{"vulnerability": "cve-2026-7308", "sightings": [{"uuid": "4369a767-a85c-484b-8218-1c57888326d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7308", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mllz5cozyv2i", "content": "CVE-2026-7308 - Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page\nCVE ID : CVE-2026-7308\n \n Published : May 11, 2026, 6:16 p.m. | 14\u00a0minutes ago\n \n Description : An authenticated user with upload permission to a hosted repository can store content tha...", "creation_timestamp": "2026-05-11T19:30:15.598338Z"}, {"uuid": "0e701520-b32d-4558-b655-149fbe0f7b44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7308", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mllz5cozyv2i", "content": "CVE-2026-7308 - Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page\nCVE ID : CVE-2026-7308\n \n Published : May 11, 2026, 6:16 p.m. | 14\u00a0minutes ago\n \n Description : An authenticated user with upload permission to a hosted repository can store content tha...", "creation_timestamp": "2026-05-11T19:30:15.600626Z"}, {"uuid": "1ef6d0e0-36c8-481e-a855-9c3840e468c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73080", "type": "seen", "source": "https://gist.github.com/alon710/6fa389a21aaf392bd94e8f902ff02560", "content": "# CVE-2026-73080: CVE-2026-73080: Unauthenticated Server-Side Request Forgery (SSRF) in SeaweedFS Volume Server\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-08-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73080\n\n## Summary\nA critical-severity Server-Side Request Forgery (SSRF) vulnerability exists in SeaweedFS volume servers prior to version 4.24. Unauthenticated attackers can trigger arbitrary HTTP requests to internal networks and cloud metadata services via the gRPC endpoint and retrieve the response data.\n\n## TL;DR\nUnauthenticated remote attackers can abuse a gRPC endpoint in SeaweedFS to perform full-read Server-Side Request Forgery (SSRF), exposing internal services and cloud instance metadata.\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS Score**: 9.3\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SeaweedFS Volume Server\n- **SeaweedFS**: < 4.24 (Fixed in: `4.24`)\n\n## Mitigation\n\n- Upgrade SeaweedFS to version 4.24 or higher\n- Restrict gRPC ports (e.g., 18080) to trusted cluster members\n- Ensure -volume.allowUntrustedRemoteEndpoints is not enabled\n- Enforce IMDSv2 with a hop limit of 1 on cloud instances\n\n**Remediation Steps:**\n1. Identify all running instances of SeaweedFS Volume Servers.\n2. Update the SeaweedFS binaries or container images to version 4.24 or higher.\n3. Verify that the startup flags do not contain -volume.allowUntrustedRemoteEndpoints.\n4. Apply firewall rules or security group policies to block public gRPC access.\n5. Monitor gRPC traffic for unauthorized FetchAndWriteNeedle calls.\n\n## References\n\n- [GitHub Security Advisory GHSA-87fv-vqqr-m4jr](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-87fv-vqqr-m4jr)\n- [SeaweedFS Pull Request #9441](https://github.com/seaweedfs/seaweedfs/pull/9441)\n- [Fix Commit 69da20bdaec923e5a43d8aa71bf3c0a2051fc019](https://github.com/seaweedfs/seaweedfs/commit/69da20bdaec923e5a43d8aa71bf3c0a2051fc019)\n- [SeaweedFS Release 4.24](https://github.com/seaweedfs/seaweedfs/releases/tag/4.24)\n- [CVE-2026-73080 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-73080)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73080) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-11T16:32:21.987701Z"}, {"uuid": "bde17007-cb03-423f-971d-084b0be00799", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73080", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mst33mum6g2b", "content": "CVE-2026-73080 - seaweedfs\nA security flaw in SeaweedFS's Volume Server allows anyone with access to the server to make unauthorized requests to other hosts and read back the responses. This can be used to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#seaweedfs #Golang #CVE #infosec", "creation_timestamp": "2026-08-11T16:50:04.827602Z"}, {"uuid": "ea7263e1-023e-4d85-af4a-5c467aedb621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73080", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mst3p7xthj2t", "content": "\ud83d\udd34 CVE-2026-73080 - Critical (9.3)\n\nSeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in wee...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73080/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-11T17:01:03.485288Z"}, {"uuid": "c2c43d2f-f394-4dd4-9ede-021eb0adb982", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73089", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx", "content": "", "creation_timestamp": "2026-09-01T18:35:04.266632Z"}, {"uuid": "9bbe5ddb-4aae-467d-a383-f4b8da95185b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73086", "type": "published-proof-of-concept", "source": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w", "content": "", "creation_timestamp": "2026-09-01T20:35:05.336140Z"}, {"uuid": "1ca62ad0-baf6-4959-b6b6-31b895dd7773", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73086", "type": "seen", "source": "https://gist.github.com/djlan/55a70e34ef3841f55902bda07048c6a5", "content": "# [SECURITY] \u5c06 ReactViewTest \u4e2d\u7684 nanoid \u4ece 3.3.8 \u5347\u7ea7\u5230 3.3.18\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 `ReactViewTest` \u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56 `nanoid` \u56fa\u5b9a\u5230 3.3.18\uff0c\u4ee5\u54cd\u5e94 Component Governance \u62a5\u544a\u7684\u9ad8\u5371\u5b89\u5168\u544a\u8b66 CVE-2026-73086\uff0c\u540c\u65f6\u4fdd\u6301\u4f9d\u8d56\u6765\u6e90\u4ecd\u4e3a\u4ed3\u5e93\u73b0\u6709\u7684 Azure Artifacts npm \u6e90\u3002\n\n| \u9879\u76ee | \u4fe1\u606f |\n|---|---|\n| PR | [777435](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777435) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff1b\u975e\u8349\u7a3f\uff1b\u5f53\u524d\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u6e90\u5206\u652f | `dependabot/npm_and_yarn/sample%2Fextensions%2Fcommon-extensions%2FReactViewTest/nanoid-3.3.18-756895` |\n| \u76ee\u6807\u5206\u652f | `main` |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 1 |\n| \u53d8\u66f4\u6587\u4ef6 | 1 |\n| \u5dee\u5f02\u89c4\u6a21 | 6 \u884c\u65b0\u589e\u30016 \u884c\u5220\u9664\uff1b1,498 \u5b57\u8282 |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [\u4f9d\u8d56\u9501\u5b9a\u4e0e\u5b89\u5168\u4fee\u590d](#\u4f9d\u8d56\u9501\u5b9a\u4e0e\u5b89\u5168\u4fee\u590d)\n  - [\u5305\u6765\u6e90\u4e0e\u5b8c\u6574\u6027\u6821\u9a8c](#\u5305\u6765\u6e90\u4e0e\u5b8c\u6574\u6027\u6821\u9a8c)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n- [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n- [\u5206\u6790\u8986\u76d6\u8303\u56f4](#\u5206\u6790\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5 PR \u7531 Dependabot \u521b\u5efa\uff0c\u7528\u4e8e\u5904\u7406 Component Governance \u62a5\u544a\u7684\u9ad8\u5371\u544a\u8b66 **CVE-2026-73086**\u3002\u5b9e\u9645\u4ee3\u7801\u6539\u52a8\u96c6\u4e2d\u5728 [`sample/extensions/common-extensions/ReactViewTest/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777435?path=/sample/extensions/common-extensions/ReactViewTest/package-lock.json&_a=files)\uff0c\u6ca1\u6709\u4e1a\u52a1\u6e90\u7801\u3001\u6d4b\u8bd5\u6e90\u7801\u6216\u6784\u5efa\u811a\u672c\u53d8\u66f4\u3002\n\n\u9501\u6587\u4ef6\u4e2d\u7684\u4e24\u5904 `nanoid` \u8bb0\u5f55\u5747\u4ece 3.3.8 \u66f4\u65b0\u4e3a 3.3.18\uff1a\n\n- `node_modules/nanoid`\uff1anpm lockfile \u7684\u5b89\u88c5\u6811\u8282\u70b9\u3002\n- \u9876\u5c42 `packages`/\u4f9d\u8d56\u6620\u5c04\u4e2d\u7684 `nanoid` \u6761\u76ee\uff1a\u7528\u4e8e\u63cf\u8ff0\u89e3\u6790\u540e\u7684\u4f9d\u8d56\u7248\u672c\u3002\n\n\u4e24\u5904\u540c\u6b65\u66f4\u65b0\u53ef\u4fdd\u8bc1\u9501\u6587\u4ef6\u5185\u90e8\u5bf9\u7248\u672c\u3001\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u6458\u8981\u7684\u63cf\u8ff0\u4e00\u81f4\u3002\u5b89\u88c5\u6d41\u7a0b\u5728\u9075\u5faa\u8be5\u9501\u6587\u4ef6\u65f6\u4f1a\u83b7\u53d6 3.3.18\uff0c\u800c\u4e0d\u662f\u5b58\u5728\u5b89\u5168\u544a\u8b66\u7684 3.3.8\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### \u4f9d\u8d56\u9501\u5b9a\u4e0e\u5b89\u5168\u4fee\u590d\n\n**\u4e3a\u4ec0\u4e48\u6539\uff1a** PR \u63cf\u8ff0\u660e\u786e\u6307\u51fa\u6b64\u5347\u7ea7\u7528\u4e8e\u54cd\u5e94 Component Governance \u5b89\u5168\u544a\u8b66 16503904\uff08CVE-2026-73086\uff09\u3002\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u8be5 CVE \u7684\u6280\u672f\u7ec6\u8282\uff0c\u56e0\u6b64\u65e0\u6cd5\u8fdb\u4e00\u6b65\u65ad\u8a00\u5177\u4f53\u653b\u51fb\u65b9\u5f0f\u3001\u53d7\u5f71\u54cd API \u6216\u5229\u7528\u524d\u63d0\u3002\n\n**\u5982\u4f55\u751f\u6548\uff1a** `package-lock.json` \u5c06\u89e3\u6790\u7ed3\u679c\u56fa\u5b9a\u4e3a `nanoid@3.3.18`\u3002\u5bf9\u4e8e\u4f7f\u7528\u8be5\u76ee\u5f55\u9501\u6587\u4ef6\u6267\u884c\u7684\u786e\u5b9a\u6027\u5b89\u88c5\u6d41\u7a0b\uff08\u5178\u578b\u5982 `npm ci`\uff09\uff0cnpm \u4f1a\u6309\u9501\u6587\u4ef6\u5b89\u88c5\u65b0\u7248\u672c\u3002`nanoid` \u6761\u76ee\u4ecd\u6807\u8bb0\u4e3a `dev: true`\uff0c\u56e0\u6b64\u4ece\u5305\u5143\u6570\u636e\u770b\uff0c\u5b83\u5c5e\u4e8e\u5f00\u53d1\u4f9d\u8d56\u8def\u5f84\uff0c\u800c\u4e0d\u662f\u751f\u4ea7\u4f9d\u8d56\uff1b\u4f46\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u5b8c\u6574\u4f9d\u8d56\u8c03\u7528\u94fe\uff0c\u65e0\u6cd5\u786e\u8ba4\u5b83\u7531\u54ea\u4e2a\u76f4\u63a5\u4f9d\u8d56\u5f15\u5165\u6216\u5728\u4f55\u5904\u88ab\u8c03\u7528\u3002\n\n\u4ece PR \u63cf\u8ff0\u4e2d\u53ef\u89c1\uff0c3.3.9 \u81f3 3.3.18 \u7684\u4e0a\u6e38\u53d1\u5e03\u5185\u5bb9\u6d89\u53ca\u5305\u4f53\u79ef\u3001React Native \u652f\u6301\u3001\u5927\u5c3a\u5bf8 ID\u3001\u8d1f\u6570\u6216\u96f6\u957f\u5ea6\u8f93\u5165\uff0c\u4ee5\u53ca\u5f02\u6b65\u751f\u6210\u65f6\u7684\u65e0\u9650\u5faa\u73af\u4fee\u590d\u3002\u6b64\u6b21\u5347\u7ea7\u4e00\u6b21\u6027\u7eb3\u5165\u8fd9\u4e9b\u8865\u4e01\u7248\u672c\u3002\u7531\u4e8e PR \u63cf\u8ff0\u7684\u53d1\u5e03\u8bf4\u660e\u672b\u5c3e\u88ab\u622a\u65ad\uff0c\u8fd9\u91cc\u53ea\u6982\u62ec\u5206\u6790\u5305\u5b9e\u9645\u53ef\u89c1\u7684\u6761\u76ee\u3002\n\n### \u5305\u6765\u6e90\u4e0e\u5b8c\u6574\u6027\u6821\u9a8c\n\n\u7248\u672c\u5347\u7ea7\u540c\u65f6\u66f4\u65b0\u4e86 tarball \u5730\u5740\u548c\u5b8c\u6574\u6027\u6458\u8981\uff1a\n\n- \u4e0b\u8f7d\u5730\u5740\u4ece\u5185\u90e8 Azure Artifacts \u6e90\u4e0a\u7684 `nanoid-3.3.8.tgz` \u5207\u6362\u4e3a\u540c\u4e00\u6e90\u4e0a\u7684 `nanoid-3.3.18.tgz`\u3002\n- `integrity` \u503c\u968f\u5305\u5185\u5bb9\u66f4\u65b0\uff0c\u4f9b npm \u6821\u9a8c\u4e0b\u8f7d\u4ea7\u7269\u3002\n\n\u5305\u6e90\u57df\u540d\u548c feed \u8def\u5f84\u6ca1\u6709\u53d8\u5316\uff0c\u56e0\u6b64\u6b64\u6b21\u53d8\u66f4\u4e0d\u4f1a\u4e3b\u52a8\u5f15\u5165\u65b0\u7684\u5916\u90e8 registry\u3002\u9501\u6587\u4ef6\u7ee7\u7eed\u4f7f\u7528\u5df2\u6709\u7684 SHA-1 \u683c\u5f0f\u5b8c\u6574\u6027\u503c\uff1b\u8fd9\u662f\u5305\u5143\u6570\u636e\u7684\u73b0\u72b6\uff0c\u800c\u4e0d\u662f\u672c PR \u65b0\u589e\u7684\u6821\u9a8c\u7b56\u7565\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n| \u5f71\u54cd\u9762 | \u5206\u6790 |\n|---|---|\n| \u5b89\u5168\u6027 | \u76ee\u6807\u662f\u79fb\u9664\u9501\u6587\u4ef6\u4e2d\u88ab\u544a\u8b66\u7684 `nanoid@3.3.8`\uff0c\u6539\u7528 3.3.18\u3002\u662f\u5426\u6700\u7ec8\u5173\u95ed CG \u544a\u8b66\u4ecd\u53d6\u51b3\u4e8e\u5408\u5e76\u540e\u7684\u626b\u63cf\u7ed3\u679c\u3002 |\n| \u8fd0\u884c\u65f6\u884c\u4e3a | \u53d8\u66f4\u5c5e\u4e8e 3.3.x \u8865\u4e01\u5347\u7ea7\uff0c\u901a\u5e38\u9884\u671f\u4fdd\u6301 API \u517c\u5bb9\uff1b\u4f46\u4e0a\u6e38\u4fee\u590d\u6d89\u53ca\u5f02\u5e38\u5c3a\u5bf8\u3001\u8d85\u5927 ID \u548c React Native/\u5f02\u6b65\u8def\u5f84\uff0c\u76f8\u5173\u8fb9\u754c\u884c\u4e3a\u53ef\u80fd\u4e0e\u65e7\u7248\u672c\u4e0d\u540c\u3002 |\n| \u6784\u5efa\u4e0e\u5b89\u88c5 | \u4f7f\u7528\u9501\u6587\u4ef6\u7684\u5b89\u88c5\u4f1a\u4e0b\u8f7d\u65b0\u7684 tarball\uff0c\u5e76\u4f9d\u8d56\u5185\u90e8 Azure Artifacts feed \u4e2d\u8be5\u7248\u672c\u53ef\u8bbf\u95ee\u4e14\u6458\u8981\u5339\u914d\u3002 |\n| \u751f\u4ea7\u53d1\u5e03 | \u9501\u6587\u4ef6\u5c06\u8be5\u5305\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u9884\u671f\u4e3b\u8981\u5f71\u54cd\u6d4b\u8bd5\u3001\u6784\u5efa\u6216\u5f00\u53d1\u5de5\u5177\u94fe\u3002\u5305\u662f\u5426\u4f1a\u88ab\u6253\u5165\u6700\u7ec8\u4ea7\u7269\u65e0\u6cd5\u4ec5\u51ed\u5f53\u524d\u5206\u6790\u5305\u786e\u8ba4\u3002 |\n| \u4ee3\u7801\u63a5\u53e3 | \u6ca1\u6709\u4e1a\u52a1\u4ee3\u7801\u6539\u52a8\uff0c\u4e5f\u6ca1\u6709\u53ef\u89c1\u7684 API \u8c03\u7528\u8c03\u6574\u3002 |\n| \u5ba1\u67e5\u8303\u56f4 | \u552f\u4e00\u53d8\u66f4\u6587\u4ef6\u662f\u9501\u6587\u4ef6\uff1b\u5206\u6790\u5305\u672a\u63d0\u4f9b `package.json` \u7684\u5bf9\u5e94\u53d8\u66f4\u3002 |\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n1. **\u9501\u6587\u4ef6\u4e0e\u4f9d\u8d56\u58f0\u660e\u7684\u4e00\u81f4\u6027\uff1a** \u672c PR \u53ea\u4fee\u6539\u4e86 `package-lock.json`\uff0c\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b `package.json` \u5185\u5bb9\uff0c\u56e0\u800c\u65e0\u6cd5\u786e\u8ba4\u5176\u4e2d\u7684\u7248\u672c\u8303\u56f4\u662f\u5426\u660e\u786e\u5141\u8bb8 3.3.18\u3002`npm ci` \u4f1a\u4e25\u683c\u6821\u9a8c\u6e05\u5355\u4e0e\u9501\u6587\u4ef6\u7684\u4e00\u81f4\u6027\uff0c\u8fd9\u5e94\u4f5c\u4e3a\u9996\u8981\u9a8c\u8bc1\u9879\u3002\n2. **\u8fb9\u754c\u8f93\u5165\u884c\u4e3a\u53d8\u5316\uff1a** \u53ef\u89c1\u53d1\u5e03\u8bf4\u660e\u8868\u660e\u591a\u4e2a\u8865\u4e01\u4fee\u590d\u4e86\u96f6\u957f\u5ea6\u3001\u8d1f\u957f\u5ea6\u3001\u8d85\u5927 ID \u548c\u5f02\u6b65\u751f\u6210\u76f8\u5173\u95ee\u9898\u3002\u5982\u679c\u73b0\u6709\u6d4b\u8bd5\u4f9d\u8d56\u65e7\u7248\u672c\u5728\u8fd9\u4e9b\u8f93\u5165\u4e0a\u7684\u5f02\u5e38\u3001\u6302\u8d77\u6216\u975e\u9884\u671f\u884c\u4e3a\uff0c\u5347\u7ea7\u540e\u7ed3\u679c\u53ef\u80fd\u53d8\u5316\u3002\n3. **React Native \u517c\u5bb9\u6027\uff1a** 3.3.10\u30013.3.11 \u548c 3.3.18 \u5305\u542b React Native \u76f8\u5173\u4fee\u590d\u3002\u5373\u4f7f\u8fd9\u901a\u5e38\u662f\u6b63\u5411\u53d8\u5316\uff0c\u4ecd\u5e94\u786e\u8ba4 `ReactViewTest` \u7684\u76ee\u6807\u73af\u5883\u548c\u6253\u5305\u5668\u6ca1\u6709\u51fa\u73b0\u6a21\u5757\u89e3\u6790\u6216\u968f\u673a\u6570\u5b9e\u73b0\u5dee\u5f02\u3002\n4. **\u5185\u90e8\u6e90\u53ef\u7528\u6027\uff1a** \u65b0 tarball \u6307\u5411\u73b0\u6709\u5185\u90e8 feed\u3002\u82e5\u8be5 feed \u672a\u5728\u6240\u6709 CI/\u5f00\u53d1\u73af\u5883\u4e2d\u540c\u6b65 3.3.18\uff0c\u4f9d\u8d56\u6062\u590d\u4f1a\u5931\u8d25\u3002\n5. **\u95f4\u63a5\u4f9d\u8d56\u5f71\u54cd\u4e0d\u660e\uff1a** \u5206\u6790\u5305\u6ca1\u6709\u4f9d\u8d56\u6811\u4e0a\u4e0b\u6587\uff0c\u65e0\u6cd5\u5224\u65ad `nanoid` \u662f\u76f4\u63a5\u5f00\u53d1\u4f9d\u8d56\u8fd8\u662f\u4f20\u9012\u4f9d\u8d56\uff0c\u4e5f\u65e0\u6cd5\u786e\u8ba4\u8c03\u7528\u65b9\u5bf9\u7279\u5b9a\u7248\u672c\u884c\u4e3a\u7684\u5047\u8bbe\u3002\n6. **\u5b89\u5168\u4fee\u590d\u786e\u8ba4\u4f9d\u8d56\u540e\u7eed\u626b\u63cf\uff1a** PR \u7684\u610f\u56fe\u662f\u5904\u7406 CVE-2026-73086\uff0c\u4f46\u5206\u6790\u5305\u672a\u5305\u542b CG \u590d\u626b\u7ed3\u679c\uff0c\u4e0d\u80fd\u636e\u6b64\u5ba3\u79f0\u544a\u8b66\u5df2\u7ecf\u5173\u95ed\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u5206\u6790\u5305\u4e2d\u6ca1\u6709\u6d4b\u8bd5\u6267\u884c\u8bb0\u5f55\u3001\u6d41\u6c34\u7ebf\u7ed3\u679c\u6216\u65b0\u589e\u6d4b\u8bd5\u6587\u4ef6\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u8be5\u53d8\u66f4\u5df2\u7ecf\u901a\u8fc7\u6d4b\u8bd5\u3002\u5efa\u8bae\u81f3\u5c11\u6267\u884c\uff1a\n\n1. \u5728 `sample/extensions/common-extensions/ReactViewTest` \u4e2d\u8fd0\u884c\u4ed3\u5e93\u65e2\u6709\u7684\u5e72\u51c0\u4f9d\u8d56\u6062\u590d\u6d41\u7a0b\uff0c\u4f18\u5148\u9a8c\u8bc1 `npm ci` \u6210\u529f\u4e14\u4e0d\u4f1a\u518d\u6b21\u6539\u5199\u9501\u6587\u4ef6\u3002\n2. \u8fd0\u884c\u8be5\u793a\u4f8b\u76ee\u5f55\u73b0\u6709\u7684\u5355\u5143\u6d4b\u8bd5\u3001React \u89c6\u56fe\u6d4b\u8bd5\u548c\u6784\u5efa\u4efb\u52a1\uff0c\u8986\u76d6\u5f00\u53d1\u4f9d\u8d56\u5b9e\u9645\u53c2\u4e0e\u7684\u5de5\u5177\u94fe\u3002\n3. \u5982\u679c\u9879\u76ee\u76f4\u63a5\u6216\u95f4\u63a5\u8c03\u7528 `nanoid`\uff0c\u9a8c\u8bc1\u9ed8\u8ba4 ID \u751f\u6210\uff0c\u5e76\u8865\u5145\u96f6\u957f\u5ea6\u3001\u8d1f\u957f\u5ea6\u3001\u8d85\u5927\u957f\u5ea6\u53ca\u5f02\u6b65\u8c03\u7528\u7b49\u4e0e\u53ef\u89c1\u53d1\u5e03\u8bf4\u660e\u76f8\u5173\u7684\u8fb9\u754c\u573a\u666f\u3002\n4. \u5728 CI \u4f7f\u7528\u7684\u51ed\u636e\u548c\u7f51\u7edc\u73af\u5883\u4e2d\u786e\u8ba4\u5185\u90e8 Azure Artifacts feed \u80fd\u4e0b\u8f7d `nanoid-3.3.18.tgz`\uff0c\u4e14\u5b8c\u6574\u6027\u6821\u9a8c\u901a\u8fc7\u3002\n5. \u5408\u5e76\u540e\u91cd\u65b0\u8fd0\u884c Component Governance \u626b\u63cf\uff0c\u786e\u8ba4\u544a\u8b66 16503904 \u4e0d\u518d\u547d\u4e2d\u8be5\u9501\u6587\u4ef6\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\n\n- **\u4ee3\u7801\u5dee\u5f02\u8986\u76d6\uff1a\u5b8c\u6574\u3002** \u6570\u636e\u5305\u6807\u8bb0 `diffTruncated: false`\uff0c\u552f\u4e00\u6587\u4ef6\u7684\u5dee\u5f02\u4e5f\u6807\u8bb0 `truncated: false`\uff1b\u56e0\u6b64\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u5185\u63d0\u4f9b\u7684\u5168\u90e8\u6587\u4ef6\u5dee\u5f02\u3002\n- **PR \u63cf\u8ff0\u8986\u76d6\uff1a\u4e0d\u5b8c\u6574\u3002** `description` \u5728\u4e0a\u6e38 changelog \u7684 3.3.10 \u6761\u76ee\u9644\u8fd1\u4ee5\u7701\u7565\u6807\u8bb0\u7ed3\u675f\uff0c\u540e\u7eed\u63cf\u8ff0\u5185\u5bb9\u4e0d\u5728\u6570\u636e\u5305\u4e2d\u3002\u672c\u8bf4\u660e\u6ca1\u6709\u63a8\u65ad\u6216\u5206\u6790\u7f3a\u5931\u90e8\u5206\u3002\n- **\u53ef\u7528\u6587\u4ef6\u8303\u56f4\uff1a** \u6570\u636e\u5305\u53ea\u5305\u542b [`sample/extensions/common-extensions/ReactViewTest/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777435?path=/sample/extensions/common-extensions/ReactViewTest/package-lock.json&_a=files) \u7684\u5dee\u5f02\uff1b\u672a\u63d0\u4f9b `package.json`\u3001\u8c03\u7528\u4ee3\u7801\u3001\u6d4b\u8bd5\u4ee3\u7801\u3001\u6784\u5efa\u65e5\u5fd7\u6216\u5b89\u5168\u626b\u63cf\u8be6\u60c5\u3002\n- **\u6570\u636e\u5305\u72b6\u6001\uff1a** \u5bfc\u51fa\u8fc7\u7a0b\u6ca1\u6709\u8bb0\u5f55\u9519\u8bef\u6216\u8b66\u544a\uff1b\u5dee\u5f02\u7531\u672c\u5730 Git \u65b9\u6cd5\u751f\u6210\u3002\n", "creation_timestamp": "2026-09-05T00:14:08.081965Z"}, {"uuid": "49609711-a796-4566-a2f1-c023991c63f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73088", "type": "seen", "source": "https://gist.github.com/djlan/e3b6762435f262eb64ea25ec3f8c9d82", "content": "# [SECURITY] \u5c06 extension-sample \u7684 browserslist \u4ece 4.24.2 \u5347\u7ea7\u5230 4.28.8\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 `sample/extension-sample` \u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56 `browserslist` \u5347\u7ea7\u5230 4.28.8 \u5e76\u540c\u6b65\u5237\u65b0\u5176\u4f20\u9012\u4f9d\u8d56\uff0c\u4ee5\u5904\u7406\u4e24\u4e2a\u9ad8\u5371\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\uff0c\u540c\u65f6\u5f15\u5165\u66f4\u65b0\u7684\u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u4e0e\u67e5\u8be2\u5b9e\u73b0\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 777936](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777936) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff1b\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001 `succeeded` |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fextension-sample/browserslist-4.28.8-757184` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-09-04 09:35:12\uff08\u5206\u6790\u5305\u539f\u59cb\u65f6\u95f4\u683c\u5f0f\u672a\u6ce8\u660e\u65f6\u533a\uff09 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 1 |\n| \u53d8\u66f4\u6587\u4ef6 | 1 |\n| \u5dee\u5f02\u7edf\u8ba1 | +65 / -42\uff0c\u5171 107 \u884c\u53d8\u66f4 |\n| \u5b89\u5168\u80cc\u666f | CG Alert 16633189\uff08CVE-2026-73088\uff09\u3001CG Alert 16633190\uff08CVE-2026-73089\uff09\uff0c\u5747\u6807\u8bb0\u4e3a High |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n6. [\u5206\u6790\u8986\u76d6\u8303\u56f4](#\u5206\u6790\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u53d8\u66f4\u6ca1\u6709\u4fee\u6539\u5e94\u7528\u6e90\u7801\u6216 `package.json`\uff0c\u552f\u4e00\u4fee\u6539\u7684\u662f [`sample/extension-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777936?path=/sample/extension-sample/package-lock.json&_a=files)\u3002\u9501\u6587\u4ef6\u628a `browserslist` \u4ece 4.24.2 \u56fa\u5b9a\u5230 4.28.8\uff0c\u5e76\u6309\u7167\u65b0\u7248\u672c\u7684\u4f9d\u8d56\u58f0\u660e\u91cd\u65b0\u89e3\u6790\u3001\u56fa\u5b9a\u76f8\u5173\u4f20\u9012\u4f9d\u8d56\u3002\n\n\u8fd9\u6837\u505a\u7684\u6838\u5fc3\u76ee\u7684\uff0c\u662f\u8ba9\u540e\u7eed\u57fa\u4e8e\u8be5\u9501\u6587\u4ef6\u6267\u884c\u7684 npm \u5b89\u88c5\u4e0d\u518d\u53d6\u5f97\u65e7\u7248 `browserslist`\uff0c\u4ece\u800c\u5e94\u7528\u5347\u7ea7\u7248\u672c\u4e2d\u5305\u542b\u7684\u5b89\u5168\u4fee\u590d\u3002PR \u63cf\u8ff0\u660e\u786e\u5c06\u6b64\u5347\u7ea7\u5173\u8054\u5230\u4e24\u4e2a\u9ad8\u5371\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\uff1b\u5305\u5185\u53ef\u89c1\u7684\u53d1\u5e03\u8bf4\u660e\u8fd8\u63d0\u5230 4.28.x \u4fee\u590d\u4e86\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u95ee\u9898\u548c\u65e0\u754c\u5185\u5b58\u589e\u957f\u3002\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u4fee\u590d\u63d0\u4ea4\u4e4b\u95f4\u7684\u9010\u9879\u6620\u5c04\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u6bcf\u4e2a CVE \u5206\u522b\u7531\u54ea\u4e00\u5904\u4ee3\u7801\u4fee\u590d\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n[`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777936?path=/sample/extension-sample/package-lock.json&_a=files) \u4e2d\u7684 `browserslist` \u7248\u672c\u3001\u79c1\u6709 npm \u6e90\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u5747\u4ece 4.24.2 \u5bf9\u5e94\u503c\u66f4\u65b0\u4e3a 4.28.8 \u5bf9\u5e94\u503c\u3002\n\n\u9501\u6587\u4ef6\u662f npm \u7684\u53ef\u590d\u73b0\u5b89\u88c5\u4f9d\u636e\u3002\u6309\u6b64\u9501\u6587\u4ef6\u5b89\u88c5\u65f6\uff0cnpm \u5c06\u91c7\u7528\u65b0\u7684\u7cbe\u786e\u7248\u672c\u548c\u54c8\u5e0c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u4f7f\u7528\u5b58\u5728\u544a\u8b66\u7684 4.24.2\u3002\u7531\u4e8e\u5206\u6790\u5305\u672a\u5305\u542b `package.json`\uff0c\u65e0\u6cd5\u786e\u8ba4\u9876\u5c42\u7248\u672c\u8303\u56f4\u6216\u5176\u4ed6\u89e3\u6790\u89c4\u5219\u4e3a\u4f55\u65e0\u9700\u540c\u6b65\u4fee\u6539\u3002\u8be5\u5305\u88ab\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u56e0\u6b64\u4e3b\u8981\u5f71\u54cd\u6784\u5efa\u3001\u8f6c\u8bd1\u3001CSS/JavaScript \u76ee\u6807\u73af\u5883\u8ba1\u7b97\u7b49\u5f00\u53d1\u6216\u6784\u5efa\u9636\u6bb5\uff0c\u800c\u4e0d\u662f\u4f5c\u4e3a\u5e94\u7528\u4e1a\u52a1\u4ee3\u7801\u76f4\u63a5\u52a0\u8f7d\u3002\n\n### 2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u94fe\u5237\u65b0\n\n`browserslist` 4.28.8 \u9700\u8981\u66f4\u65b0\u7684\u6570\u636e\u5305\u548c\u7248\u672c\u6620\u5c04\uff0c\u56e0\u6b64\u9501\u6587\u4ef6\u540c\u65f6\u5347\u7ea7\uff1a\n\n| \u4f9d\u8d56 | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528 |\n|---|---:|---:|---|\n| `caniuse-lite` | 1.0.30001687 | 1.0.30001810 | \u63d0\u4f9b\u6d4f\u89c8\u5668\u529f\u80fd\u652f\u6301\u6570\u636e |\n| `electron-to-chromium` | 1.5.72 | 1.5.416 | \u5c06 Electron \u7248\u672c\u6620\u5c04\u5230 Chromium \u7248\u672c |\n| `node-releases` | 2.0.19 | 2.0.54 | \u63d0\u4f9b Node.js \u53d1\u5e03\u7248\u672c\u6570\u636e |\n| `update-browserslist-db` | 1.1.1 | 1.3.2 | \u66f4\u65b0 Browserslist \u6570\u636e\u5e93 |\n\n\u8fd9\u4e9b\u7248\u672c\u4f1a\u5f71\u54cd Browserslist \u5bf9\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\u7684\u8ba1\u7b97\u7ed3\u679c\u3002\u5373\u4f7f\u9879\u76ee\u7684 Browserslist \u67e5\u8be2\u914d\u7f6e\u4e0d\u53d8\uff0c\u66f4\u65b0\u540e\u7684\u5e02\u573a\u6570\u636e\u3001Node/Electron \u6620\u5c04\u6216\u67e5\u8be2\u4fee\u590d\u4e5f\u53ef\u80fd\u4f7f\u6784\u5efa\u5de5\u5177\u9009\u51fa\u7565\u6709\u4e0d\u540c\u7684\u76ee\u6807\u96c6\u5408\uff0c\u8fdb\u800c\u6539\u53d8\u8f6c\u8bd1\u6216\u524d\u7f00\u5904\u7406\u7ed3\u679c\u3002\n\n### 3. Baseline \u67e5\u8be2\u652f\u6301\n\n\u65b0\u4f9d\u8d56\u56fe\u65b0\u589e `baseline-browser-mapping` 2.11.20\uff0c\u5e76\u7531 `browserslist` \u901a\u8fc7 `^2.11.12` \u5f15\u7528\u3002\u8be5\u5305\u4e3a Baseline \u6d4f\u89c8\u5668\u67e5\u8be2\u63d0\u4f9b\u6620\u5c04\u6570\u636e\u548c\u547d\u4ee4\u884c\u5165\u53e3\uff1b\u9501\u6587\u4ef6\u540c\u65f6\u8bb0\u5f55\u4e86\u5176\u8bb8\u53ef\u8bc1\u3001Node \u5f15\u64ce\u8981\u6c42\u548c\u79c1\u6709\u6e90\u5236\u54c1\u4fe1\u606f\u3002\n\n\u6b64\u65b0\u589e\u4f9d\u8d56\u89e3\u91ca\u4e86\u4e3a\u4f55\u4e00\u6b21\u770b\u4f3c\u5355\u5305\u5347\u7ea7\u4f1a\u589e\u52a0\u65b0\u7684\u9501\u6587\u4ef6\u8282\u70b9\uff1a`browserslist` \u65b0\u7248\u672c\u628a Baseline \u76f8\u5173\u80fd\u529b\u62c6\u5206\u6216\u63a5\u5165\u4e86\u4e13\u95e8\u7684\u6570\u636e\u6620\u5c04\u5305\u3002\u5305\u5185\u53ef\u89c1\u53d1\u5e03\u8bf4\u660e\u8fd8\u63d0\u5230 Baseline \u67e5\u8be2\u7684\u5927\u5c0f\u5199\u5904\u7406\u548c KaiOS \u5305\u542b\u903b\u8f91\u4fee\u590d\uff0c\u56e0\u6b64\u4f7f\u7528\u76f8\u5173\u67e5\u8be2\u65f6\uff0c\u7ed3\u679c\u53ef\u80fd\u6bd4\u65e7\u7248\u672c\u66f4\u51c6\u786e\u3002\n\n### 4. \u9501\u6587\u4ef6\u53cc\u7ed3\u6784\u540c\u6b65\n\n\u8be5\u9501\u6587\u4ef6\u540c\u65f6\u5305\u542b `node_modules/...` \u5305\u8bb0\u5f55\u548c\u8f83\u65e7\u517c\u5bb9\u7ed3\u6784\u4e2d\u7684\u4f9d\u8d56\u8bb0\u5f55\u3002\u5dee\u5f02\u5728\u4e24\u4e2a\u533a\u57df\u91cd\u590d\u66f4\u65b0\u540c\u4e00\u7ec4\u7248\u672c\u4e0e\u4f9d\u8d56\u5173\u7cfb\uff0c\u8fd9\u662f npm \u9501\u6587\u4ef6\u683c\u5f0f\u7684\u6b63\u5e38\u540c\u6b65\uff0c\u800c\u4e0d\u662f\u5b89\u88c5\u4e24\u4efd\u76f8\u540c\u4f9d\u8d56\u3002\n\n\u6b64\u5916\uff0c`update-browserslist-db` \u5bf9 `picocolors` \u7684\u7248\u672c\u8303\u56f4\u7531 `^1.1.0` \u8c03\u6574\u4e3a `^1.1.1`\uff1b\u5f53\u524d\u5dee\u5f02\u6ca1\u6709\u663e\u793a `picocolors` \u7684\u5b9e\u9645\u9501\u5b9a\u7248\u672c\u53d1\u751f\u53d8\u5316\uff0c\u56e0\u6b64\u8fd9\u91cc\u662f\u4f9d\u8d56\u58f0\u660e\u8303\u56f4\u7684\u540c\u6b65\uff0c\u800c\u4e0d\u662f\u53ef\u786e\u8ba4\u7684\u5305\u7248\u672c\u5347\u7ea7\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6b63\u9762\u5f71\u54cd\n\n- \u901a\u8fc7\u9501\u5b9a `browserslist` 4.28.8\uff0c\u9488\u5bf9 PR \u63cf\u8ff0\u5217\u51fa\u7684\u4e24\u4e2a\u9ad8\u5371\u5b89\u5168\u544a\u8b66\u5b8c\u6210\u4f9d\u8d56\u4fa7\u5347\u7ea7\u3002\n- \u83b7\u5f97\u5305\u5185\u53d1\u5e03\u8bf4\u660e\u6240\u5217\u7684\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u3001\u65e0\u754c\u5185\u5b58\u589e\u957f\u7b49\u4fee\u590d\u3002\n- \u66f4\u65b0\u6d4f\u89c8\u5668\u3001Electron \u548c Node.js \u7248\u672c\u6570\u636e\uff0c\u964d\u4f4e\u56e0\u8fc7\u671f\u517c\u5bb9\u6027\u6570\u636e\u5e93\u5bfc\u81f4\u76ee\u6807\u5224\u65ad\u4e0d\u51c6\u786e\u7684\u6982\u7387\u3002\n- \u4fee\u590d\u591a\u79cd\u67e5\u8be2\u884c\u4e3a\uff0c\u5305\u62ec Electron \u7248\u672c\u67e5\u8be2\u3001`>`/`>=` \u67e5\u8be2\u3001Baseline \u5927\u5c0f\u5199\u548c KaiOS \u76f8\u5173\u903b\u8f91\u3002\n- \u4ecd\u4ece AzureNotebooks \u7684\u5185\u90e8 npm \u6e90\u89e3\u6790\u4f9d\u8d56\uff0c\u6ca1\u6709\u6539\u53d8\u5236\u54c1\u6765\u6e90\u6a21\u578b\u3002\n\n### \u884c\u4e3a\u5f71\u54cd\n\n\u6b64 PR \u4e0d\u76f4\u63a5\u6539\u52a8\u8fd0\u884c\u65f6\u4e1a\u52a1\u903b\u8f91\uff0c\u4f46\u53ef\u80fd\u95f4\u63a5\u6539\u53d8\u6784\u5efa\u4ea7\u7269\u3002\u4efb\u4f55\u8c03\u7528 Browserslist \u7684\u5de5\u5177\uff08\u4f8b\u5982\u8f6c\u8bd1\u5668\u3001Autoprefixer \u6216\u5176\u4ed6\u524d\u7aef\u6784\u5efa\u63d2\u4ef6\uff09\u90fd\u53ef\u80fd\u56e0\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\u53d8\u5316\u800c\u751f\u6210\u4e0d\u540c\u7684\u8bed\u6cd5\u8f6c\u6362\u6216 CSS \u524d\u7f00\u3002\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u8be5\u793a\u4f8b\u7684\u6784\u5efa\u914d\u7f6e\u548c\u4ea7\u7269\u5dee\u5f02\uff0c\u56e0\u6b64\u65e0\u6cd5\u786e\u8ba4\u5b9e\u9645\u4ea7\u7269\u662f\u5426\u53d1\u751f\u53d8\u5316\u3002\n\n### \u8303\u56f4\u5f71\u54cd\n\n\u53d8\u66f4\u5c40\u9650\u4e8e `sample/extension-sample` \u7684\u9501\u6587\u4ef6\uff0c\u672a\u663e\u793a\u4ed3\u5e93\u5176\u4ed6\u793a\u4f8b\u6216\u4ea7\u54c1\u76ee\u5f55\u7684\u4f9d\u8d56\u88ab\u66f4\u65b0\u3002\u82e5\u5176\u4ed6\u76ee\u5f55\u4e5f\u5404\u81ea\u7ef4\u62a4 `browserslist` \u9501\u5b9a\u7248\u672c\uff0c\u672c PR \u4e0d\u4f1a\u81ea\u52a8\u4fee\u590d\u90a3\u4e9b\u72ec\u7acb\u4f9d\u8d56\u6811\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669 | \u5177\u4f53\u539f\u56e0 | \u5efa\u8bae\u5173\u6ce8 |\n|---|---|---|\n| Node.js \u7248\u672c\u517c\u5bb9\u6027 | \u65b0\u9501\u5b9a\u7684 `node-releases` 2.0.54 \u58f0\u660e `node >=18`\uff0c\u65e7\u7248\u672c\u5728\u5dee\u5f02\u4e2d\u6ca1\u6709\u8be5\u5f15\u64ce\u8981\u6c42 | \u82e5\u8be5\u793a\u4f8b\u6216 CI \u4ecd\u4f7f\u7528 Node 16 \u6216\u66f4\u65e9\u7248\u672c\uff0cnpm \u53ef\u80fd\u4ea7\u751f `EBADENGINE` \u8b66\u544a\uff1b\u542f\u7528 `engine-strict` \u65f6\u53ef\u80fd\u5b89\u88c5\u5931\u8d25\u3002\u5e94\u4ee5 Node 18+ \u6267\u884c\u5b89\u88c5\u9a8c\u8bc1 |\n| \u6784\u5efa\u8f93\u51fa\u53d8\u5316 | `caniuse-lite`\u3001Electron/Node \u6620\u5c04\u548c\u67e5\u8be2\u5b9e\u73b0\u5747\u8de8\u591a\u4e2a\u7248\u672c\u66f4\u65b0 | \u6bd4\u8f83\u5347\u7ea7\u524d\u540e\u7684\u76ee\u6807\u6d4f\u89c8\u5668\u5217\u8868\u4e0e\u6784\u5efa\u4ea7\u7269\uff0c\u7279\u522b\u5173\u6ce8 polyfill\u3001\u8bed\u6cd5\u964d\u7ea7\u548c CSS \u524d\u7f00\u53d8\u5316 |\n| \u67e5\u8be2\u8bed\u4e49\u53d8\u5316 | \u65b0\u7248\u672c\u4fee\u590d `>`\u3001`>=`\u3001Electron\u3001Baseline \u7b49\u67e5\u8be2 | \u5982\u679c\u914d\u7f6e\u4f9d\u8d56\u65e7\u7248\u9519\u8bef\u884c\u4e3a\uff0c\u76ee\u6807\u96c6\u5408\u53ef\u80fd\u53d8\u5316\uff1b\u5e94\u8fd0\u884c\u9879\u76ee\u5b9e\u9645\u4f7f\u7528\u7684 Browserslist \u67e5\u8be2 |\n| \u65b0\u4f20\u9012\u4f9d\u8d56 | \u65b0\u589e `baseline-browser-mapping`\uff0c\u589e\u52a0\u4e00\u4e2a\u5b89\u88c5\u8282\u70b9\u548c CLI \u5165\u53e3 | \u786e\u8ba4\u5185\u90e8\u6e90\u53ef\u6301\u7eed\u63d0\u4f9b\u8be5\u5236\u54c1\uff0c\u8bb8\u53ef\u8bc1 Apache-2.0 \u7b26\u5408\u9879\u76ee\u8981\u6c42 |\n| \u9501\u6587\u4ef6\u4e0e\u6e05\u5355\u4e00\u81f4\u6027 | \u5305\u5185\u53ea\u663e\u793a\u9501\u6587\u4ef6\u53d8\u66f4\uff0c\u672a\u663e\u793a `package.json` | \u5e94\u786e\u8ba4\u9876\u5c42\u7248\u672c\u8303\u56f4\u5141\u8bb8\u5e76\u9884\u671f\u89e3\u6790\u5230 4.28.8\uff1b\u5426\u5219\u672a\u6765\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\u53ef\u80fd\u56de\u9000\u6216\u4ea7\u751f\u4e0d\u540c\u7ed3\u679c |\n| \u5b8c\u6574\u6027\u54c8\u5e0c\u5f62\u5f0f | \u65b0\u65e7\u76f8\u5173\u5236\u54c1\u5747\u663e\u793a SHA-1 \u5f62\u5f0f\u7684 `integrity` \u503c\uff0c\u4e14\u6765\u81ea\u5185\u90e8\u6e90 | \u8fd9\u770b\u8d77\u6765\u662f\u73b0\u6709\u6e90/\u9501\u6587\u4ef6\u6a21\u5f0f\u7684\u5ef6\u7eed\uff0c\u4f46\u5b89\u5168\u5ba1\u67e5\u53ef\u786e\u8ba4\u5185\u90e8\u6e90\u662f\u5426\u8fd8\u63d0\u4f9b\u66f4\u5f3a\u7684 SRI \u54c8\u5e0c |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u6d4b\u8bd5\u6587\u4ef6\u4fee\u6539\u3001\u81ea\u52a8\u5316\u6d4b\u8bd5\u7ed3\u679c\u3001\u6784\u5efa\u65e5\u5fd7\u6216\u7b56\u7565\u68c0\u67e5\u8be6\u60c5\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u6d4b\u8bd5\u5df2\u7ecf\u901a\u8fc7\u3002`mergeStatus: succeeded` \u4ec5\u8868\u660e\u5305\u4e2d\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u6210\u529f\uff0c\u4e0d\u80fd\u66ff\u4ee3\u6784\u5efa\u548c\u6d4b\u8bd5\u8bc1\u636e\u3002\n\n\u9488\u5bf9\u672c\u6b21\u53d8\u66f4\uff0c\u6700\u6709\u4ef7\u503c\u7684\u9a8c\u8bc1\u5305\u62ec\uff1a\n\n1. \u5728\u4ed3\u5e93\u652f\u6301\u7684 Node.js \u7248\u672c\u4e0a\u5bf9 `sample/extension-sample` \u6267\u884c\u5e72\u51c0\u7684\u9501\u6587\u4ef6\u5b89\u88c5\uff0c\u786e\u8ba4\u5185\u90e8 npm \u6e90\u53ef\u89e3\u6790\u6240\u6709\u65b0\u7248\u672c\uff1b\u5c24\u5176\u5e94\u8986\u76d6 Node 18+\uff0c\u5e76\u68c0\u67e5\u65e7\u7248 Node \u662f\u5426\u51fa\u73b0\u5f15\u64ce\u9519\u8bef\u3002\n2. \u8fd0\u884c\u8be5\u793a\u4f8b\u73b0\u6709\u7684\u6784\u5efa\u548c\u6d4b\u8bd5\u547d\u4ee4\uff0c\u786e\u8ba4\u4f7f\u7528\u65b0\u7248 Browserslist \u540e\u65e0\u914d\u7f6e\u89e3\u6790\u9519\u8bef\u3002\n3. \u8f93\u51fa\u5e76\u6bd4\u8f83\u9879\u76ee\u5b9e\u9645 Browserslist \u67e5\u8be2\u7684\u89e3\u6790\u7ed3\u679c\uff0c\u786e\u8ba4\u76ee\u6807\u6d4f\u89c8\u5668\u53d8\u5316\u7b26\u5408\u9884\u671f\u3002\n4. \u82e5\u8be5\u793a\u4f8b\u751f\u6210\u524d\u7aef\u5305\uff0c\u6bd4\u8f83\u5173\u952e\u6784\u5efa\u4ea7\u7269\uff0c\u68c0\u67e5\u8f6c\u8bd1\u7ea7\u522b\u3001CSS \u524d\u7f00\u548c\u5305\u4f53\u79ef\u662f\u5426\u51fa\u73b0\u975e\u9884\u671f\u53d8\u5316\u3002\n5. \u5728\u7ec4\u4ef6\u6cbb\u7406\u626b\u63cf\u4e2d\u786e\u8ba4 CVE-2026-73088 \u548c CVE-2026-73089 \u544a\u8b66\u5747\u5df2\u6d88\u9664\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\n\n- \u5206\u6790\u5305\u58f0\u660e\u5171\u6709 1 \u4e2a\u53d8\u66f4\u6587\u4ef6\uff0c\u4e14\u63d0\u4f9b\u4e86\u8be5\u6587\u4ef6\u7684\u5dee\u5f02\uff1b\u6587\u4ef6\u7ea7 `truncated` \u548c\u5168\u5c40 `diffTruncated` \u5747\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u4e2d\u5217\u51fa\u7684 **1/1 \u4e2a\u6587\u4ef6\u5dee\u5f02**\uff0c\u6ca1\u6709\u5df2\u77e5\u7684\u622a\u65ad\u5dee\u5f02\u7f3a\u53e3\u3002\n- \u5dee\u5f02\u7531 `git-local` \u65b9\u6cd5\u751f\u6210\uff0c\u603b\u8ba1 9,598 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5305\u8bb0\u5f55\u7684\u5355\u6587\u4ef6\u548c\u603b\u4f53\u622a\u65ad\u4e0a\u9650\u3002\n- PR \u63cf\u8ff0\u4e2d\u7684\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u6587\u672c\u5728\u53ef\u89c1\u5185\u5bb9\u672b\u5c3e\u4ee5\u7701\u7565\u5f62\u5f0f\u4e2d\u65ad\uff0c\u56e0\u6b64\u672c\u6587\u53ea\u91c7\u7528\u5305\u5185\u660e\u786e\u53ef\u89c1\u7684\u53d1\u5e03\u8bf4\u660e\u6761\u76ee\uff0c\u6ca1\u6709\u63a8\u65ad\u672a\u63d0\u4f9b\u7684\u540e\u7eed\u7248\u672c\u8bf4\u660e\u3002\n- \u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u5b9e\u9645\u6e90\u7801\u3001`package.json` \u5185\u5bb9\u3001\u6784\u5efa\u914d\u7f6e\u3001\u6d4b\u8bd5\u7ed3\u679c\u6216\u5b8c\u6574\u7b56\u7565\u72b6\u6001\uff1b\u4e0e\u8fd9\u4e9b\u5185\u5bb9\u6709\u5173\u7684\u7ed3\u8bba\u5747\u9650\u5b9a\u4e3a\u98ce\u9669\u6216\u5efa\u8bae\uff0c\u800c\u975e\u5df2\u9a8c\u8bc1\u4e8b\u5b9e\u3002\n", "creation_timestamp": "2026-09-05T16:13:11.785872Z"}, {"uuid": "417cc851-fd76-465f-bbf0-88635da71ea9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73089", "type": "seen", "source": "https://gist.github.com/djlan/e3b6762435f262eb64ea25ec3f8c9d82", "content": "# [SECURITY] \u5c06 extension-sample \u7684 browserslist \u4ece 4.24.2 \u5347\u7ea7\u5230 4.28.8\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 `sample/extension-sample` \u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56 `browserslist` \u5347\u7ea7\u5230 4.28.8 \u5e76\u540c\u6b65\u5237\u65b0\u5176\u4f20\u9012\u4f9d\u8d56\uff0c\u4ee5\u5904\u7406\u4e24\u4e2a\u9ad8\u5371\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\uff0c\u540c\u65f6\u5f15\u5165\u66f4\u65b0\u7684\u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u4e0e\u67e5\u8be2\u5b9e\u73b0\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 777936](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777936) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff1b\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001 `succeeded` |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fextension-sample/browserslist-4.28.8-757184` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-09-04 09:35:12\uff08\u5206\u6790\u5305\u539f\u59cb\u65f6\u95f4\u683c\u5f0f\u672a\u6ce8\u660e\u65f6\u533a\uff09 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 1 |\n| \u53d8\u66f4\u6587\u4ef6 | 1 |\n| \u5dee\u5f02\u7edf\u8ba1 | +65 / -42\uff0c\u5171 107 \u884c\u53d8\u66f4 |\n| \u5b89\u5168\u80cc\u666f | CG Alert 16633189\uff08CVE-2026-73088\uff09\u3001CG Alert 16633190\uff08CVE-2026-73089\uff09\uff0c\u5747\u6807\u8bb0\u4e3a High |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n6. [\u5206\u6790\u8986\u76d6\u8303\u56f4](#\u5206\u6790\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u53d8\u66f4\u6ca1\u6709\u4fee\u6539\u5e94\u7528\u6e90\u7801\u6216 `package.json`\uff0c\u552f\u4e00\u4fee\u6539\u7684\u662f [`sample/extension-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777936?path=/sample/extension-sample/package-lock.json&_a=files)\u3002\u9501\u6587\u4ef6\u628a `browserslist` \u4ece 4.24.2 \u56fa\u5b9a\u5230 4.28.8\uff0c\u5e76\u6309\u7167\u65b0\u7248\u672c\u7684\u4f9d\u8d56\u58f0\u660e\u91cd\u65b0\u89e3\u6790\u3001\u56fa\u5b9a\u76f8\u5173\u4f20\u9012\u4f9d\u8d56\u3002\n\n\u8fd9\u6837\u505a\u7684\u6838\u5fc3\u76ee\u7684\uff0c\u662f\u8ba9\u540e\u7eed\u57fa\u4e8e\u8be5\u9501\u6587\u4ef6\u6267\u884c\u7684 npm \u5b89\u88c5\u4e0d\u518d\u53d6\u5f97\u65e7\u7248 `browserslist`\uff0c\u4ece\u800c\u5e94\u7528\u5347\u7ea7\u7248\u672c\u4e2d\u5305\u542b\u7684\u5b89\u5168\u4fee\u590d\u3002PR \u63cf\u8ff0\u660e\u786e\u5c06\u6b64\u5347\u7ea7\u5173\u8054\u5230\u4e24\u4e2a\u9ad8\u5371\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\uff1b\u5305\u5185\u53ef\u89c1\u7684\u53d1\u5e03\u8bf4\u660e\u8fd8\u63d0\u5230 4.28.x \u4fee\u590d\u4e86\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u95ee\u9898\u548c\u65e0\u754c\u5185\u5b58\u589e\u957f\u3002\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u4fee\u590d\u63d0\u4ea4\u4e4b\u95f4\u7684\u9010\u9879\u6620\u5c04\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u6bcf\u4e2a CVE \u5206\u522b\u7531\u54ea\u4e00\u5904\u4ee3\u7801\u4fee\u590d\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n[`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/777936?path=/sample/extension-sample/package-lock.json&_a=files) \u4e2d\u7684 `browserslist` \u7248\u672c\u3001\u79c1\u6709 npm \u6e90\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u5747\u4ece 4.24.2 \u5bf9\u5e94\u503c\u66f4\u65b0\u4e3a 4.28.8 \u5bf9\u5e94\u503c\u3002\n\n\u9501\u6587\u4ef6\u662f npm \u7684\u53ef\u590d\u73b0\u5b89\u88c5\u4f9d\u636e\u3002\u6309\u6b64\u9501\u6587\u4ef6\u5b89\u88c5\u65f6\uff0cnpm \u5c06\u91c7\u7528\u65b0\u7684\u7cbe\u786e\u7248\u672c\u548c\u54c8\u5e0c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u4f7f\u7528\u5b58\u5728\u544a\u8b66\u7684 4.24.2\u3002\u7531\u4e8e\u5206\u6790\u5305\u672a\u5305\u542b `package.json`\uff0c\u65e0\u6cd5\u786e\u8ba4\u9876\u5c42\u7248\u672c\u8303\u56f4\u6216\u5176\u4ed6\u89e3\u6790\u89c4\u5219\u4e3a\u4f55\u65e0\u9700\u540c\u6b65\u4fee\u6539\u3002\u8be5\u5305\u88ab\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u56e0\u6b64\u4e3b\u8981\u5f71\u54cd\u6784\u5efa\u3001\u8f6c\u8bd1\u3001CSS/JavaScript \u76ee\u6807\u73af\u5883\u8ba1\u7b97\u7b49\u5f00\u53d1\u6216\u6784\u5efa\u9636\u6bb5\uff0c\u800c\u4e0d\u662f\u4f5c\u4e3a\u5e94\u7528\u4e1a\u52a1\u4ee3\u7801\u76f4\u63a5\u52a0\u8f7d\u3002\n\n### 2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u94fe\u5237\u65b0\n\n`browserslist` 4.28.8 \u9700\u8981\u66f4\u65b0\u7684\u6570\u636e\u5305\u548c\u7248\u672c\u6620\u5c04\uff0c\u56e0\u6b64\u9501\u6587\u4ef6\u540c\u65f6\u5347\u7ea7\uff1a\n\n| \u4f9d\u8d56 | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528 |\n|---|---:|---:|---|\n| `caniuse-lite` | 1.0.30001687 | 1.0.30001810 | \u63d0\u4f9b\u6d4f\u89c8\u5668\u529f\u80fd\u652f\u6301\u6570\u636e |\n| `electron-to-chromium` | 1.5.72 | 1.5.416 | \u5c06 Electron \u7248\u672c\u6620\u5c04\u5230 Chromium \u7248\u672c |\n| `node-releases` | 2.0.19 | 2.0.54 | \u63d0\u4f9b Node.js \u53d1\u5e03\u7248\u672c\u6570\u636e |\n| `update-browserslist-db` | 1.1.1 | 1.3.2 | \u66f4\u65b0 Browserslist \u6570\u636e\u5e93 |\n\n\u8fd9\u4e9b\u7248\u672c\u4f1a\u5f71\u54cd Browserslist \u5bf9\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\u7684\u8ba1\u7b97\u7ed3\u679c\u3002\u5373\u4f7f\u9879\u76ee\u7684 Browserslist \u67e5\u8be2\u914d\u7f6e\u4e0d\u53d8\uff0c\u66f4\u65b0\u540e\u7684\u5e02\u573a\u6570\u636e\u3001Node/Electron \u6620\u5c04\u6216\u67e5\u8be2\u4fee\u590d\u4e5f\u53ef\u80fd\u4f7f\u6784\u5efa\u5de5\u5177\u9009\u51fa\u7565\u6709\u4e0d\u540c\u7684\u76ee\u6807\u96c6\u5408\uff0c\u8fdb\u800c\u6539\u53d8\u8f6c\u8bd1\u6216\u524d\u7f00\u5904\u7406\u7ed3\u679c\u3002\n\n### 3. Baseline \u67e5\u8be2\u652f\u6301\n\n\u65b0\u4f9d\u8d56\u56fe\u65b0\u589e `baseline-browser-mapping` 2.11.20\uff0c\u5e76\u7531 `browserslist` \u901a\u8fc7 `^2.11.12` \u5f15\u7528\u3002\u8be5\u5305\u4e3a Baseline \u6d4f\u89c8\u5668\u67e5\u8be2\u63d0\u4f9b\u6620\u5c04\u6570\u636e\u548c\u547d\u4ee4\u884c\u5165\u53e3\uff1b\u9501\u6587\u4ef6\u540c\u65f6\u8bb0\u5f55\u4e86\u5176\u8bb8\u53ef\u8bc1\u3001Node \u5f15\u64ce\u8981\u6c42\u548c\u79c1\u6709\u6e90\u5236\u54c1\u4fe1\u606f\u3002\n\n\u6b64\u65b0\u589e\u4f9d\u8d56\u89e3\u91ca\u4e86\u4e3a\u4f55\u4e00\u6b21\u770b\u4f3c\u5355\u5305\u5347\u7ea7\u4f1a\u589e\u52a0\u65b0\u7684\u9501\u6587\u4ef6\u8282\u70b9\uff1a`browserslist` \u65b0\u7248\u672c\u628a Baseline \u76f8\u5173\u80fd\u529b\u62c6\u5206\u6216\u63a5\u5165\u4e86\u4e13\u95e8\u7684\u6570\u636e\u6620\u5c04\u5305\u3002\u5305\u5185\u53ef\u89c1\u53d1\u5e03\u8bf4\u660e\u8fd8\u63d0\u5230 Baseline \u67e5\u8be2\u7684\u5927\u5c0f\u5199\u5904\u7406\u548c KaiOS \u5305\u542b\u903b\u8f91\u4fee\u590d\uff0c\u56e0\u6b64\u4f7f\u7528\u76f8\u5173\u67e5\u8be2\u65f6\uff0c\u7ed3\u679c\u53ef\u80fd\u6bd4\u65e7\u7248\u672c\u66f4\u51c6\u786e\u3002\n\n### 4. \u9501\u6587\u4ef6\u53cc\u7ed3\u6784\u540c\u6b65\n\n\u8be5\u9501\u6587\u4ef6\u540c\u65f6\u5305\u542b `node_modules/...