e2d\u8bb0\u5f55\u56e0\u79c1\u6709 feed \u8ba4\u8bc1\u9650\u5236\uff0c\u6784\u5efa\u548c\u6d4b\u8bd5\u672a\u8fd0\u884c | \u5408\u5e76\u524d\u7531\u5177\u5907\u6e90\u6743\u9650\u7684 CI \u5bf9 9 \u4e2a\u9879\u76ee\u6267\u884c\u9501\u6587\u4ef6\u5b89\u88c5\u53ca\u73b0\u6709\u6784\u5efa/\u6d4b\u8bd5 |\n| \u9501\u6587\u4ef6\u9644\u5e26\u6e05\u7406 | extension-sample\u3001SystemMonitor \u4ee5\u53ca\u622a\u65ad\u7684 angular-host-app \u9501\u6587\u4ef6\u5305\u542b\u975e `fast-uri` \u8282\u70b9\u5220\u9664 | \u5ba1\u67e5\u4f9d\u8d56\u6811\u5dee\u5f02\uff0c\u91cd\u70b9\u9a8c\u8bc1\u8fd9\u4e9b\u9879\u76ee\u662f\u5426\u4ecd\u80fd\u5e72\u51c0\u5b89\u88c5\u3001\u6784\u5efa\u548c\u542f\u52a8 |\n| npm \u5ba2\u6237\u7aef\u517c\u5bb9\u6027 | \u65b0\u589e\u7684 `overrides` \u4f9d\u8d56 npm \u5bf9\u8be5\u5b57\u6bb5\u7684\u652f\u6301 | \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 npm \u7248\u672c\u9a8c\u8bc1\uff1b\u907f\u514d\u65e7\u5ba2\u6237\u7aef\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6 |\n| \u7cbe\u786e\u56fa\u5b9a\u7684\u7ef4\u62a4\u6210\u672c | \u7cbe\u786e\u7248\u672c\u4e0d\u4f1a\u81ea\u52a8\u83b7\u53d6\u540e\u7eed 3.x \u5b89\u5168\u8865\u4e01 | \u5c06\u540e\u7eed\u5b89\u5168\u7248\u672c\u5347\u7ea7\u4f5c\u4e3a\u663e\u5f0f\u3001\u53d7\u5ba1\u67e5\u7684\u4f9d\u8d56\u66f4\u65b0 |\n| \u79c1\u6709\u6e90\u53ef\u7528\u6027 | \u9501\u6587\u4ef6\u6307\u5411 Azure DevOps \u79c1\u6709 npm \u6e90\uff0c\u79bb\u7ebf\u6216\u65e0\u6743\u9650\u73af\u5883\u65e0\u6cd5\u9a8c\u8bc1\u5b89\u88c5 | \u5728\u6709\u8ba4\u8bc1\u7684\u5b98\u65b9 CI \u4e2d\u5b8c\u6210\u6700\u7ec8\u9a8c\u8bc1 |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u6ca1\u6709\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\uff0c\u4e5f\u6ca1\u6709\u63d0\u4f9b\u6210\u529f\u7684\u6784\u5efa\u3001\u5355\u5143\u6d4b\u8bd5\u3001\u96c6\u6210\u6d4b\u8bd5\u6216 `npm ci` \u7ed3\u679c\u3002PR \u63cf\u8ff0\u4e2d\u7684\u9a8c\u8bc1\u72b6\u6001\u4e3a\uff1a\n\n- \u8bed\u4e49\u68c0\u67e5\uff1a\u901a\u8fc7\uff0c\u786e\u8ba4\u4f7f\u7528\u7cbe\u786e\u8986\u76d6\u4e14\u6ca1\u6709\u964d\u7ea7\u3002\n- \u5b89\u5168\u544a\u8b66\u68c0\u67e5\uff1a\u8b66\u544a\uff0c\u4e24\u4e2a\u544a\u8b66\u7531 `3.1.4` \u89e3\u51b3\uff0cCVE-2026-18446 \u4ecd\u5f00\u653e\u3002\n- \u6784\u5efa\u4e0e\u6d4b\u8bd5\uff1a\u56e0\u79c1\u6709 feed \u8ba4\u8bc1\u8981\u6c42\u800c\u672a\u8fd0\u884c\u3002\n- Component Detection\uff1a\u73af\u5883\u4e2d\u6ca1\u6709\u76f8\u5e94 CLI\uff0c\u56e0\u6b64\u8df3\u8fc7\u3002\n\n\u56e0\u6b64\uff0c\u5f53\u524d\u5305\u53ea\u80fd\u652f\u6301\u201c\u6e05\u5355\u4e0e\u9501\u6587\u4ef6\u7684\u76ee\u6807\u7248\u672c\u4fee\u6539\u5728\u53ef\u89c1\u5dee\u5f02\u4e2d\u4e00\u81f4\u201d\u8fd9\u4e00\u7ed3\u8bba\uff0c\u4e0d\u80fd\u652f\u6301\u201c\u9879\u76ee\u5df2\u6210\u529f\u6784\u5efa\u6216\u6d4b\u8bd5\u901a\u8fc7\u201d\u7684\u7ed3\u8bba\u3002\u5efa\u8bae\u6700\u4f4e\u9a8c\u8bc1\u96c6\u5305\u62ec\uff1a\u5728\u6bcf\u4e2a\u9879\u76ee\u6267\u884c\u53d7\u652f\u6301\u7684\u9501\u6587\u4ef6\u5b89\u88c5\u3001\u786e\u8ba4\u4f9d\u8d56\u6811\u4e2d\u4e0d\u5b58\u5728 `fast-uri@3.1.2`\u3001\u8fd0\u884c\u5404\u9879\u76ee\u5df2\u6709\u6784\u5efa\u4e0e\u6d4b\u8bd5\uff0c\u5e76\u91cd\u65b0\u626b\u63cf\u4e09\u4e2a\u5173\u8054\u5b89\u5168\u544a\u8b66\u3002\n\n## \u622a\u65ad\u5dee\u5f02\u8986\u76d6\u8bf4\u660e\n\n\u5206\u6790\u5305\u58f0\u660e\u5168\u5c40 `diffTruncated: true`\uff0c\u539f\u56e0\u662f [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766458?path=/sample/angular-host-app/package-lock.json&_a=files) \u7684\u5dee\u5f02\u8fbe\u5230 65,536 \u5b57\u8282\u5355\u6587\u4ef6\u4e0a\u9650\u3002\u8be5\u6587\u4ef6\u53ef\u89c1\u90e8\u5206\u8db3\u4ee5\u786e\u8ba4 `fast-uri` \u4ece `3.1.2` \u66f4\u65b0\u5230 `3.1.4`\uff0c\u5e76\u770b\u5230\u90e8\u5206\u989d\u5916\u8282\u70b9\u5220\u9664\uff0c\u4f46\u4e0d\u8db3\u4ee5\u5b8c\u6574\u679a\u4e3e\u6216\u8bc4\u4ef7\u8be5\u9501\u6587\u4ef6\u7684\u6240\u6709\u53d8\u5316\u3002\n\n\u5176\u4f59 17 \u4e2a\u6587\u4ef6\u5728\u5305\u4e2d\u5747\u6807\u8bb0\u4e3a\u672a\u622a\u65ad\u3002\u672c\u6587\u6ca1\u6709\u63a8\u65ad\u622a\u65ad\u90e8\u5206\u7684\u5185\u5bb9\uff0c\u4e5f\u6ca1\u6709\u58f0\u79f0\u5df2\u5206\u6790\u5305\u4e2d\u4e0d\u5b58\u5728\u7684\u6d41\u6c34\u7ebf\u65e5\u5fd7\u3001\u5b8c\u6574\u4f9d\u8d56\u6811\u3001\u6d4b\u8bd5\u7ed3\u679c\u6216 Component Governance \u626b\u63cf\u8f93\u51fa\u3002\n", "creation_timestamp": "2026-08-31T16:08:03.309504Z"}]}