` \u5305\u8bb0\u5f55\u548c\u8f83\u65e7\u517c\u5bb9\u7ed3\u6784\u4e2d\u7684\u4f9d\u8d56\u8bb0\u5f55\u3002\u5dee\u5f02\u5728\u4e24\u4e2a\u533a\u57df\u91cd\u590d\u66f4\u65b0\u540c\u4e00\u7ec4\u7248\u672c\u4e0e\u4f9d\u8d56\u5173\u7cfb\uff0c\u8fd9\u662f npm \u9501\u6587\u4ef6\u683c\u5f0f\u7684\u6b63\u5e38\u540c\u6b65\uff0c\u800c\u4e0d\u662f\u5b89\u88c5\u4e24\u4efd\u76f8\u540c\u4f9d\u8d56\u3002\n\n\u6b64\u5916\uff0c`update-browserslist-db` \u5bf9 `picocolors` \u7684\u7248\u672c\u8303\u56f4\u7531 `^1.1.0` \u8c03\u6574\u4e3a `^1.1.1`\uff1b\u5f53\u524d\u5dee\u5f02\u6ca1\u6709\u663e\u793a `picocolors` \u7684\u5b9e\u9645\u9501\u5b9a\u7248\u672c\u53d1\u751f\u53d8\u5316\uff0c\u56e0\u6b64\u8fd9\u91cc\u662f\u4f9d\u8d56\u58f0\u660e\u8303\u56f4\u7684\u540c\u6b65\uff0c\u800c\u4e0d\u662f\u53ef\u786e\u8ba4\u7684\u5305\u7248\u672c\u5347\u7ea7\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6b63\u9762\u5f71\u54cd\n\n- \u901a\u8fc7\u9501\u5b9a `browserslist` 4.28.8\uff0c\u9488\u5bf9 PR \u63cf\u8ff0\u5217\u51fa\u7684\u4e24\u4e2a\u9ad8\u5371\u5b89\u5168\u544a\u8b66\u5b8c\u6210\u4f9d\u8d56\u4fa7\u5347\u7ea7\u3002\n- \u83b7\u5f97\u5305\u5185\u53d1\u5e03\u8bf4\u660e\u6240\u5217\u7684\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u3001\u65e0\u754c\u5185\u5b58\u589e\u957f\u7b49\u4fee\u590d\u3002\n- \u66f4\u65b0\u6d4f\u89c8\u5668\u3001Electron \u548c Node.js \u7248\u672c\u6570\u636e\uff0c\u964d\u4f4e\u56e0\u8fc7\u671f\u517c\u5bb9\u6027\u6570\u636e\u5e93\u5bfc\u81f4\u76ee\u6807\u5224\u65ad\u4e0d\u51c6\u786e\u7684\u6982\u7387\u3002\n- \u4fee\u590d\u591a\u79cd\u67e5\u8be2\u884c\u4e3a\uff0c\u5305\u62ec Electron \u7248\u672c\u67e5\u8be2\u3001`>`/`>=` \u67e5\u8be2\u3001Baseline \u5927\u5c0f\u5199\u548c KaiOS \u76f8\u5173\u903b\u8f91\u3002\n- \u4ecd\u4ece AzureNotebooks \u7684\u5185\u90e8 npm \u6e90\u89e3\u6790\u4f9d\u8d56\uff0c\u6ca1\u6709\u6539\u53d8\u5236\u54c1\u6765\u6e90\u6a21\u578b\u3002\n\n### \u884c\u4e3a\u5f71\u54cd\n\n\u6b64 PR \u4e0d\u76f4\u63a5\u6539\u52a8\u8fd0\u884c\u65f6\u4e1a\u52a1\u903b\u8f91\uff0c\u4f46\u53ef\u80fd\u95f4\u63a5\u6539\u53d8\u6784\u5efa\u4ea7\u7269\u3002\u4efb\u4f55\u8c03\u7528 Browserslist \u7684\u5de5\u5177\uff08\u4f8b\u5982\u8f6c\u8bd1\u5668\u3001Autoprefixer \u6216\u5176\u4ed6\u524d\u7aef\u6784\u5efa\u63d2\u4ef6\uff09\u90fd\u53ef\u80fd\u56e0\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\u53d8\u5316\u800c\u751f\u6210\u4e0d\u540c\u7684\u8bed\u6cd5\u8f6c\u6362\u6216 CSS \u524d\u7f00\u3002\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u8be5\u793a\u4f8b\u7684\u6784\u5efa\u914d\u7f6e\u548c\u4ea7\u7269\u5dee\u5f02\uff0c\u56e0\u6b64\u65e0\u6cd5\u786e\u8ba4\u5b9e\u9645\u4ea7\u7269\u662f\u5426\u53d1\u751f\u53d8\u5316\u3002\n\n### \u8303\u56f4\u5f71\u54cd\n\n\u53d8\u66f4\u5c40\u9650\u4e8e `sample/extension-sample` \u7684\u9501\u6587\u4ef6\uff0c\u672a\u663e\u793a\u4ed3\u5e93\u5176\u4ed6\u793a\u4f8b\u6216\u4ea7\u54c1\u76ee\u5f55\u7684\u4f9d\u8d56\u88ab\u66f4\u65b0\u3002\u82e5\u5176\u4ed6\u76ee\u5f55\u4e5f\u5404\u81ea\u7ef4\u62a4 `browserslist` \u9501\u5b9a\u7248\u672c\uff0c\u672c PR \u4e0d\u4f1a\u81ea\u52a8\u4fee\u590d\u90a3\u4e9b\u72ec\u7acb\u4f9d\u8d56\u6811\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669 | \u5177\u4f53\u539f\u56e0 | \u5efa\u8bae\u5173\u6ce8 |\n|---|---|---|\n| Node.js \u7248\u672c\u517c\u5bb9\u6027 | \u65b0\u9501\u5b9a\u7684 `node-releases` 2.0.54 \u58f0\u660e `node >=18`\uff0c\u65e7\u7248\u672c\u5728\u5dee\u5f02\u4e2d\u6ca1\u6709\u8be5\u5f15\u64ce\u8981\u6c42 | \u82e5\u8be5\u793a\u4f8b\u6216 CI \u4ecd\u4f7f\u7528 Node 16 \u6216\u66f4\u65e9\u7248\u672c\uff0cnpm \u53ef\u80fd\u4ea7\u751f `EBADENGINE` \u8b66\u544a\uff1b\u542f\u7528 `engine-strict` \u65f6\u53ef\u80fd\u5b89\u88c5\u5931\u8d25\u3002\u5e94\u4ee5 Node 18+ \u6267\u884c\u5b89\u88c5\u9a8c\u8bc1 |\n| \u6784\u5efa\u8f93\u51fa\u53d8\u5316 | `caniuse-lite`\u3001Electron/Node \u6620\u5c04\u548c\u67e5\u8be2\u5b9e\u73b0\u5747\u8de8\u591a\u4e2a\u7248\u672c\u66f4\u65b0 | \u6bd4\u8f83\u5347\u7ea7\u524d\u540e\u7684\u76ee\u6807\u6d4f\u89c8\u5668\u5217\u8868\u4e0e\u6784\u5efa\u4ea7\u7269\uff0c\u7279\u522b\u5173\u6ce8 polyfill\u3001\u8bed\u6cd5\u964d\u7ea7\u548c CSS \u524d\u7f00\u53d8\u5316 |\n| \u67e5\u8be2\u8bed\u4e49\u53d8\u5316 | \u65b0\u7248\u672c\u4fee\u590d `>`\u3001`>=`\u3001Electron\u3001Baseline \u7b49\u67e5\u8be2 | \u5982\u679c\u914d\u7f6e\u4f9d\u8d56\u65e7\u7248\u9519\u8bef\u884c\u4e3a\uff0c\u76ee\u6807\u96c6\u5408\u53ef\u80fd\u53d8\u5316\uff1b\u5e94\u8fd0\u884c\u9879\u76ee\u5b9e\u9645\u4f7f\u7528\u7684 Browserslist \u67e5\u8be2 |\n| \u65b0\u4f20\u9012\u4f9d\u8d56 | \u65b0\u589e `baseline-browser-mapping`\uff0c\u589e\u52a0\u4e00\u4e2a\u5b89\u88c5\u8282\u70b9\u548c CLI \u5165\u53e3 | \u786e\u8ba4\u5185\u90e8\u6e90\u53ef\u6301\u7eed\u63d0\u4f9b\u8be5\u5236\u54c1\uff0c\u8bb8\u53ef\u8bc1 Apache-2.0 \u7b26\u5408\u9879\u76ee\u8981\u6c42 |\n| \u9501\u6587\u4ef6\u4e0e\u6e05\u5355\u4e00\u81f4\u6027 | \u5305\u5185\u53ea\u663e\u793a\u9501\u6587\u4ef6\u53d8\u66f4\uff0c\u672a\u663e\u793a `package.json` | \u5e94\u786e\u8ba4\u9876\u5c42\u7248\u672c\u8303\u56f4\u5141\u8bb8\u5e76\u9884\u671f\u89e3\u6790\u5230 4.28.8\uff1b\u5426\u5219\u672a\u6765\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\u53ef\u80fd\u56de\u9000\u6216\u4ea7\u751f\u4e0d\u540c\u7ed3\u679c |\n| \u5b8c\u6574\u6027\u54c8\u5e0c\u5f62\u5f0f | \u65b0\u65e7\u76f8\u5173\u5236\u54c1\u5747\u663e\u793a SHA-1 \u5f62\u5f0f\u7684 `integrity` \u503c\uff0c\u4e14\u6765\u81ea\u5185\u90e8\u6e90 | \u8fd9\u770b\u8d77\u6765\u662f\u73b0\u6709\u6e90/\u9501\u6587\u4ef6\u6a21\u5f0f\u7684\u5ef6\u7eed\uff0c\u4f46\u5b89\u5168\u5ba1\u67e5\u53ef\u786e\u8ba4\u5185\u90e8\u6e90\u662f\u5426\u8fd8\u63d0\u4f9b\u66f4\u5f3a\u7684 SRI \u54c8\u5e0c |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u6d4b\u8bd5\u6587\u4ef6\u4fee\u6539\u3001\u81ea\u52a8\u5316\u6d4b\u8bd5\u7ed3\u679c\u3001\u6784\u5efa\u65e5\u5fd7\u6216\u7b56\u7565\u68c0\u67e5\u8be6\u60c5\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u6d4b\u8bd5\u5df2\u7ecf\u901a\u8fc7\u3002`mergeStatus: succeeded` \u4ec5\u8868\u660e\u5305\u4e2d\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u6210\u529f\uff0c\u4e0d\u80fd\u66ff\u4ee3\u6784\u5efa\u548c\u6d4b\u8bd5\u8bc1\u636e\u3002\n\n\u9488\u5bf9\u672c\u6b21\u53d8\u66f4\uff0c\u6700\u6709\u4ef7\u503c\u7684\u9a8c\u8bc1\u5305\u62ec\uff1a\n\n1. \u5728\u4ed3\u5e93\u652f\u6301\u7684 Node.js \u7248\u672c\u4e0a\u5bf9 `sample/extension-sample` \u6267\u884c\u5e72\u51c0\u7684\u9501\u6587\u4ef6\u5b89\u88c5\uff0c\u786e\u8ba4\u5185\u90e8 npm \u6e90\u53ef\u89e3\u6790\u6240\u6709\u65b0\u7248\u672c\uff1b\u5c24\u5176\u5e94\u8986\u76d6 Node 18+\uff0c\u5e76\u68c0\u67e5\u65e7\u7248 Node \u662f\u5426\u51fa\u73b0\u5f15\u64ce\u9519\u8bef\u3002\n2. \u8fd0\u884c\u8be5\u793a\u4f8b\u73b0\u6709\u7684\u6784\u5efa\u548c\u6d4b\u8bd5\u547d\u4ee4\uff0c\u786e\u8ba4\u4f7f\u7528\u65b0\u7248 Browserslist \u540e\u65e0\u914d\u7f6e\u89e3\u6790\u9519\u8bef\u3002\n3. \u8f93\u51fa\u5e76\u6bd4\u8f83\u9879\u76ee\u5b9e\u9645 Browserslist \u67e5\u8be2\u7684\u89e3\u6790\u7ed3\u679c\uff0c\u786e\u8ba4\u76ee\u6807\u6d4f\u89c8\u5668\u53d8\u5316\u7b26\u5408\u9884\u671f\u3002\n4. \u82e5\u8be5\u793a\u4f8b\u751f\u6210\u524d\u7aef\u5305\uff0c\u6bd4\u8f83\u5173\u952e\u6784\u5efa\u4ea7\u7269\uff0c\u68c0\u67e5\u8f6c\u8bd1\u7ea7\u522b\u3001CSS \u524d\u7f00\u548c\u5305\u4f53\u79ef\u662f\u5426\u51fa\u73b0\u975e\u9884\u671f\u53d8\u5316\u3002\n5. \u5728\u7ec4\u4ef6\u6cbb\u7406\u626b\u63cf\u4e2d\u786e\u8ba4 CVE-2026-73088 \u548c CVE-2026-73089 \u544a\u8b66\u5747\u5df2\u6d88\u9664\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\n\n- \u5206\u6790\u5305\u58f0\u660e\u5171\u6709 1 \u4e2a\u53d8\u66f4\u6587\u4ef6\uff0c\u4e14\u63d0\u4f9b\u4e86\u8be5\u6587\u4ef6\u7684\u5dee\u5f02\uff1b\u6587\u4ef6\u7ea7 `truncated` \u548c\u5168\u5c40 `diffTruncated` \u5747\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u4e2d\u5217\u51fa\u7684 **1/1 \u4e2a\u6587\u4ef6\u5dee\u5f02**\uff0c\u6ca1\u6709\u5df2\u77e5\u7684\u622a\u65ad\u5dee\u5f02\u7f3a\u53e3\u3002\n- \u5dee\u5f02\u7531 `git-local` \u65b9\u6cd5\u751f\u6210\uff0c\u603b\u8ba1 9,598 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5305\u8bb0\u5f55\u7684\u5355\u6587\u4ef6\u548c\u603b\u4f53\u622a\u65ad\u4e0a\u9650\u3002\n- PR \u63cf\u8ff0\u4e2d\u7684\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u6587\u672c\u5728\u53ef\u89c1\u5185\u5bb9\u672b\u5c3e\u4ee5\u7701\u7565\u5f62\u5f0f\u4e2d\u65ad\uff0c\u56e0\u6b64\u672c\u6587\u53ea\u91c7\u7528\u5305\u5185\u660e\u786e\u53ef\u89c1\u7684\u53d1\u5e03\u8bf4\u660e\u6761\u76ee\uff0c\u6ca1\u6709\u63a8\u65ad\u672a\u63d0\u4f9b\u7684\u540e\u7eed\u7248\u672c\u8bf4\u660e\u3002\n- \u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u5b9e\u9645\u6e90\u7801\u3001`package.json` \u5185\u5bb9\u3001\u6784\u5efa\u914d\u7f6e\u3001\u6d4b\u8bd5\u7ed3\u679c\u6216\u5b8c\u6574\u7b56\u7565\u72b6\u6001\uff1b\u4e0e\u8fd9\u4e9b\u5185\u5bb9\u6709\u5173\u7684\u7ed3\u8bba\u5747\u9650\u5b9a\u4e3a\u98ce\u9669\u6216\u5efa\u8bae\uff0c\u800c\u975e\u5df2\u9a8c\u8bc1\u4e8b\u5b9e\u3002\n", "creation_timestamp": "2026-09-05T16:13:11.860022Z"}, {"uuid": "3d64e462-1ba8-4b36-9554-90c4279e9d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73088", "type": "seen", "source": "https://gist.github.com/djlan/cceed0d99bfb6e25cf9c9ac2042ad728", "content": "# [\u5b89\u5168\u66f4\u65b0] \u5c06 `/sample/angular-host-app` \u4e2d\u7684 browserslist \u4ece 4.28.1 \u5347\u7ea7\u5230 4.28.8\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 Angular \u793a\u4f8b\u5bbf\u4e3b\u5e94\u7528\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06 `browserslist` \u53ca\u5176\u6d4f\u89c8\u5668\u6570\u636e\u76f8\u5173\u4f20\u9012\u4f9d\u8d56\u5347\u7ea7\u5230\u8f83\u65b0\u7248\u672c\uff0c\u4ee5\u4fee\u590d\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u53ef\u80fd\u63d0\u9ad8\u6784\u5efa\u73af\u5883\u6240\u9700\u7684\u6700\u4f4e Node.js \u7248\u672c\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 778333](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | \u6d3b\u8dc3\uff08\u975e\u8349\u7a3f\uff09\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\uff0c\u8868\u793a\u5f53\u524d\u53ef\u5408\u5e76\u6027\u68c0\u67e5\u6210\u529f\uff0c\u5e76\u4e0d\u4ee3\u8868\u5df2\u7ecf\u5408\u5e76 |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fangular-host-app/browserslist-4.28.8-757402` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-09-05 09:35:06 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 1 |\n| \u53d8\u66f4\u6587\u4ef6 | 1 |\n| \u5dee\u5f02\u7edf\u8ba1 | 31 \u884c\u65b0\u589e\uff0c25 \u884c\u5220\u9664\uff08\u6839\u636e\u5305\u5185 diff \u7edf\u8ba1\uff09 |\n| \u5dee\u5f02\u6765\u6e90 | `git-local` |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n6. [\u5206\u6790\u8986\u76d6\u8303\u56f4](#\u5206\u6790\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5\u53d8\u66f4\u7531 Dependabot \u521b\u5efa\uff0c\u76ee\u6807\u662f\u5904\u7406 Component Governance \u62a5\u544a\u7684\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027\u5b89\u5168\u544a\u8b66\uff1a`CVE-2026-73088` \u548c `CVE-2026-73089`\u3002\u5305\u5185\u4fe1\u606f\u8868\u660e\uff0c\u6838\u5fc3\u5347\u7ea7\u662f\u5c06 `browserslist` \u4ece `4.28.1` \u63d0\u5347\u5230 `4.28.8`\u3002\n\n\u552f\u4e00\u4fee\u6539\u7684\u6587\u4ef6\u662f [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333?path=/sample/angular-host-app/package-lock.json&_a=files)\u3002\u6ca1\u6709\u5e94\u7528\u6e90\u4ee3\u7801\u3001\u914d\u7f6e\u6e90\u7801\u6216\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\uff1b\u6b64\u6b21 PR \u901a\u8fc7\u66f4\u65b0\u9501\u6587\u4ef6\u56fa\u5b9a\u65b0\u7684\u4f9d\u8d56\u89e3\u6790\u7ed3\u679c\uff0c\u4f7f\u540e\u7eed\u4f7f\u7528\u9501\u6587\u4ef6\u5b89\u88c5\u4f9d\u8d56\u65f6\u83b7\u53d6\u4fee\u590d\u540e\u7684\u7248\u672c\u53ca\u914d\u5957\u6d4f\u89c8\u5668\u6570\u636e\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n[`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333?path=/sample/angular-host-app/package-lock.json&_a=files) \u5c06 `browserslist` \u4ece `4.28.1` \u5347\u7ea7\u81f3 `4.28.8`\uff0c\u5e76\u540c\u6b65\u66ff\u6362\u5185\u90e8 Azure Artifacts npm \u6e90\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u3002\n\n`browserslist` \u901a\u5e38\u7531\u524d\u7aef\u6784\u5efa\u5de5\u5177\u7528\u4e8e\u628a\u76ee\u6807\u6d4f\u89c8\u5668\u67e5\u8be2\u8f6c\u6362\u4e3a\u5177\u4f53\u6d4f\u89c8\u5668\u7248\u672c\u96c6\u5408\uff0c\u8fdb\u800c\u5f71\u54cd Babel\u3001Autoprefixer \u7b49\u5de5\u5177\u7684\u8f6c\u8bd1\u6216 CSS \u517c\u5bb9\u5904\u7406\u3002\u672c\u6b21\u5347\u7ea7\u7684\u4e3b\u8981\u52a8\u673a\u662f\u5b89\u5168\u4fee\u590d\uff1b\u5305\u5185 release notes \u8fd8\u660e\u786e\u63d0\u5230\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u95ee\u9898\u548c\u65e0\u754c\u5185\u5b58\u589e\u957f\u7b49\u4fee\u590d\u3002\u56e0\u6b64\uff0c\u65b0\u9501\u6587\u4ef6\u4f1a\u8ba9\u786e\u5b9a\u6027\u5b89\u88c5\u89e3\u6790\u5230\u5305\u542b\u8fd9\u4e9b\u4fee\u590d\u7684\u7248\u672c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u4f7f\u7528 `4.28.1`\u3002\n\n### 2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u94fe\u66f4\u65b0\n\n\u4e3a\u6ee1\u8db3\u65b0\u7248 `browserslist` \u7684\u4f9d\u8d56\u8303\u56f4\uff0c\u9501\u6587\u4ef6\u540c\u6b65\u66f4\u65b0\u4e86\u4ee5\u4e0b\u4f20\u9012\u4f9d\u8d56\uff1a\n\n| \u4f9d\u8d56 | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528\u4e0e\u53d8\u5316\u542b\u4e49 |\n|---|---:|---:|---|\n| `baseline-browser-mapping` | 2.9.15 | 2.11.20 | \u63d0\u4f9b Web Platform Baseline \u4e0e\u6d4f\u89c8\u5668\u7248\u672c\u6620\u5c04\uff1b\u547d\u4ee4\u5165\u53e3\u7531 `dist/cli.js` \u6539\u4e3a `dist/cli.cjs`\uff0c\u5e76\u65b0\u589e `node >=6.0.0` \u58f0\u660e |\n| `caniuse-lite` | 1.0.30001787 | 1.0.30001810 | \u66f4\u65b0\u6d4f\u89c8\u5668\u529f\u80fd\u652f\u6301\u6570\u636e\uff0c\u53ef\u80fd\u4f7f\u76f8\u540c\u67e5\u8be2\u5f97\u5230\u66f4\u65b0\u540e\u7684\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408 |\n| `electron-to-chromium` | 1.5.267 | 1.5.416 | \u66f4\u65b0 Electron \u4e0e Chromium \u7248\u672c\u6620\u5c04 |\n| `node-releases` | 2.0.27 | 2.0.54 | \u66f4\u65b0 Node.js \u53d1\u5e03\u7248\u672c\u6570\u636e\uff0c\u5e76\u65b0\u589e `node >=18` \u5f15\u64ce\u8981\u6c42 |\n| `update-browserslist-db` | 1.2.3 | 1.3.2 | \u66f4\u65b0 browserslist \u6570\u636e\u5e93\u7ef4\u62a4\u5de5\u5177 |\n\n\u8fd9\u4e9b\u66f4\u65b0\u5e76\u975e\u72ec\u7acb\u529f\u80fd\u5f00\u53d1\uff0c\u800c\u662f `browserslist 4.28.8` \u65b0\u4f9d\u8d56\u7ea6\u675f\u6240\u4ea7\u751f\u7684\u9501\u6587\u4ef6\u89e3\u6790\u7ed3\u679c\u3002\u5b83\u4eec\u5171\u540c\u786e\u4fdd\u6d4f\u89c8\u5668\u67e5\u8be2\u3001\u5b89\u5168\u4fee\u590d\u548c\u7248\u672c\u6570\u636e\u5904\u4e8e\u76f8\u4e92\u517c\u5bb9\u7684\u4e00\u7ec4\u7248\u672c\u3002\n\n### 3. \u5b89\u88c5\u53ef\u91cd\u590d\u6027\u4e0e\u5236\u54c1\u6765\u6e90\n\n\u9501\u6587\u4ef6\u4e2d\u7684\u6bcf\u4e2a\u5347\u7ea7\u5305\u90fd\u540c\u6b65\u66f4\u65b0\u4e86 `resolved` \u548c `integrity`\u3002`resolved` \u4ecd\u6307\u5411\u4ed3\u5e93\u73b0\u6709\u7684\u5185\u90e8 Azure Artifacts feed\uff0c\u56e0\u6b64\u6ca1\u6709\u89c2\u5bdf\u5230\u5207\u6362\u5230\u516c\u5171 npm \u6e90\u7684\u884c\u4e3a\uff1b\u65b0\u7684\u5b8c\u6574\u6027\u54c8\u5e0c\u5219\u7528\u4e8e\u6821\u9a8c\u4e0b\u8f7d\u5230\u7684 tarball \u4e0e\u9501\u5b9a\u5236\u54c1\u4e00\u81f4\u3002\n\n\u7531\u4e8e\u5305\u5185\u6ca1\u6709\u5305\u542b `package.json` \u7684\u4fee\u6539\u6216\u5185\u5bb9\uff0c\u65e0\u6cd5\u786e\u8ba4 `browserslist` \u662f\u76f4\u63a5\u4f9d\u8d56\u8fd8\u662f\u7531\u5176\u4ed6\u5de5\u5177\u5f15\u5165\u7684\u4f20\u9012\u4f9d\u8d56\uff0c\u4e5f\u65e0\u6cd5\u4ece\u672c\u5206\u6790\u5305\u5224\u65ad\u5176\u58f0\u660e\u7248\u672c\u8303\u56f4\u3002\u53ef\u4ee5\u786e\u8ba4\u7684\u662f\uff0c\u63d0\u4ea4\u540e\u7684\u9501\u5b9a\u5b89\u88c5\u7ed3\u679c\u4f1a\u4f7f\u7528 `4.28.8`\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6784\u5efa\u4e0e\u4ea7\u7269\n\n- \u8fd0\u884c\u65f6\u4e1a\u52a1\u903b\u8f91\u6ca1\u6709\u76f4\u63a5\u53d8\u66f4\uff0c\u5f71\u54cd\u96c6\u4e2d\u5728\u4f9d\u8d56\u5b89\u88c5\u548c\u524d\u7aef\u6784\u5efa\u9636\u6bb5\u3002\n- \u66f4\u65b0\u540e\u7684 `caniuse-lite`\u3001`electron-to-chromium` \u548c `node-releases` \u6570\u636e\u53ef\u80fd\u6539\u53d8 browserslist \u67e5\u8be2\u89e3\u6790\u51fa\u7684\u5177\u4f53\u76ee\u6807\u7248\u672c\uff0c\u56e0\u6b64\u6700\u7ec8 JavaScript \u8f6c\u8bd1\u6216 CSS \u524d\u7f00\u7ed3\u679c\u53ef\u80fd\u51fa\u73b0\u5c0f\u5e45\u53d8\u5316\u3002\n- `baseline-browser-mapping` \u4fee\u590d\u4e86 Baseline\u3001KaiOS \u548c\u5927\u5c0f\u5199\u76f8\u5173\u67e5\u8be2\u95ee\u9898\uff1b\u5982\u679c\u9879\u76ee\u4f7f\u7528\u8fd9\u4e9b\u67e5\u8be2\uff0c\u65b0\u7248\u672c\u53ef\u80fd\u4ea7\u751f\u6bd4\u65e7\u7248\u672c\u66f4\u51c6\u786e\u4f46\u4e0d\u540c\u7684\u7ed3\u679c\u3002\n\n### \u5b89\u5168\n\n- PR \u660e\u786e\u9488\u5bf9\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027 CG \u544a\u8b66\uff0c\u5e76\u5347\u7ea7\u5230\u5305\u542b\u76f8\u5173\u5b89\u5168\u4fee\u590d\u7684\u7248\u672c\u3002\n- \u5305\u5185\u6ca1\u6709\u6f0f\u6d1e\u5229\u7528\u8def\u5f84\u3001\u53d7\u5f71\u54cd\u8c03\u7528\u70b9\u6216\u4fee\u590d\u63d0\u4ea4\u7684\u5b8c\u6574\u5185\u5bb9\uff0c\u56e0\u6b64\u4e0d\u80fd\u4ec5\u51ed\u8be5\u5305\u65ad\u8a00\u5e94\u7528\u6b64\u524d\u53ef\u88ab\u5b9e\u9645\u5229\u7528\uff0c\u4e5f\u4e0d\u80fd\u72ec\u7acb\u8bc1\u660e\u4e24\u4e2a CVE \u5df2\u5728\u6240\u6709\u4f9d\u8d56\u8def\u5f84\u4e0a\u5b8c\u5168\u6d88\u9664\uff1b\u5e94\u4ee5\u5408\u5e76\u540e\u7684 CG/\u4f9d\u8d56\u626b\u63cf\u7ed3\u679c\u4e3a\u51c6\u3002\n\n### \u8fd0\u7ef4\u4e0e\u5f00\u53d1\u73af\u5883\n\n- \u4f9d\u8d56\u4ecd\u6765\u81ea\u65e2\u6709\u5185\u90e8 feed\uff0c\u5236\u54c1\u6765\u6e90\u6a21\u5f0f\u672a\u6539\u53d8\u3002\n- `node-releases 2.0.54` \u58f0\u660e `node >=18`\uff0c\u8fd9\u662f\u672c\u6b21\u53d8\u66f4\u6700\u5177\u4f53\u7684\u73af\u5883\u517c\u5bb9\u6027\u98ce\u9669\u3002\u82e5 CI\u3001\u5f00\u53d1\u673a\u6216\u793a\u4f8b\u6784\u5efa\u4ecd\u4f7f\u7528 Node.js 16 \u6216\u66f4\u65e9\u7248\u672c\uff0cnpm \u53ef\u80fd\u53d1\u51fa `EBADENGINE` \u8b66\u544a\uff1b\u5728\u542f\u7528\u4e25\u683c engine \u6821\u9a8c\u65f6\uff0c\u5b89\u88c5\u53ef\u80fd\u76f4\u63a5\u5931\u8d25\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9\n\n| \u98ce\u9669 | \u5177\u4f53\u8868\u73b0 | \u5efa\u8bae |\n|---|---|---|\n| Node.js \u6700\u4f4e\u7248\u672c\u53d8\u5316 | \u65b0\u9501\u5b9a\u7684 `node-releases` \u8981\u6c42 Node.js 18 \u6216\u66f4\u9ad8\uff1b\u65e7\u6784\u5efa\u4ee3\u7406\u53ef\u80fd\u8b66\u544a\u6216\u5b89\u88c5\u5931\u8d25 | \u786e\u8ba4 Angular \u793a\u4f8b\u53ca\u5176 CI \u4f7f\u7528 Node.js 18+\uff0c\u5e76\u68c0\u67e5\u662f\u5426\u542f\u7528\u4e86 `engine-strict` |\n| \u6d4f\u89c8\u5668\u76ee\u6807\u96c6\u5408\u53d8\u5316 | \u65b0\u7248\u517c\u5bb9\u6027\u6570\u636e\u5e93\u53ef\u80fd\u8ba9\u76f8\u540c browserslist \u67e5\u8be2\u8fd4\u56de\u4e0d\u540c\u6d4f\u89c8\u5668\u7248\u672c | \u5bf9\u6bd4\u5347\u7ea7\u524d\u540e\u7684 browserslist \u8f93\u51fa\uff0c\u5e76\u68c0\u67e5\u6784\u5efa\u4ea7\u7269\u6216\u5feb\u7167\u662f\u5426\u53d1\u751f\u9884\u671f\u5916\u53d8\u5316 |\n| CLI \u5165\u53e3\u53d8\u5316 | `baseline-browser-mapping` \u7684 bin \u4ece `dist/cli.js` \u6539\u4e3a `dist/cli.cjs` | \u82e5\u811a\u672c\u7ed5\u8fc7\u5305\u7684 bin \u6620\u5c04\u5e76\u76f4\u63a5\u5f15\u7528\u65e7\u8def\u5f84\uff0c\u4f1a\u5931\u6548\uff1b\u5305\u5185\u672a\u63d0\u4f9b\u76f8\u5173\u811a\u672c\u5185\u5bb9\uff0c\u65e0\u6cd5\u786e\u8ba4\u662f\u5426\u5b58\u5728\u6b64\u7528\u6cd5 |\n| \u4ec5\u9501\u6587\u4ef6\u53d8\u66f4 | \u5305\u5185\u6ca1\u6709 `package.json` \u53d8\u66f4\uff0c\u65e0\u6cd5\u786e\u8ba4\u58f0\u660e\u8303\u56f4\u662f\u5426\u5141\u8bb8\u6216\u7a33\u5b9a\u5730\u4ea7\u751f\u6b64\u89e3\u6790\u7ed3\u679c | \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 npm \u7248\u672c\u6267\u884c\u5e72\u51c0\u5b89\u88c5\uff0c\u5e76\u786e\u8ba4\u9501\u6587\u4ef6\u4e0d\u4f1a\u88ab\u518d\u6b21\u6539\u5199 |\n| \u5b89\u5168\u4fee\u590d\u9a8c\u8bc1\u4e0d\u8db3 | \u63cf\u8ff0\u5217\u51fa CVE\uff0c\u4f46\u5305\u5185\u6ca1\u6709 CG \u590d\u626b\u7ed3\u679c\u6216\u6f0f\u6d1e\u7ec6\u8282 | \u5408\u5e76\u524d\u786e\u8ba4 CG \u544a\u8b66\u5728\u8be5\u5206\u652f\u4e0a\u5df2\u6e05\u9664\uff0c\u5e76\u68c0\u67e5\u662f\u5426\u4ecd\u5b58\u5728\u5176\u4ed6\u8def\u5f84\u9501\u5b9a\u65e7\u7248\u672c |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u6d4b\u8bd5\u53d8\u66f4\u3001\u6d4b\u8bd5\u6267\u884c\u8bb0\u5f55\u3001CI \u6784\u5efa\u7ed3\u679c\u6216 Component Governance \u590d\u626b\u7ed3\u679c\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u672c PR \u5df2\u901a\u8fc7\u6d4b\u8bd5\u3002\u5efa\u8bae\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n1. \u5728\u9879\u76ee\u652f\u6301\u7684\u6700\u4f4e Node.js \u7248\u672c\u4ee5\u53ca Node.js 18+ \u73af\u5883\u4e2d\u6267\u884c\u9501\u6587\u4ef6\u9a71\u52a8\u7684\u5e72\u51c0\u5b89\u88c5\uff0c\u786e\u8ba4\u6ca1\u6709 engine \u6216\u5b8c\u6574\u6027\u9519\u8bef\u3002\n2. \u6784\u5efa `/sample/angular-host-app`\uff0c\u786e\u8ba4 Angular\u3001Babel/PostCSS \u7b49\u4f9d\u8d56 browserslist \u7684\u5de5\u5177\u94fe\u6b63\u5e38\u5de5\u4f5c\u3002\n3. \u8fd0\u884c\u8be5\u793a\u4f8b\u73b0\u6709\u7684\u5355\u5143\u6d4b\u8bd5\u3001lint \u548c\u7aef\u5230\u7aef\u6d4b\u8bd5\uff08\u5982\u679c\u4ed3\u5e93\u5df2\u6709\u5bf9\u5e94\u547d\u4ee4\uff09\u3002\n4. \u8f93\u51fa\u5e76\u6bd4\u8f83\u9879\u76ee browserslist \u67e5\u8be2\u7ed3\u679c\uff0c\u786e\u8ba4\u76ee\u6807\u6d4f\u89c8\u5668\u53d8\u5316\u7b26\u5408\u9884\u671f\u3002\n5. \u91cd\u65b0\u8fd0\u884c CG/\u4f9d\u8d56\u5b89\u5168\u626b\u63cf\uff0c\u786e\u8ba4 `CVE-2026-73088` \u548c `CVE-2026-73089` \u544a\u8b66\u5df2\u89e3\u51b3\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\n\n- \u5305\u5185\u5217\u51fa\u7684 1 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u6709 diff\uff0c\u4e14\u6587\u4ef6\u7ea7 `truncated` \u4e3a `false`\uff1b\u603b\u4f53 `diffTruncated` \u4e5f\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5206\u6790\u5305\u63d0\u4f9b\u7684\u5168\u90e8\u4ee3\u7801\u5dee\u5f02\u3002\n- diff \u5927\u5c0f\u4e3a 5,054 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5305\u8bb0\u5f55\u7684\u603b\u5dee\u5f02\u4e0a\u9650 524,288 \u5b57\u8282\u548c\u5355\u6587\u4ef6\u4e0a\u9650 65,536 \u5b57\u8282\u3002\n- PR \u63cf\u8ff0\u4e2d\u7684\u4e0a\u6e38 changelog \u6587\u672c\u4ee5 `https://gith...` \u7ed3\u675f\uff0c\u660e\u663e\u672a\u5b8c\u6574\u5305\u542b\u5728\u5305\u4e2d\u3002\u672c\u6587\u53ea\u4f7f\u7528\u4e86\u5305\u5185\u53ef\u89c1\u7684 release notes \u6458\u8981\uff0c\u6ca1\u6709\u58f0\u79f0\u5206\u6790\u88ab\u7701\u7565\u7684 changelog\u3001\u4e0a\u6e38\u63d0\u4ea4\u6216\u5b8c\u6574 CVE \u6280\u672f\u7ec6\u8282\u3002\n- \u5305\u5185\u6ca1\u6709 `package.json` \u5185\u5bb9\u3001\u6784\u5efa\u65e5\u5fd7\u3001\u6d4b\u8bd5\u7ed3\u679c\u3001\u7b56\u7565\u68c0\u67e5\u8be6\u60c5\u6216\u5b8c\u6574\u6f0f\u6d1e\u62a5\u544a\uff1b\u76f8\u5173\u7ed3\u8bba\u5747\u6309\u4e0a\u8ff0\u9650\u5236\u8868\u8ff0\u3002\n", "creation_timestamp": "2026-09-05T16:19:59.162776Z"}, {"uuid": "abfa3ae4-5d2d-4c97-a96c-3cf030e04961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73089", "type": "seen", "source": "https://gist.github.com/djlan/cceed0d99bfb6e25cf9c9ac2042ad728", "content": "# [\u5b89\u5168\u66f4\u65b0] \u5c06 `/sample/angular-host-app` \u4e2d\u7684 browserslist \u4ece 4.28.1 \u5347\u7ea7\u5230 4.28.8\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 Angular \u793a\u4f8b\u5bbf\u4e3b\u5e94\u7528\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06 `browserslist` \u53ca\u5176\u6d4f\u89c8\u5668\u6570\u636e\u76f8\u5173\u4f20\u9012\u4f9d\u8d56\u5347\u7ea7\u5230\u8f83\u65b0\u7248\u672c\uff0c\u4ee5\u4fee\u590d\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u53ef\u80fd\u63d0\u9ad8\u6784\u5efa\u73af\u5883\u6240\u9700\u7684\u6700\u4f4e Node.js \u7248\u672c\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 778333](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | \u6d3b\u8dc3\uff08\u975e\u8349\u7a3f\uff09\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\uff0c\u8868\u793a\u5f53\u524d\u53ef\u5408\u5e76\u6027\u68c0\u67e5\u6210\u529f\uff0c\u5e76\u4e0d\u4ee3\u8868\u5df2\u7ecf\u5408\u5e76 |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fangular-host-app/browserslist-4.28.8-757402` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-09-05 09:35:06 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 1 |\n| \u53d8\u66f4\u6587\u4ef6 | 1 |\n| \u5dee\u5f02\u7edf\u8ba1 | 31 \u884c\u65b0\u589e\uff0c25 \u884c\u5220\u9664\uff08\u6839\u636e\u5305\u5185 diff \u7edf\u8ba1\uff09 |\n| \u5dee\u5f02\u6765\u6e90 | `git-local` |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n6. [\u5206\u6790\u8986\u76d6\u8303\u56f4](#\u5206\u6790\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5\u53d8\u66f4\u7531 Dependabot \u521b\u5efa\uff0c\u76ee\u6807\u662f\u5904\u7406 Component Governance \u62a5\u544a\u7684\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027\u5b89\u5168\u544a\u8b66\uff1a`CVE-2026-73088` \u548c `CVE-2026-73089`\u3002\u5305\u5185\u4fe1\u606f\u8868\u660e\uff0c\u6838\u5fc3\u5347\u7ea7\u662f\u5c06 `browserslist` \u4ece `4.28.1` \u63d0\u5347\u5230 `4.28.8`\u3002\n\n\u552f\u4e00\u4fee\u6539\u7684\u6587\u4ef6\u662f [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333?path=/sample/angular-host-app/package-lock.json&_a=files)\u3002\u6ca1\u6709\u5e94\u7528\u6e90\u4ee3\u7801\u3001\u914d\u7f6e\u6e90\u7801\u6216\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\uff1b\u6b64\u6b21 PR \u901a\u8fc7\u66f4\u65b0\u9501\u6587\u4ef6\u56fa\u5b9a\u65b0\u7684\u4f9d\u8d56\u89e3\u6790\u7ed3\u679c\uff0c\u4f7f\u540e\u7eed\u4f7f\u7528\u9501\u6587\u4ef6\u5b89\u88c5\u4f9d\u8d56\u65f6\u83b7\u53d6\u4fee\u590d\u540e\u7684\u7248\u672c\u53ca\u914d\u5957\u6d4f\u89c8\u5668\u6570\u636e\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n[`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778333?path=/sample/angular-host-app/package-lock.json&_a=files) \u5c06 `browserslist` \u4ece `4.28.1` \u5347\u7ea7\u81f3 `4.28.8`\uff0c\u5e76\u540c\u6b65\u66ff\u6362\u5185\u90e8 Azure Artifacts npm \u6e90\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u3002\n\n`browserslist` \u901a\u5e38\u7531\u524d\u7aef\u6784\u5efa\u5de5\u5177\u7528\u4e8e\u628a\u76ee\u6807\u6d4f\u89c8\u5668\u67e5\u8be2\u8f6c\u6362\u4e3a\u5177\u4f53\u6d4f\u89c8\u5668\u7248\u672c\u96c6\u5408\uff0c\u8fdb\u800c\u5f71\u54cd Babel\u3001Autoprefixer \u7b49\u5de5\u5177\u7684\u8f6c\u8bd1\u6216 CSS \u517c\u5bb9\u5904\u7406\u3002\u672c\u6b21\u5347\u7ea7\u7684\u4e3b\u8981\u52a8\u673a\u662f\u5b89\u5168\u4fee\u590d\uff1b\u5305\u5185 release notes \u8fd8\u660e\u786e\u63d0\u5230\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u95ee\u9898\u548c\u65e0\u754c\u5185\u5b58\u589e\u957f\u7b49\u4fee\u590d\u3002\u56e0\u6b64\uff0c\u65b0\u9501\u6587\u4ef6\u4f1a\u8ba9\u786e\u5b9a\u6027\u5b89\u88c5\u89e3\u6790\u5230\u5305\u542b\u8fd9\u4e9b\u4fee\u590d\u7684\u7248\u672c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u4f7f\u7528 `4.28.1`\u3002\n\n### 2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u94fe\u66f4\u65b0\n\n\u4e3a\u6ee1\u8db3\u65b0\u7248 `browserslist` \u7684\u4f9d\u8d56\u8303\u56f4\uff0c\u9501\u6587\u4ef6\u540c\u6b65\u66f4\u65b0\u4e86\u4ee5\u4e0b\u4f20\u9012\u4f9d\u8d56\uff1a\n\n| \u4f9d\u8d56 | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528\u4e0e\u53d8\u5316\u542b\u4e49 |\n|---|---:|---:|---|\n| `baseline-browser-mapping` | 2.9.15 | 2.11.20 | \u63d0\u4f9b Web Platform Baseline \u4e0e\u6d4f\u89c8\u5668\u7248\u672c\u6620\u5c04\uff1b\u547d\u4ee4\u5165\u53e3\u7531 `dist/cli.js` \u6539\u4e3a `dist/cli.cjs`\uff0c\u5e76\u65b0\u589e `node >=6.0.0` \u58f0\u660e |\n| `caniuse-lite` | 1.0.30001787 | 1.0.30001810 | \u66f4\u65b0\u6d4f\u89c8\u5668\u529f\u80fd\u652f\u6301\u6570\u636e\uff0c\u53ef\u80fd\u4f7f\u76f8\u540c\u67e5\u8be2\u5f97\u5230\u66f4\u65b0\u540e\u7684\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408 |\n| `electron-to-chromium` | 1.5.267 | 1.5.416 | \u66f4\u65b0 Electron \u4e0e Chromium \u7248\u672c\u6620\u5c04 |\n| `node-releases` | 2.0.27 | 2.0.54 | \u66f4\u65b0 Node.js \u53d1\u5e03\u7248\u672c\u6570\u636e\uff0c\u5e76\u65b0\u589e `node >=18` \u5f15\u64ce\u8981\u6c42 |\n| `update-browserslist-db` | 1.2.3 | 1.3.2 | \u66f4\u65b0 browserslist \u6570\u636e\u5e93\u7ef4\u62a4\u5de5\u5177 |\n\n\u8fd9\u4e9b\u66f4\u65b0\u5e76\u975e\u72ec\u7acb\u529f\u80fd\u5f00\u53d1\uff0c\u800c\u662f `browserslist 4.28.8` \u65b0\u4f9d\u8d56\u7ea6\u675f\u6240\u4ea7\u751f\u7684\u9501\u6587\u4ef6\u89e3\u6790\u7ed3\u679c\u3002\u5b83\u4eec\u5171\u540c\u786e\u4fdd\u6d4f\u89c8\u5668\u67e5\u8be2\u3001\u5b89\u5168\u4fee\u590d\u548c\u7248\u672c\u6570\u636e\u5904\u4e8e\u76f8\u4e92\u517c\u5bb9\u7684\u4e00\u7ec4\u7248\u672c\u3002\n\n### 3. \u5b89\u88c5\u53ef\u91cd\u590d\u6027\u4e0e\u5236\u54c1\u6765\u6e90\n\n\u9501\u6587\u4ef6\u4e2d\u7684\u6bcf\u4e2a\u5347\u7ea7\u5305\u90fd\u540c\u6b65\u66f4\u65b0\u4e86 `resolved` \u548c `integrity`\u3002`resolved` \u4ecd\u6307\u5411\u4ed3\u5e93\u73b0\u6709\u7684\u5185\u90e8 Azure Artifacts feed\uff0c\u56e0\u6b64\u6ca1\u6709\u89c2\u5bdf\u5230\u5207\u6362\u5230\u516c\u5171 npm \u6e90\u7684\u884c\u4e3a\uff1b\u65b0\u7684\u5b8c\u6574\u6027\u54c8\u5e0c\u5219\u7528\u4e8e\u6821\u9a8c\u4e0b\u8f7d\u5230\u7684 tarball \u4e0e\u9501\u5b9a\u5236\u54c1\u4e00\u81f4\u3002\n\n\u7531\u4e8e\u5305\u5185\u6ca1\u6709\u5305\u542b `package.json` \u7684\u4fee\u6539\u6216\u5185\u5bb9\uff0c\u65e0\u6cd5\u786e\u8ba4 `browserslist` \u662f\u76f4\u63a5\u4f9d\u8d56\u8fd8\u662f\u7531\u5176\u4ed6\u5de5\u5177\u5f15\u5165\u7684\u4f20\u9012\u4f9d\u8d56\uff0c\u4e5f\u65e0\u6cd5\u4ece\u672c\u5206\u6790\u5305\u5224\u65ad\u5176\u58f0\u660e\u7248\u672c\u8303\u56f4\u3002\u53ef\u4ee5\u786e\u8ba4\u7684\u662f\uff0c\u63d0\u4ea4\u540e\u7684\u9501\u5b9a\u5b89\u88c5\u7ed3\u679c\u4f1a\u4f7f\u7528 `4.28.8`\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6784\u5efa\u4e0e\u4ea7\u7269\n\n- \u8fd0\u884c\u65f6\u4e1a\u52a1\u903b\u8f91\u6ca1\u6709\u76f4\u63a5\u53d8\u66f4\uff0c\u5f71\u54cd\u96c6\u4e2d\u5728\u4f9d\u8d56\u5b89\u88c5\u548c\u524d\u7aef\u6784\u5efa\u9636\u6bb5\u3002\n- \u66f4\u65b0\u540e\u7684 `caniuse-lite`\u3001`electron-to-chromium` \u548c `node-releases` \u6570\u636e\u53ef\u80fd\u6539\u53d8 browserslist \u67e5\u8be2\u89e3\u6790\u51fa\u7684\u5177\u4f53\u76ee\u6807\u7248\u672c\uff0c\u56e0\u6b64\u6700\u7ec8 JavaScript \u8f6c\u8bd1\u6216 CSS \u524d\u7f00\u7ed3\u679c\u53ef\u80fd\u51fa\u73b0\u5c0f\u5e45\u53d8\u5316\u3002\n- `baseline-browser-mapping` \u4fee\u590d\u4e86 Baseline\u3001KaiOS \u548c\u5927\u5c0f\u5199\u76f8\u5173\u67e5\u8be2\u95ee\u9898\uff1b\u5982\u679c\u9879\u76ee\u4f7f\u7528\u8fd9\u4e9b\u67e5\u8be2\uff0c\u65b0\u7248\u672c\u53ef\u80fd\u4ea7\u751f\u6bd4\u65e7\u7248\u672c\u66f4\u51c6\u786e\u4f46\u4e0d\u540c\u7684\u7ed3\u679c\u3002\n\n### \u5b89\u5168\n\n- PR \u660e\u786e\u9488\u5bf9\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027 CG \u544a\u8b66\uff0c\u5e76\u5347\u7ea7\u5230\u5305\u542b\u76f8\u5173\u5b89\u5168\u4fee\u590d\u7684\u7248\u672c\u3002\n- \u5305\u5185\u6ca1\u6709\u6f0f\u6d1e\u5229\u7528\u8def\u5f84\u3001\u53d7\u5f71\u54cd\u8c03\u7528\u70b9\u6216\u4fee\u590d\u63d0\u4ea4\u7684\u5b8c\u6574\u5185\u5bb9\uff0c\u56e0\u6b64\u4e0d\u80fd\u4ec5\u51ed\u8be5\u5305\u65ad\u8a00\u5e94\u7528\u6b64\u524d\u53ef\u88ab\u5b9e\u9645\u5229\u7528\uff0c\u4e5f\u4e0d\u80fd\u72ec\u7acb\u8bc1\u660e\u4e24\u4e2a CVE \u5df2\u5728\u6240\u6709\u4f9d\u8d56\u8def\u5f84\u4e0a\u5b8c\u5168\u6d88\u9664\uff1b\u5e94\u4ee5\u5408\u5e76\u540e\u7684 CG/\u4f9d\u8d56\u626b\u63cf\u7ed3\u679c\u4e3a\u51c6\u3002\n\n### \u8fd0\u7ef4\u4e0e\u5f00\u53d1\u73af\u5883\n\n- \u4f9d\u8d56\u4ecd\u6765\u81ea\u65e2\u6709\u5185\u90e8 feed\uff0c\u5236\u54c1\u6765\u6e90\u6a21\u5f0f\u672a\u6539\u53d8\u3002\n- `node-releases 2.0.54` \u58f0\u660e `node >=18`\uff0c\u8fd9\u662f\u672c\u6b21\u53d8\u66f4\u6700\u5177\u4f53\u7684\u73af\u5883\u517c\u5bb9\u6027\u98ce\u9669\u3002\u82e5 CI\u3001\u5f00\u53d1\u673a\u6216\u793a\u4f8b\u6784\u5efa\u4ecd\u4f7f\u7528 Node.js 16 \u6216\u66f4\u65e9\u7248\u672c\uff0cnpm \u53ef\u80fd\u53d1\u51fa `EBADENGINE` \u8b66\u544a\uff1b\u5728\u542f\u7528\u4e25\u683c engine \u6821\u9a8c\u65f6\uff0c\u5b89\u88c5\u53ef\u80fd\u76f4\u63a5\u5931\u8d25\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9\n\n| \u98ce\u9669 | \u5177\u4f53\u8868\u73b0 | \u5efa\u8bae |\n|---|---|---|\n| Node.js \u6700\u4f4e\u7248\u672c\u53d8\u5316 | \u65b0\u9501\u5b9a\u7684 `node-releases` \u8981\u6c42 Node.js 18 \u6216\u66f4\u9ad8\uff1b\u65e7\u6784\u5efa\u4ee3\u7406\u53ef\u80fd\u8b66\u544a\u6216\u5b89\u88c5\u5931\u8d25 | \u786e\u8ba4 Angular \u793a\u4f8b\u53ca\u5176 CI \u4f7f\u7528 Node.js 18+\uff0c\u5e76\u68c0\u67e5\u662f\u5426\u542f\u7528\u4e86 `engine-strict` |\n| \u6d4f\u89c8\u5668\u76ee\u6807\u96c6\u5408\u53d8\u5316 | \u65b0\u7248\u517c\u5bb9\u6027\u6570\u636e\u5e93\u53ef\u80fd\u8ba9\u76f8\u540c browserslist \u67e5\u8be2\u8fd4\u56de\u4e0d\u540c\u6d4f\u89c8\u5668\u7248\u672c | \u5bf9\u6bd4\u5347\u7ea7\u524d\u540e\u7684 browserslist \u8f93\u51fa\uff0c\u5e76\u68c0\u67e5\u6784\u5efa\u4ea7\u7269\u6216\u5feb\u7167\u662f\u5426\u53d1\u751f\u9884\u671f\u5916\u53d8\u5316 |\n| CLI \u5165\u53e3\u53d8\u5316 | `baseline-browser-mapping` \u7684 bin \u4ece `dist/cli.js` \u6539\u4e3a `dist/cli.cjs` | \u82e5\u811a\u672c\u7ed5\u8fc7\u5305\u7684 bin \u6620\u5c04\u5e76\u76f4\u63a5\u5f15\u7528\u65e7\u8def\u5f84\uff0c\u4f1a\u5931\u6548\uff1b\u5305\u5185\u672a\u63d0\u4f9b\u76f8\u5173\u811a\u672c\u5185\u5bb9\uff0c\u65e0\u6cd5\u786e\u8ba4\u662f\u5426\u5b58\u5728\u6b64\u7528\u6cd5 |\n| \u4ec5\u9501\u6587\u4ef6\u53d8\u66f4 | \u5305\u5185\u6ca1\u6709 `package.json` \u53d8\u66f4\uff0c\u65e0\u6cd5\u786e\u8ba4\u58f0\u660e\u8303\u56f4\u662f\u5426\u5141\u8bb8\u6216\u7a33\u5b9a\u5730\u4ea7\u751f\u6b64\u89e3\u6790\u7ed3\u679c | \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 npm \u7248\u672c\u6267\u884c\u5e72\u51c0\u5b89\u88c5\uff0c\u5e76\u786e\u8ba4\u9501\u6587\u4ef6\u4e0d\u4f1a\u88ab\u518d\u6b21\u6539\u5199 |\n| \u5b89\u5168\u4fee\u590d\u9a8c\u8bc1\u4e0d\u8db3 | \u63cf\u8ff0\u5217\u51fa CVE\uff0c\u4f46\u5305\u5185\u6ca1\u6709 CG \u590d\u626b\u7ed3\u679c\u6216\u6f0f\u6d1e\u7ec6\u8282 | \u5408\u5e76\u524d\u786e\u8ba4 CG \u544a\u8b66\u5728\u8be5\u5206\u652f\u4e0a\u5df2\u6e05\u9664\uff0c\u5e76\u68c0\u67e5\u662f\u5426\u4ecd\u5b58\u5728\u5176\u4ed6\u8def\u5f84\u9501\u5b9a\u65e7\u7248\u672c |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u6d4b\u8bd5\u53d8\u66f4\u3001\u6d4b\u8bd5\u6267\u884c\u8bb0\u5f55\u3001CI \u6784\u5efa\u7ed3\u679c\u6216 Component Governance \u590d\u626b\u7ed3\u679c\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u672c PR \u5df2\u901a\u8fc7\u6d4b\u8bd5\u3002\u5efa\u8bae\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n1. \u5728\u9879\u76ee\u652f\u6301\u7684\u6700\u4f4e Node.js \u7248\u672c\u4ee5\u53ca Node.js 18+ \u73af\u5883\u4e2d\u6267\u884c\u9501\u6587\u4ef6\u9a71\u52a8\u7684\u5e72\u51c0\u5b89\u88c5\uff0c\u786e\u8ba4\u6ca1\u6709 engine \u6216\u5b8c\u6574\u6027\u9519\u8bef\u3002\n2. \u6784\u5efa `/sample/angular-host-app`\uff0c\u786e\u8ba4 Angular\u3001Babel/PostCSS \u7b49\u4f9d\u8d56 browserslist \u7684\u5de5\u5177\u94fe\u6b63\u5e38\u5de5\u4f5c\u3002\n3. \u8fd0\u884c\u8be5\u793a\u4f8b\u73b0\u6709\u7684\u5355\u5143\u6d4b\u8bd5\u3001lint \u548c\u7aef\u5230\u7aef\u6d4b\u8bd5\uff08\u5982\u679c\u4ed3\u5e93\u5df2\u6709\u5bf9\u5e94\u547d\u4ee4\uff09\u3002\n4. \u8f93\u51fa\u5e76\u6bd4\u8f83\u9879\u76ee browserslist \u67e5\u8be2\u7ed3\u679c\uff0c\u786e\u8ba4\u76ee\u6807\u6d4f\u89c8\u5668\u53d8\u5316\u7b26\u5408\u9884\u671f\u3002\n5. \u91cd\u65b0\u8fd0\u884c CG/\u4f9d\u8d56\u5b89\u5168\u626b\u63cf\uff0c\u786e\u8ba4 `CVE-2026-73088` \u548c `CVE-2026-73089` \u544a\u8b66\u5df2\u89e3\u51b3\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\n\n- \u5305\u5185\u5217\u51fa\u7684 1 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u6709 diff\uff0c\u4e14\u6587\u4ef6\u7ea7 `truncated` \u4e3a `false`\uff1b\u603b\u4f53 `diffTruncated` \u4e5f\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5206\u6790\u5305\u63d0\u4f9b\u7684\u5168\u90e8\u4ee3\u7801\u5dee\u5f02\u3002\n- diff \u5927\u5c0f\u4e3a 5,054 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5305\u8bb0\u5f55\u7684\u603b\u5dee\u5f02\u4e0a\u9650 524,288 \u5b57\u8282\u548c\u5355\u6587\u4ef6\u4e0a\u9650 65,536 \u5b57\u8282\u3002\n- PR \u63cf\u8ff0\u4e2d\u7684\u4e0a\u6e38 changelog \u6587\u672c\u4ee5 `https://gith...` \u7ed3\u675f\uff0c\u660e\u663e\u672a\u5b8c\u6574\u5305\u542b\u5728\u5305\u4e2d\u3002\u672c\u6587\u53ea\u4f7f\u7528\u4e86\u5305\u5185\u53ef\u89c1\u7684 release notes \u6458\u8981\uff0c\u6ca1\u6709\u58f0\u79f0\u5206\u6790\u88ab\u7701\u7565\u7684 changelog\u3001\u4e0a\u6e38\u63d0\u4ea4\u6216\u5b8c\u6574 CVE \u6280\u672f\u7ec6\u8282\u3002\n- \u5305\u5185\u6ca1\u6709 `package.json` \u5185\u5bb9\u3001\u6784\u5efa\u65e5\u5fd7\u3001\u6d4b\u8bd5\u7ed3\u679c\u3001\u7b56\u7565\u68c0\u67e5\u8be6\u60c5\u6216\u5b8c\u6574\u6f0f\u6d1e\u62a5\u544a\uff1b\u76f8\u5173\u7ed3\u8bba\u5747\u6309\u4e0a\u8ff0\u9650\u5236\u8868\u8ff0\u3002\n", "creation_timestamp": "2026-09-05T16:19:59.211436Z"}, {"uuid": "ddcad69e-20f3-4336-a6e1-08461d4a3ef5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73087", "type": "published-proof-of-concept", "source": "https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x", "content": "", "creation_timestamp": "2026-09-08T20:35:17.844792Z"}, {"uuid": "2de76a5b-995b-4788-9dd6-d76b319b949b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73089", "type": "seen", "source": "https://gist.github.com/djlan/abb58fed073f262e5e0917ae453bde64", "content": "# [SECURITY] \u5c06 Terminal \u793a\u4f8b\u4e2d\u7684 browserslist \u4ece 4.24.2 \u5347\u7ea7\u5230 4.28.8\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 Terminal \u670d\u52a1\u7aef\u6269\u5c55\u793a\u4f8b\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06 `browserslist` \u53ca\u5176\u6d4f\u89c8\u5668\u6570\u636e\u4f9d\u8d56\u5347\u7ea7\u5230\u4fee\u590d\u7248\u672c\uff0c\u4ee5\u5904\u7406\u4e24\u4e2a\u9ad8\u5371 Component Governance \u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u4fdd\u6301\u4f9d\u8d56\u5b89\u88c5\u7ed3\u679c\u53ef\u91cd\u590d\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 778780](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778780) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | \u6d3b\u8dc3\uff08\u975e\u8349\u7a3f\uff09\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fextensions%2Fserver-extensions%2FTerminal/browserslist-4.28.8-758268` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-09-08 09:33:35 |\n| \u53d8\u66f4\u7edf\u8ba1 | 1 \u4e2a\u6587\u4ef6\u30011 \u4e2a\u63d0\u4ea4\u30011 \u6b21\u8fed\u4ee3\uff1b63 \u884c\u65b0\u589e\u300141 \u884c\u5220\u9664\uff08\u6309\u5305\u5185 diff \u7edf\u8ba1\uff0c\u5171 104 \u884c\u53d8\u52a8\uff09\uff1bdiff \u5927\u5c0f 9,448 \u5b57\u8282 |\n| \u5b89\u5168\u80cc\u666f | \u5904\u7406\u4e24\u4e2a\u9ad8\u5371\u544a\u8b66\uff1aCVE-2026-73088\u3001CVE-2026-73089 |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [1. browserslist \u5b89\u5168\u5347\u7ea7](#1-browserslist-\u5b89\u5168\u5347\u7ea7)\n  - [2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u540c\u6b65](#2-\u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u540c\u6b65)\n  - [3. \u65b0\u589e Baseline \u6d4f\u89c8\u5668\u6620\u5c04\u80fd\u529b](#3-\u65b0\u589e-baseline-\u6d4f\u89c8\u5668\u6620\u5c04\u80fd\u529b)\n  - [4. \u9501\u6587\u4ef6\u4e00\u81f4\u6027\u4e0e\u5236\u54c1\u6765\u6e90](#4-\u9501\u6587\u4ef6\u4e00\u81f4\u6027\u4e0e\u5236\u54c1\u6765\u6e90)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n- [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n- [\u5206\u6790\u8986\u76d6\u8303\u56f4\u4e0e\u622a\u65ad\u8bf4\u660e](#\u5206\u6790\u8986\u76d6\u8303\u56f4\u4e0e\u622a\u65ad\u8bf4\u660e)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u53d8\u66f4\u53ea\u6d89\u53ca [`sample/extensions/server-extensions/Terminal/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778780?path=/sample/extensions/server-extensions/Terminal/package-lock.json&_a=files)\uff0c\u6ca1\u6709\u4fee\u6539\u4e1a\u52a1\u6e90\u7801\u6216 `package.json`\u3002\u6838\u5fc3\u4f9d\u8d56 `browserslist` \u4ece `4.24.2` \u5347\u7ea7\u5230 `4.28.8`\uff0c\u5e76\u7531 npm \u9501\u6587\u4ef6\u540c\u6b65\u66f4\u65b0\u5176\u4f20\u9012\u4f9d\u8d56\u3001\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u6821\u9a8c\u503c\u3002\n\n\u8fd9\u6837\u505a\u7684\u76f4\u63a5\u539f\u56e0\u662f Dependabot \u68c0\u6d4b\u5230\u4e0e\u65e7\u7248\u672c\u76f8\u5173\u7684\u4e24\u4e2a\u9ad8\u5371 Component Governance \u544a\u8b66\u3002\u5347\u7ea7\u540e\u7684\u7248\u672c\u8303\u56f4\u5305\u542b\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u4e2d\u63d0\u5230\u7684\u539f\u578b\u6c61\u67d3/\u539f\u578b\u5199\u5165\u95ee\u9898\u4fee\u590d\u3001\u65e0\u754c\u5185\u5b58\u589e\u957f\u4fee\u590d\u548c\u89e3\u6790\u6027\u80fd\u6539\u8fdb\uff1b\u4e0d\u8fc7\uff0c\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u63d0\u4ea4\u4e4b\u95f4\u7684\u9010\u9879\u6620\u5c04\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u6bcf\u4e2a CVE \u5206\u522b\u7531\u54ea\u4e00\u9879\u4ee3\u7801\u4fee\u590d\u89e3\u51b3\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. browserslist \u5b89\u5168\u5347\u7ea7\n\n**\u4e3a\u4ec0\u4e48\u6539\uff1a** `browserslist` \u7528\u4e8e\u6839\u636e\u67e5\u8be2\u89c4\u5219\u89e3\u6790\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\uff0c\u5176\u65e7\u7248\u672c\u89e6\u53d1\u4e86 CVE-2026-73088 \u548c CVE-2026-73089 \u4e24\u4e2a\u9ad8\u5371\u6cbb\u7406\u544a\u8b66\u3002\u5c06\u7248\u672c\u63d0\u5347\u81f3 `4.28.8` \u662f\u672c PR \u7684\u5b89\u5168\u4fee\u590d\u4e3b\u4f53\u3002\n\n**\u5982\u4f55\u5de5\u4f5c\uff1a**\n\n- \u9501\u5b9a\u7248\u672c\u7531 `4.24.2` \u66f4\u65b0\u4e3a `4.28.8`\u3002\n- `resolved` \u5730\u5740\u5207\u6362\u5230 AzureNotebooks \u5185\u90e8 npm feed \u4e2d\u5bf9\u5e94\u7684 `4.28.8` \u5236\u54c1\u3002\n- `integrity` \u6821\u9a8c\u503c\u968f\u5236\u54c1\u66f4\u65b0\uff0cnpm \u5b89\u88c5\u65f6\u4f1a\u6821\u9a8c\u4e0b\u8f7d\u5185\u5bb9\u4e0e\u9501\u6587\u4ef6\u662f\u5426\u4e00\u81f4\u3002\n- \u4e0a\u6e38\u53d1\u5e03\u4fe1\u606f\u8868\u660e\u8be5\u7248\u672c\u533a\u95f4\u5305\u542b\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u3001\u65e0\u754c\u5185\u5b58\u589e\u957f\u4ee5\u53ca\u591a\u9879\u67e5\u8be2\u89e3\u6790\u95ee\u9898\u7684\u4fee\u590d\u3002\n\n\u8be5\u6a21\u5757\u7684\u53d8\u66f4\u96c6\u4e2d\u5728 [`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778780?path=/sample/extensions/server-extensions/Terminal/package-lock.json&_a=files) \u4e2d\uff0c\u4e0d\u4f1a\u76f4\u63a5\u6539\u53d8\u4ed3\u5e93\u5185\u7684\u5e94\u7528\u5b9e\u73b0\u4ee3\u7801\uff1b\u5b9e\u9645\u884c\u4e3a\u53d8\u5316\u6765\u81ea\u5b89\u88c5\u540e\u4f7f\u7528\u7684\u65b0\u4f9d\u8d56\u7248\u672c\u3002\n\n### 2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u540c\u6b65\n\n`browserslist` \u7684\u67e5\u8be2\u7ed3\u679c\u4f9d\u8d56\u6d4f\u89c8\u5668\u7248\u672c\u6570\u636e\u5e93\u3002\u4e3a\u5339\u914d\u65b0\u7248\u672c\uff0c\u5176\u76f8\u5173\u6570\u636e\u5305\u540c\u65f6\u5347\u7ea7\uff1a\n\n| \u4f9d\u8d56 | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528 |\n|---|---:|---:|---|\n| `caniuse-lite` | `1.0.30001687` | `1.0.30001810` | \u63d0\u4f9b Web \u529f\u80fd\u53ca\u6d4f\u89c8\u5668\u652f\u6301\u6570\u636e |\n| `electron-to-chromium` | `1.5.72` | `1.5.418` | \u5c06 Electron \u7248\u672c\u6620\u5c04\u5230 Chromium \u7248\u672c |\n| `node-releases` | `2.0.19` | `2.0.54` | \u63d0\u4f9b Node.js \u53d1\u5e03\u7248\u672c\u6570\u636e |\n| `update-browserslist-db` | `1.1.1` | `1.3.2` | \u66f4\u65b0 Browserslist \u4f7f\u7528\u7684\u6570\u636e\u96c6 |\n\n\u8fd9\u4e9b\u5347\u7ea7\u4f7f `browserslist@4.28.8` \u6309\u5176\u58f0\u660e\u7684\u4f9d\u8d56\u8303\u56f4\u83b7\u5f97\u8f83\u65b0\u7684\u6570\u636e\uff0c\u907f\u514d\u6838\u5fc3\u89e3\u6790\u5668\u5df2\u5347\u7ea7\u4f46\u6570\u636e\u4ecd\u505c\u7559\u5728\u65e7\u5feb\u7167\u3002\u7ed3\u679c\u662f\u76f8\u540c Browserslist \u67e5\u8be2\u5728\u5c11\u6570\u8fb9\u754c\u573a\u666f\u4e0b\u53ef\u80fd\u5f97\u5230\u66f4\u7b26\u5408\u5f53\u524d\u6d4f\u89c8\u5668\u751f\u6001\u7684\u76ee\u6807\u96c6\u5408\u3002\n\n### 3. \u65b0\u589e Baseline \u6d4f\u89c8\u5668\u6620\u5c04\u80fd\u529b\n\n\u65b0\u7248 `browserslist` \u65b0\u589e\u4e86\u5bf9 `baseline-browser-mapping` \u7684\u4f9d\u8d56\uff0c\u9501\u6587\u4ef6\u56e0\u6b64\u52a0\u5165 `2.11.20`\uff1a\n\n- \u8be5\u5305\u63d0\u4f9b Web Platform Baseline \u4e0e\u5177\u4f53\u6d4f\u89c8\u5668\u7248\u672c\u4e4b\u95f4\u7684\u6620\u5c04\u3002\n- \u5b83\u88ab\u8bb0\u5f55\u5728\u9501\u6587\u4ef6\u7684\u65b0\u3001\u65e7\u4e24\u5957\u4f9d\u8d56\u8868\u793a\u7ed3\u6784\u4e2d\uff0c\u8bf4\u660e\u5f53\u524d\u9501\u6587\u4ef6\u683c\u5f0f\u540c\u65f6\u7ef4\u62a4 `node_modules/...` \u6761\u76ee\u548c\u9876\u5c42\u4f9d\u8d56\u6811\u3002\n- \u5305\u58f0\u660e\u7684 Node.js \u5f15\u64ce\u4e3a `>=6.0.0`\uff0c\u672c\u8eab\u4e0d\u4f1a\u63d0\u9ad8\u8fd0\u884c\u65f6\u95e8\u69db\u3002\n\n\u8fd9\u4e00\u65b0\u589e\u4f9d\u8d56\u652f\u6301\u65b0\u7248 Browserslist \u7684 Baseline \u67e5\u8be2\u80fd\u529b\uff1b\u5373\u4f7f\u9879\u76ee\u5f53\u524d\u672a\u663e\u5f0f\u4f7f\u7528\u6b64\u7c7b\u67e5\u8be2\uff0c\u5b83\u4ecd\u662f\u65b0\u7248\u4f9d\u8d56\u56fe\u7684\u4e00\u90e8\u5206\u3002\n\n### 4. \u9501\u6587\u4ef6\u4e00\u81f4\u6027\u4e0e\u5236\u54c1\u6765\u6e90\n\n\u6240\u6709\u53d7\u5f71\u54cd\u5305\u7684 `resolved` \u548c `integrity` \u5b57\u6bb5\u5747\u968f\u7248\u672c\u66f4\u65b0\uff0c\u4e14\u5236\u54c1\u7ee7\u7eed\u6765\u81ea\u73b0\u6709\u7684 AzureNotebooks \u5185\u90e8 npm feed\u3002\u9501\u6587\u4ef6\u540c\u65f6\u66f4\u65b0\u4e86 `node_modules` \u7ed3\u6784\u548c\u517c\u5bb9\u7684\u9876\u5c42 `dependencies` \u7ed3\u6784\uff0c\u907f\u514d\u4e0d\u540c npm \u5ba2\u6237\u7aef\u8bfb\u53d6\u5230\u4e0d\u4e00\u81f4\u7684\u7248\u672c\u56fe\u3002\n\n`update-browserslist-db` \u5bf9 `picocolors` \u7684\u8981\u6c42\u7531 `^1.1.0` \u8c03\u6574\u4e3a `^1.1.1`\uff1b\u5305\u5185 diff \u6ca1\u6709\u663e\u793a\u5df2\u9501\u5b9a\u7684 `picocolors` \u5b9e\u9645\u7248\u672c\u53d1\u751f\u53d8\u5316\uff0c\u56e0\u6b64\u53ea\u80fd\u786e\u8ba4\u4f9d\u8d56\u7ea6\u675f\u6539\u53d8\uff0c\u4e0d\u80fd\u58f0\u79f0\u8be5\u5305\u672c\u8eab\u88ab\u5347\u7ea7\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n**\u5b89\u5168\u6027\uff1a** \u4e3b\u8981\u6b63\u5411\u5f71\u54cd\u662f\u66ff\u6362\u89e6\u53d1\u6cbb\u7406\u544a\u8b66\u7684\u65e7\u7248 `browserslist`\uff0c\u5e76\u5f15\u5165\u4e0a\u6e38\u5b89\u5168\u4fee\u590d\u7248\u672c\u3002\u82e5\u6784\u5efa\u548c\u90e8\u7f72\u786e\u5b9e\u4f7f\u7528\u6b64\u76ee\u5f55\u7684\u9501\u6587\u4ef6\uff0c\u540e\u7eed\u5b89\u88c5\u5c06\u89e3\u6790\u5230\u4fee\u590d\u540e\u7684\u5236\u54c1\u3002\n\n**\u6784\u5efa\u4e0e\u4ea7\u7269\uff1a** \u6d4f\u89c8\u5668\u76ee\u6807\u89e3\u6790\u7ed3\u679c\u53ef\u80fd\u56e0\u66f4\u65b0\u540e\u7684\u6570\u636e\u96c6\u548c\u67e5\u8be2\u89e3\u6790\u4fee\u590d\u800c\u53d8\u5316\uff0c\u8fdb\u800c\u5f71\u54cd Babel\u3001Autoprefixer \u6216\u5176\u4ed6\u8bfb\u53d6 Browserslist \u914d\u7f6e\u7684\u5de5\u5177\u6240\u751f\u6210\u7684\u8f6c\u8bd1\u4e0e CSS \u517c\u5bb9\u4ee3\u7801\u3002\u5305\u5185\u672a\u63d0\u4f9b\u5b9e\u9645\u6784\u5efa\u4ea7\u7269\u5bf9\u6bd4\uff0c\u56e0\u6b64\u5f71\u54cd\u89c4\u6a21\u672a\u77e5\u3002\n\n**\u8fd0\u884c\u65f6\uff1a** \u6ca1\u6709\u4e1a\u52a1\u6e90\u7801\u53d8\u5316\u3002\u98ce\u9669\u4e3b\u8981\u51fa\u73b0\u5728\u4f9d\u8d56\u5b89\u88c5\u3001\u6784\u5efa\u9636\u6bb5\u6216\u8fd0\u884c\u65f6\u8c03\u7528 Browserslist API \u7684\u8def\u5f84\uff0c\u800c\u975e Terminal \u6269\u5c55\u81ea\u8eab\u903b\u8f91\u88ab\u76f4\u63a5\u6539\u5199\u3002\n\n**\u4f9b\u5e94\u94fe\u4e0e\u53ef\u91cd\u590d\u5b89\u88c5\uff1a** \u4e0b\u8f7d\u6e90\u4ecd\u4e3a\u5185\u90e8 feed\uff0c\u5e76\u66f4\u65b0\u4e86\u5b8c\u6574\u6027\u54c8\u5e0c\uff1b\u8fd9\u4fdd\u6301\u4e86\u9501\u6587\u4ef6\u5b89\u88c5\u7684\u786e\u5b9a\u6027\u3002\u65b0\u589e\u4e00\u4e2a\u4f20\u9012\u4f9d\u8d56\u4f1a\u6269\u5927\u4e00\u4e2a\u5305\u7684\u4f9b\u5e94\u94fe\u9762\uff0c\u4f46\u5b83\u662f\u65b0\u7248 `browserslist` \u7684\u663e\u5f0f\u4f9d\u8d56\u3002\n\n**\u4ed3\u5e93\u8303\u56f4\uff1a** \u53d8\u66f4\u9650\u5b9a\u5728 Terminal \u793a\u4f8b\u76ee\u5f55\uff0c\u4e0d\u4ee3\u8868\u4ed3\u5e93\u5176\u4ed6\u4f4d\u7f6e\u7684 `browserslist` \u5b9e\u4f8b\u4e5f\u5df2\u5347\u7ea7\u6216\u76f8\u5173\u5b89\u5168\u544a\u8b66\u5df2\u5168\u90e8\u6d88\u9664\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n1. **Node.js \u7248\u672c\u95e8\u69db\u53ef\u80fd\u63d0\u9ad8\u3002** `node-releases@2.0.54` \u5728\u9501\u6587\u4ef6\u4e2d\u58f0\u660e `node >=18`\u3002\u5982\u679c Terminal \u793a\u4f8b\u7684\u5b89\u88c5\u6216\u6784\u5efa\u73af\u5883\u4ecd\u4f7f\u7528 Node.js 16 \u6216\u66f4\u65e9\u7248\u672c\uff0cnpm \u53ef\u80fd\u53d1\u51fa\u5f15\u64ce\u4e0d\u517c\u5bb9\u8b66\u544a\uff1b\u5728\u542f\u7528 `engine-strict` \u65f6\u53ef\u80fd\u76f4\u63a5\u5b89\u88c5\u5931\u8d25\u3002\u8fd9\u662f\u672c\u6b21\u5347\u7ea7\u6700\u5177\u4f53\u7684\u517c\u5bb9\u6027\u98ce\u9669\u3002\n2. **\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\u53ef\u80fd\u53d8\u5316\u3002** \u66f4\u65b0 `caniuse-lite`\u3001Electron/Chromium \u6620\u5c04\u548c Node \u53d1\u5e03\u6570\u636e\u540e\uff0c\u76f8\u540c\u67e5\u8be2\u53ef\u80fd\u9009\u51fa\u4e0d\u540c\u7248\u672c\uff0c\u4ece\u800c\u6539\u53d8\u8f6c\u8bd1\u3001polyfill \u6216\u524d\u7f00\u8f93\u51fa\u3002\u5e94\u7279\u522b\u5173\u6ce8\u9879\u76ee\u662f\u5426\u4f9d\u8d56\u7cbe\u786e\u7a33\u5b9a\u7684\u65e7\u6d4f\u89c8\u5668\u4ea7\u7269\u3002\n3. **\u8de8\u591a\u4e2a\u6b21\u7248\u672c\u5347\u7ea7\u5b58\u5728\u884c\u4e3a\u5dee\u5f02\u3002** `4.24.2` \u5230 `4.28.8` \u4e0d\u53ea\u662f\u8865\u4e01\u5347\u7ea7\uff0c\u5305\u542b\u67e5\u8be2\u89e3\u6790\u3001Baseline \u67e5\u8be2\u3001Electron \u67e5\u8be2\u53ca\u6bd4\u8f83\u8fd0\u7b97\u7b26\u5904\u7406\u7b49\u53d8\u5316\u3002\u4f9d\u8d56\u975e\u6807\u51c6\u6216\u8fb9\u754c\u67e5\u8be2\u8bed\u6cd5\u7684\u914d\u7f6e\u9700\u8981\u56de\u5f52\u9a8c\u8bc1\u3002\n4. **\u4ec5\u66f4\u65b0\u9501\u6587\u4ef6\u7684\u524d\u63d0\u3002** \u5305\u5185\u672a\u663e\u793a `package.json` \u53d8\u5316\u3002\u82e5 `package.json` \u5bf9 `browserslist` \u7684\u58f0\u660e\u8303\u56f4\u4e0d\u80fd\u8986\u76d6 `4.28.8`\uff0c\u540e\u7eed\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u53ef\u80fd\u56de\u9000\u6216\u4ea7\u751f\u5dee\u5f02\uff1b\u5f53\u524d\u5305\u6ca1\u6709\u63d0\u4f9b\u8be5\u6e05\u5355\u5185\u5bb9\uff0c\u65e0\u6cd5\u9a8c\u8bc1\u8fd9\u4e00\u70b9\u3002\n5. **\u65e7\u7248 npm \u7684\u517c\u5bb9\u6027\u9700\u786e\u8ba4\u3002** \u9501\u6587\u4ef6\u540c\u65f6\u5305\u542b\u4e24\u79cd\u4f9d\u8d56\u8868\u793a\uff0c\u8868\u660e\u5176\u683c\u5f0f\u9700\u8981\u517c\u987e\u7279\u5b9a npm \u7248\u672c\u3002\u867d\u7136 diff \u672c\u8eab\u4fdd\u6301\u4e86\u539f\u6709\u7ed3\u6784\uff0c\u4f46\u6ca1\u6709\u63d0\u4f9b\u9879\u76ee\u89c4\u5b9a\u7684 npm \u7248\u672c\u6216\u91cd\u65b0\u5b89\u88c5\u9a8c\u8bc1\u7ed3\u679c\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u4e2d\u6ca1\u6709\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\u3001\u6d4b\u8bd5\u6267\u884c\u8bb0\u5f55\u3001\u6d41\u6c34\u7ebf\u7ed3\u679c\u6216\u6784\u5efa\u65e5\u5fd7\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u6d4b\u8bd5\u5df2\u7ecf\u901a\u8fc7\u3002PR \u5f53\u524d\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\uff0c\u4f46\u8be5\u5b57\u6bb5\u4e0d\u7b49\u540c\u4e8e\u6240\u6709 CI \u7b56\u7565\u6216\u6d4b\u8bd5\u5747\u6210\u529f\u3002\n\n\u5efa\u8bae\u9488\u5bf9 [`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778780?path=/sample/extensions/server-extensions/Terminal/package-lock.json&_a=files) \u6240\u5728\u76ee\u5f55\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n- \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node.js/npm \u7248\u672c\u6267\u884c\u5e72\u51c0\u5b89\u88c5\uff0c\u786e\u8ba4\u5185\u90e8 feed \u53ef\u89e3\u6790\u6240\u6709\u65b0\u5236\u54c1\u4e14\u5b8c\u6574\u6027\u6821\u9a8c\u901a\u8fc7\u3002\n- \u8fd0\u884c Terminal \u670d\u52a1\u7aef\u6269\u5c55\u793a\u4f8b\u73b0\u6709\u7684\u6784\u5efa\u548c\u6d4b\u8bd5\u547d\u4ee4\u3002\n- \u6267\u884c\u9879\u76ee\u5b9e\u9645\u4f7f\u7528\u7684 Browserslist \u67e5\u8be2\u5e76\u5bf9\u6bd4\u5347\u7ea7\u524d\u540e\u7684\u76ee\u6807\u5217\u8868\u3002\n- \u5728\u53d7\u652f\u6301\u7684\u6700\u4f4e Node.js \u7248\u672c\u4e0a\u9a8c\u8bc1\u5b89\u88c5\uff0c\u91cd\u70b9\u786e\u8ba4 `node-releases@2.0.54` \u7684 `node >=18` \u8981\u6c42\u662f\u5426\u53ef\u63a5\u53d7\u3002\n- \u91cd\u65b0\u8fd0\u884c Component Governance \u626b\u63cf\uff0c\u786e\u8ba4\u4e24\u4e2a\u9ad8\u5371\u544a\u8b66\u5df2\u5173\u95ed\u4e14\u672a\u5f15\u5165\u65b0\u7684\u6cbb\u7406\u544a\u8b66\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\u4e0e\u622a\u65ad\u8bf4\u660e\n\n- **\u4ee3\u7801 diff \u8986\u76d6\u5b8c\u6574\uff1a** \u6570\u636e\u5305\u6807\u8bb0\u6587\u4ef6 diff \u7684 `truncated` \u4e3a `false`\uff0c\u6574\u4f53 `diffTruncated` \u4e5f\u4e3a `false`\uff1b1 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u6709 diff\uff0c\u5305\u5185\u672a\u62a5\u544a\u5bfc\u51fa\u9519\u8bef\u6216\u8b66\u544a\u3002\u56e0\u6b64\uff0c\u4e0a\u8ff0\u4ee3\u7801\u53d8\u66f4\u5206\u6790\u8986\u76d6\u4e86\u6570\u636e\u5305\u63d0\u4f9b\u7684\u5168\u90e8\u6587\u4ef6\u5dee\u5f02\u3002\n- **PR \u63cf\u8ff0\u5185\u5bb9\u4e0d\u5b8c\u6574\uff1a** \u6570\u636e\u5305\u4e2d\u7684 PR \u63cf\u8ff0\u5728 Browserslist \u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u4e2d\u4ee5 `...` \u622a\u65ad\uff0c\u540e\u7eed\u53d1\u5e03\u8bf4\u660e\u4e0d\u5728\u5305\u5185\u3002\u672c\u8bf4\u660e\u53ea\u5f15\u7528\u622a\u65ad\u524d\u660e\u786e\u51fa\u73b0\u7684\u4fee\u590d\u9879\uff0c\u4e0d\u63a8\u65ad\u7f3a\u5931\u90e8\u5206\u3002\n- **\u4e0a\u4e0b\u6587\u9650\u5236\uff1a** \u6570\u636e\u5305\u6ca1\u6709\u63d0\u4f9b\u5b8c\u6574\u7684 `package.json`\u3001Browserslist \u914d\u7f6e\u3001\u6784\u5efa\u811a\u672c\u3001\u6d41\u6c34\u7ebf\u6267\u884c\u7ed3\u679c\u6216\u4ed3\u5e93\u5176\u4ed6\u76ee\u5f55\u5185\u5bb9\uff0c\u56e0\u6b64\u672a\u5bf9\u8fd9\u4e9b\u7f3a\u5931\u5185\u5bb9\u4f5c\u51fa\u5df2\u9a8c\u8bc1\u7ed3\u8bba\u3002\n", "creation_timestamp": "2026-09-09T00:19:56.936858Z"}, {"uuid": "e5e8425d-372f-4aed-a18c-888bda753e73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73088", "type": "seen", "source": "https://gist.github.com/djlan/abb58fed073f262e5e0917ae453bde64", "content": "# [SECURITY] \u5c06 Terminal \u793a\u4f8b\u4e2d\u7684 browserslist \u4ece 4.24.2 \u5347\u7ea7\u5230 4.28.8\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 Terminal \u670d\u52a1\u7aef\u6269\u5c55\u793a\u4f8b\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06 `browserslist` \u53ca\u5176\u6d4f\u89c8\u5668\u6570\u636e\u4f9d\u8d56\u5347\u7ea7\u5230\u4fee\u590d\u7248\u672c\uff0c\u4ee5\u5904\u7406\u4e24\u4e2a\u9ad8\u5371 Component Governance \u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u4fdd\u6301\u4f9d\u8d56\u5b89\u88c5\u7ed3\u679c\u53ef\u91cd\u590d\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 778780](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778780) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | \u6d3b\u8dc3\uff08\u975e\u8349\u7a3f\uff09\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fextensions%2Fserver-extensions%2FTerminal/browserslist-4.28.8-758268` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-09-08 09:33:35 |\n| \u53d8\u66f4\u7edf\u8ba1 | 1 \u4e2a\u6587\u4ef6\u30011 \u4e2a\u63d0\u4ea4\u30011 \u6b21\u8fed\u4ee3\uff1b63 \u884c\u65b0\u589e\u300141 \u884c\u5220\u9664\uff08\u6309\u5305\u5185 diff \u7edf\u8ba1\uff0c\u5171 104 \u884c\u53d8\u52a8\uff09\uff1bdiff \u5927\u5c0f 9,448 \u5b57\u8282 |\n| \u5b89\u5168\u80cc\u666f | \u5904\u7406\u4e24\u4e2a\u9ad8\u5371\u544a\u8b66\uff1aCVE-2026-73088\u3001CVE-2026-73089 |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [1. browserslist \u5b89\u5168\u5347\u7ea7](#1-browserslist-\u5b89\u5168\u5347\u7ea7)\n  - [2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u540c\u6b65](#2-\u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u540c\u6b65)\n  - [3. \u65b0\u589e Baseline \u6d4f\u89c8\u5668\u6620\u5c04\u80fd\u529b](#3-\u65b0\u589e-baseline-\u6d4f\u89c8\u5668\u6620\u5c04\u80fd\u529b)\n  - [4. \u9501\u6587\u4ef6\u4e00\u81f4\u6027\u4e0e\u5236\u54c1\u6765\u6e90](#4-\u9501\u6587\u4ef6\u4e00\u81f4\u6027\u4e0e\u5236\u54c1\u6765\u6e90)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n- [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n- [\u5206\u6790\u8986\u76d6\u8303\u56f4\u4e0e\u622a\u65ad\u8bf4\u660e](#\u5206\u6790\u8986\u76d6\u8303\u56f4\u4e0e\u622a\u65ad\u8bf4\u660e)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u53d8\u66f4\u53ea\u6d89\u53ca [`sample/extensions/server-extensions/Terminal/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778780?path=/sample/extensions/server-extensions/Terminal/package-lock.json&_a=files)\uff0c\u6ca1\u6709\u4fee\u6539\u4e1a\u52a1\u6e90\u7801\u6216 `package.json`\u3002\u6838\u5fc3\u4f9d\u8d56 `browserslist` \u4ece `4.24.2` \u5347\u7ea7\u5230 `4.28.8`\uff0c\u5e76\u7531 npm \u9501\u6587\u4ef6\u540c\u6b65\u66f4\u65b0\u5176\u4f20\u9012\u4f9d\u8d56\u3001\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u6821\u9a8c\u503c\u3002\n\n\u8fd9\u6837\u505a\u7684\u76f4\u63a5\u539f\u56e0\u662f Dependabot \u68c0\u6d4b\u5230\u4e0e\u65e7\u7248\u672c\u76f8\u5173\u7684\u4e24\u4e2a\u9ad8\u5371 Component Governance \u544a\u8b66\u3002\u5347\u7ea7\u540e\u7684\u7248\u672c\u8303\u56f4\u5305\u542b\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u4e2d\u63d0\u5230\u7684\u539f\u578b\u6c61\u67d3/\u539f\u578b\u5199\u5165\u95ee\u9898\u4fee\u590d\u3001\u65e0\u754c\u5185\u5b58\u589e\u957f\u4fee\u590d\u548c\u89e3\u6790\u6027\u80fd\u6539\u8fdb\uff1b\u4e0d\u8fc7\uff0c\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u63d0\u4ea4\u4e4b\u95f4\u7684\u9010\u9879\u6620\u5c04\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u6bcf\u4e2a CVE \u5206\u522b\u7531\u54ea\u4e00\u9879\u4ee3\u7801\u4fee\u590d\u89e3\u51b3\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. browserslist \u5b89\u5168\u5347\u7ea7\n\n**\u4e3a\u4ec0\u4e48\u6539\uff1a** `browserslist` \u7528\u4e8e\u6839\u636e\u67e5\u8be2\u89c4\u5219\u89e3\u6790\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\uff0c\u5176\u65e7\u7248\u672c\u89e6\u53d1\u4e86 CVE-2026-73088 \u548c CVE-2026-73089 \u4e24\u4e2a\u9ad8\u5371\u6cbb\u7406\u544a\u8b66\u3002\u5c06\u7248\u672c\u63d0\u5347\u81f3 `4.28.8` \u662f\u672c PR \u7684\u5b89\u5168\u4fee\u590d\u4e3b\u4f53\u3002\n\n**\u5982\u4f55\u5de5\u4f5c\uff1a**\n\n- \u9501\u5b9a\u7248\u672c\u7531 `4.24.2` \u66f4\u65b0\u4e3a `4.28.8`\u3002\n- `resolved` \u5730\u5740\u5207\u6362\u5230 AzureNotebooks \u5185\u90e8 npm feed \u4e2d\u5bf9\u5e94\u7684 `4.28.8` \u5236\u54c1\u3002\n- `integrity` \u6821\u9a8c\u503c\u968f\u5236\u54c1\u66f4\u65b0\uff0cnpm \u5b89\u88c5\u65f6\u4f1a\u6821\u9a8c\u4e0b\u8f7d\u5185\u5bb9\u4e0e\u9501\u6587\u4ef6\u662f\u5426\u4e00\u81f4\u3002\n- \u4e0a\u6e38\u53d1\u5e03\u4fe1\u606f\u8868\u660e\u8be5\u7248\u672c\u533a\u95f4\u5305\u542b\u539f\u578b\u6c61\u67d3\u3001\u539f\u578b\u5199\u5165\u3001\u65e0\u754c\u5185\u5b58\u589e\u957f\u4ee5\u53ca\u591a\u9879\u67e5\u8be2\u89e3\u6790\u95ee\u9898\u7684\u4fee\u590d\u3002\n\n\u8be5\u6a21\u5757\u7684\u53d8\u66f4\u96c6\u4e2d\u5728 [`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778780?path=/sample/extensions/server-extensions/Terminal/package-lock.json&_a=files) \u4e2d\uff0c\u4e0d\u4f1a\u76f4\u63a5\u6539\u53d8\u4ed3\u5e93\u5185\u7684\u5e94\u7528\u5b9e\u73b0\u4ee3\u7801\uff1b\u5b9e\u9645\u884c\u4e3a\u53d8\u5316\u6765\u81ea\u5b89\u88c5\u540e\u4f7f\u7528\u7684\u65b0\u4f9d\u8d56\u7248\u672c\u3002\n\n### 2. \u6d4f\u89c8\u5668\u517c\u5bb9\u6027\u6570\u636e\u540c\u6b65\n\n`browserslist` \u7684\u67e5\u8be2\u7ed3\u679c\u4f9d\u8d56\u6d4f\u89c8\u5668\u7248\u672c\u6570\u636e\u5e93\u3002\u4e3a\u5339\u914d\u65b0\u7248\u672c\uff0c\u5176\u76f8\u5173\u6570\u636e\u5305\u540c\u65f6\u5347\u7ea7\uff1a\n\n| \u4f9d\u8d56 | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528 |\n|---|---:|---:|---|\n| `caniuse-lite` | `1.0.30001687` | `1.0.30001810` | \u63d0\u4f9b Web \u529f\u80fd\u53ca\u6d4f\u89c8\u5668\u652f\u6301\u6570\u636e |\n| `electron-to-chromium` | `1.5.72` | `1.5.418` | \u5c06 Electron \u7248\u672c\u6620\u5c04\u5230 Chromium \u7248\u672c |\n| `node-releases` | `2.0.19` | `2.0.54` | \u63d0\u4f9b Node.js \u53d1\u5e03\u7248\u672c\u6570\u636e |\n| `update-browserslist-db` | `1.1.1` | `1.3.2` | \u66f4\u65b0 Browserslist \u4f7f\u7528\u7684\u6570\u636e\u96c6 |\n\n\u8fd9\u4e9b\u5347\u7ea7\u4f7f `browserslist@4.28.8` \u6309\u5176\u58f0\u660e\u7684\u4f9d\u8d56\u8303\u56f4\u83b7\u5f97\u8f83\u65b0\u7684\u6570\u636e\uff0c\u907f\u514d\u6838\u5fc3\u89e3\u6790\u5668\u5df2\u5347\u7ea7\u4f46\u6570\u636e\u4ecd\u505c\u7559\u5728\u65e7\u5feb\u7167\u3002\u7ed3\u679c\u662f\u76f8\u540c Browserslist \u67e5\u8be2\u5728\u5c11\u6570\u8fb9\u754c\u573a\u666f\u4e0b\u53ef\u80fd\u5f97\u5230\u66f4\u7b26\u5408\u5f53\u524d\u6d4f\u89c8\u5668\u751f\u6001\u7684\u76ee\u6807\u96c6\u5408\u3002\n\n### 3. \u65b0\u589e Baseline \u6d4f\u89c8\u5668\u6620\u5c04\u80fd\u529b\n\n\u65b0\u7248 `browserslist` \u65b0\u589e\u4e86\u5bf9 `baseline-browser-mapping` \u7684\u4f9d\u8d56\uff0c\u9501\u6587\u4ef6\u56e0\u6b64\u52a0\u5165 `2.11.20`\uff1a\n\n- \u8be5\u5305\u63d0\u4f9b Web Platform Baseline \u4e0e\u5177\u4f53\u6d4f\u89c8\u5668\u7248\u672c\u4e4b\u95f4\u7684\u6620\u5c04\u3002\n- \u5b83\u88ab\u8bb0\u5f55\u5728\u9501\u6587\u4ef6\u7684\u65b0\u3001\u65e7\u4e24\u5957\u4f9d\u8d56\u8868\u793a\u7ed3\u6784\u4e2d\uff0c\u8bf4\u660e\u5f53\u524d\u9501\u6587\u4ef6\u683c\u5f0f\u540c\u65f6\u7ef4\u62a4 `node_modules/...` \u6761\u76ee\u548c\u9876\u5c42\u4f9d\u8d56\u6811\u3002\n- \u5305\u58f0\u660e\u7684 Node.js \u5f15\u64ce\u4e3a `>=6.0.0`\uff0c\u672c\u8eab\u4e0d\u4f1a\u63d0\u9ad8\u8fd0\u884c\u65f6\u95e8\u69db\u3002\n\n\u8fd9\u4e00\u65b0\u589e\u4f9d\u8d56\u652f\u6301\u65b0\u7248 Browserslist \u7684 Baseline \u67e5\u8be2\u80fd\u529b\uff1b\u5373\u4f7f\u9879\u76ee\u5f53\u524d\u672a\u663e\u5f0f\u4f7f\u7528\u6b64\u7c7b\u67e5\u8be2\uff0c\u5b83\u4ecd\u662f\u65b0\u7248\u4f9d\u8d56\u56fe\u7684\u4e00\u90e8\u5206\u3002\n\n### 4. \u9501\u6587\u4ef6\u4e00\u81f4\u6027\u4e0e\u5236\u54c1\u6765\u6e90\n\n\u6240\u6709\u53d7\u5f71\u54cd\u5305\u7684 `resolved` \u548c `integrity` \u5b57\u6bb5\u5747\u968f\u7248\u672c\u66f4\u65b0\uff0c\u4e14\u5236\u54c1\u7ee7\u7eed\u6765\u81ea\u73b0\u6709\u7684 AzureNotebooks \u5185\u90e8 npm feed\u3002\u9501\u6587\u4ef6\u540c\u65f6\u66f4\u65b0\u4e86 `node_modules` \u7ed3\u6784\u548c\u517c\u5bb9\u7684\u9876\u5c42 `dependencies` \u7ed3\u6784\uff0c\u907f\u514d\u4e0d\u540c npm \u5ba2\u6237\u7aef\u8bfb\u53d6\u5230\u4e0d\u4e00\u81f4\u7684\u7248\u672c\u56fe\u3002\n\n`update-browserslist-db` \u5bf9 `picocolors` \u7684\u8981\u6c42\u7531 `^1.1.0` \u8c03\u6574\u4e3a `^1.1.1`\uff1b\u5305\u5185 diff \u6ca1\u6709\u663e\u793a\u5df2\u9501\u5b9a\u7684 `picocolors` \u5b9e\u9645\u7248\u672c\u53d1\u751f\u53d8\u5316\uff0c\u56e0\u6b64\u53ea\u80fd\u786e\u8ba4\u4f9d\u8d56\u7ea6\u675f\u6539\u53d8\uff0c\u4e0d\u80fd\u58f0\u79f0\u8be5\u5305\u672c\u8eab\u88ab\u5347\u7ea7\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n**\u5b89\u5168\u6027\uff1a** \u4e3b\u8981\u6b63\u5411\u5f71\u54cd\u662f\u66ff\u6362\u89e6\u53d1\u6cbb\u7406\u544a\u8b66\u7684\u65e7\u7248 `browserslist`\uff0c\u5e76\u5f15\u5165\u4e0a\u6e38\u5b89\u5168\u4fee\u590d\u7248\u672c\u3002\u82e5\u6784\u5efa\u548c\u90e8\u7f72\u786e\u5b9e\u4f7f\u7528\u6b64\u76ee\u5f55\u7684\u9501\u6587\u4ef6\uff0c\u540e\u7eed\u5b89\u88c5\u5c06\u89e3\u6790\u5230\u4fee\u590d\u540e\u7684\u5236\u54c1\u3002\n\n**\u6784\u5efa\u4e0e\u4ea7\u7269\uff1a** \u6d4f\u89c8\u5668\u76ee\u6807\u89e3\u6790\u7ed3\u679c\u53ef\u80fd\u56e0\u66f4\u65b0\u540e\u7684\u6570\u636e\u96c6\u548c\u67e5\u8be2\u89e3\u6790\u4fee\u590d\u800c\u53d8\u5316\uff0c\u8fdb\u800c\u5f71\u54cd Babel\u3001Autoprefixer \u6216\u5176\u4ed6\u8bfb\u53d6 Browserslist \u914d\u7f6e\u7684\u5de5\u5177\u6240\u751f\u6210\u7684\u8f6c\u8bd1\u4e0e CSS \u517c\u5bb9\u4ee3\u7801\u3002\u5305\u5185\u672a\u63d0\u4f9b\u5b9e\u9645\u6784\u5efa\u4ea7\u7269\u5bf9\u6bd4\uff0c\u56e0\u6b64\u5f71\u54cd\u89c4\u6a21\u672a\u77e5\u3002\n\n**\u8fd0\u884c\u65f6\uff1a** \u6ca1\u6709\u4e1a\u52a1\u6e90\u7801\u53d8\u5316\u3002\u98ce\u9669\u4e3b\u8981\u51fa\u73b0\u5728\u4f9d\u8d56\u5b89\u88c5\u3001\u6784\u5efa\u9636\u6bb5\u6216\u8fd0\u884c\u65f6\u8c03\u7528 Browserslist API \u7684\u8def\u5f84\uff0c\u800c\u975e Terminal \u6269\u5c55\u81ea\u8eab\u903b\u8f91\u88ab\u76f4\u63a5\u6539\u5199\u3002\n\n**\u4f9b\u5e94\u94fe\u4e0e\u53ef\u91cd\u590d\u5b89\u88c5\uff1a** \u4e0b\u8f7d\u6e90\u4ecd\u4e3a\u5185\u90e8 feed\uff0c\u5e76\u66f4\u65b0\u4e86\u5b8c\u6574\u6027\u54c8\u5e0c\uff1b\u8fd9\u4fdd\u6301\u4e86\u9501\u6587\u4ef6\u5b89\u88c5\u7684\u786e\u5b9a\u6027\u3002\u65b0\u589e\u4e00\u4e2a\u4f20\u9012\u4f9d\u8d56\u4f1a\u6269\u5927\u4e00\u4e2a\u5305\u7684\u4f9b\u5e94\u94fe\u9762\uff0c\u4f46\u5b83\u662f\u65b0\u7248 `browserslist` \u7684\u663e\u5f0f\u4f9d\u8d56\u3002\n\n**\u4ed3\u5e93\u8303\u56f4\uff1a** \u53d8\u66f4\u9650\u5b9a\u5728 Terminal \u793a\u4f8b\u76ee\u5f55\uff0c\u4e0d\u4ee3\u8868\u4ed3\u5e93\u5176\u4ed6\u4f4d\u7f6e\u7684 `browserslist` \u5b9e\u4f8b\u4e5f\u5df2\u5347\u7ea7\u6216\u76f8\u5173\u5b89\u5168\u544a\u8b66\u5df2\u5168\u90e8\u6d88\u9664\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n1. **Node.js \u7248\u672c\u95e8\u69db\u53ef\u80fd\u63d0\u9ad8\u3002** `node-releases@2.0.54` \u5728\u9501\u6587\u4ef6\u4e2d\u58f0\u660e `node >=18`\u3002\u5982\u679c Terminal \u793a\u4f8b\u7684\u5b89\u88c5\u6216\u6784\u5efa\u73af\u5883\u4ecd\u4f7f\u7528 Node.js 16 \u6216\u66f4\u65e9\u7248\u672c\uff0cnpm \u53ef\u80fd\u53d1\u51fa\u5f15\u64ce\u4e0d\u517c\u5bb9\u8b66\u544a\uff1b\u5728\u542f\u7528 `engine-strict` \u65f6\u53ef\u80fd\u76f4\u63a5\u5b89\u88c5\u5931\u8d25\u3002\u8fd9\u662f\u672c\u6b21\u5347\u7ea7\u6700\u5177\u4f53\u7684\u517c\u5bb9\u6027\u98ce\u9669\u3002\n2. **\u76ee\u6807\u6d4f\u89c8\u5668\u96c6\u5408\u53ef\u80fd\u53d8\u5316\u3002** \u66f4\u65b0 `caniuse-lite`\u3001Electron/Chromium \u6620\u5c04\u548c Node \u53d1\u5e03\u6570\u636e\u540e\uff0c\u76f8\u540c\u67e5\u8be2\u53ef\u80fd\u9009\u51fa\u4e0d\u540c\u7248\u672c\uff0c\u4ece\u800c\u6539\u53d8\u8f6c\u8bd1\u3001polyfill \u6216\u524d\u7f00\u8f93\u51fa\u3002\u5e94\u7279\u522b\u5173\u6ce8\u9879\u76ee\u662f\u5426\u4f9d\u8d56\u7cbe\u786e\u7a33\u5b9a\u7684\u65e7\u6d4f\u89c8\u5668\u4ea7\u7269\u3002\n3. **\u8de8\u591a\u4e2a\u6b21\u7248\u672c\u5347\u7ea7\u5b58\u5728\u884c\u4e3a\u5dee\u5f02\u3002** `4.24.2` \u5230 `4.28.8` \u4e0d\u53ea\u662f\u8865\u4e01\u5347\u7ea7\uff0c\u5305\u542b\u67e5\u8be2\u89e3\u6790\u3001Baseline \u67e5\u8be2\u3001Electron \u67e5\u8be2\u53ca\u6bd4\u8f83\u8fd0\u7b97\u7b26\u5904\u7406\u7b49\u53d8\u5316\u3002\u4f9d\u8d56\u975e\u6807\u51c6\u6216\u8fb9\u754c\u67e5\u8be2\u8bed\u6cd5\u7684\u914d\u7f6e\u9700\u8981\u56de\u5f52\u9a8c\u8bc1\u3002\n4. **\u4ec5\u66f4\u65b0\u9501\u6587\u4ef6\u7684\u524d\u63d0\u3002** \u5305\u5185\u672a\u663e\u793a `package.json` \u53d8\u5316\u3002\u82e5 `package.json` \u5bf9 `browserslist` \u7684\u58f0\u660e\u8303\u56f4\u4e0d\u80fd\u8986\u76d6 `4.28.8`\uff0c\u540e\u7eed\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u53ef\u80fd\u56de\u9000\u6216\u4ea7\u751f\u5dee\u5f02\uff1b\u5f53\u524d\u5305\u6ca1\u6709\u63d0\u4f9b\u8be5\u6e05\u5355\u5185\u5bb9\uff0c\u65e0\u6cd5\u9a8c\u8bc1\u8fd9\u4e00\u70b9\u3002\n5. **\u65e7\u7248 npm \u7684\u517c\u5bb9\u6027\u9700\u786e\u8ba4\u3002** \u9501\u6587\u4ef6\u540c\u65f6\u5305\u542b\u4e24\u79cd\u4f9d\u8d56\u8868\u793a\uff0c\u8868\u660e\u5176\u683c\u5f0f\u9700\u8981\u517c\u987e\u7279\u5b9a npm \u7248\u672c\u3002\u867d\u7136 diff \u672c\u8eab\u4fdd\u6301\u4e86\u539f\u6709\u7ed3\u6784\uff0c\u4f46\u6ca1\u6709\u63d0\u4f9b\u9879\u76ee\u89c4\u5b9a\u7684 npm \u7248\u672c\u6216\u91cd\u65b0\u5b89\u88c5\u9a8c\u8bc1\u7ed3\u679c\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u4e2d\u6ca1\u6709\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\u3001\u6d4b\u8bd5\u6267\u884c\u8bb0\u5f55\u3001\u6d41\u6c34\u7ebf\u7ed3\u679c\u6216\u6784\u5efa\u65e5\u5fd7\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u6d4b\u8bd5\u5df2\u7ecf\u901a\u8fc7\u3002PR \u5f53\u524d\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\uff0c\u4f46\u8be5\u5b57\u6bb5\u4e0d\u7b49\u540c\u4e8e\u6240\u6709 CI \u7b56\u7565\u6216\u6d4b\u8bd5\u5747\u6210\u529f\u3002\n\n\u5efa\u8bae\u9488\u5bf9 [`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/778780?path=/sample/extensions/server-extensions/Terminal/package-lock.json&_a=files) \u6240\u5728\u76ee\u5f55\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n- \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node.js/npm \u7248\u672c\u6267\u884c\u5e72\u51c0\u5b89\u88c5\uff0c\u786e\u8ba4\u5185\u90e8 feed \u53ef\u89e3\u6790\u6240\u6709\u65b0\u5236\u54c1\u4e14\u5b8c\u6574\u6027\u6821\u9a8c\u901a\u8fc7\u3002\n- \u8fd0\u884c Terminal \u670d\u52a1\u7aef\u6269\u5c55\u793a\u4f8b\u73b0\u6709\u7684\u6784\u5efa\u548c\u6d4b\u8bd5\u547d\u4ee4\u3002\n- \u6267\u884c\u9879\u76ee\u5b9e\u9645\u4f7f\u7528\u7684 Browserslist \u67e5\u8be2\u5e76\u5bf9\u6bd4\u5347\u7ea7\u524d\u540e\u7684\u76ee\u6807\u5217\u8868\u3002\n- \u5728\u53d7\u652f\u6301\u7684\u6700\u4f4e Node.js \u7248\u672c\u4e0a\u9a8c\u8bc1\u5b89\u88c5\uff0c\u91cd\u70b9\u786e\u8ba4 `node-releases@2.0.54` \u7684 `node >=18` \u8981\u6c42\u662f\u5426\u53ef\u63a5\u53d7\u3002\n- \u91cd\u65b0\u8fd0\u884c Component Governance \u626b\u63cf\uff0c\u786e\u8ba4\u4e24\u4e2a\u9ad8\u5371\u544a\u8b66\u5df2\u5173\u95ed\u4e14\u672a\u5f15\u5165\u65b0\u7684\u6cbb\u7406\u544a\u8b66\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\u4e0e\u622a\u65ad\u8bf4\u660e\n\n- **\u4ee3\u7801 diff \u8986\u76d6\u5b8c\u6574\uff1a** \u6570\u636e\u5305\u6807\u8bb0\u6587\u4ef6 diff \u7684 `truncated` \u4e3a `false`\uff0c\u6574\u4f53 `diffTruncated` \u4e5f\u4e3a `false`\uff1b1 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u6709 diff\uff0c\u5305\u5185\u672a\u62a5\u544a\u5bfc\u51fa\u9519\u8bef\u6216\u8b66\u544a\u3002\u56e0\u6b64\uff0c\u4e0a\u8ff0\u4ee3\u7801\u53d8\u66f4\u5206\u6790\u8986\u76d6\u4e86\u6570\u636e\u5305\u63d0\u4f9b\u7684\u5168\u90e8\u6587\u4ef6\u5dee\u5f02\u3002\n- **PR \u63cf\u8ff0\u5185\u5bb9\u4e0d\u5b8c\u6574\uff1a** \u6570\u636e\u5305\u4e2d\u7684 PR \u63cf\u8ff0\u5728 Browserslist \u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u4e2d\u4ee5 `...` \u622a\u65ad\uff0c\u540e\u7eed\u53d1\u5e03\u8bf4\u660e\u4e0d\u5728\u5305\u5185\u3002\u672c\u8bf4\u660e\u53ea\u5f15\u7528\u622a\u65ad\u524d\u660e\u786e\u51fa\u73b0\u7684\u4fee\u590d\u9879\uff0c\u4e0d\u63a8\u65ad\u7f3a\u5931\u90e8\u5206\u3002\n- **\u4e0a\u4e0b\u6587\u9650\u5236\uff1a** \u6570\u636e\u5305\u6ca1\u6709\u63d0\u4f9b\u5b8c\u6574\u7684 `package.json`\u3001Browserslist \u914d\u7f6e\u3001\u6784\u5efa\u811a\u672c\u3001\u6d41\u6c34\u7ebf\u6267\u884c\u7ed3\u679c\u6216\u4ed3\u5e93\u5176\u4ed6\u76ee\u5f55\u5185\u5bb9\uff0c\u56e0\u6b64\u672a\u5bf9\u8fd9\u4e9b\u7f3a\u5931\u5185\u5bb9\u4f5c\u51fa\u5df2\u9a8c\u8bc1\u7ed3\u8bba\u3002\n", "creation_timestamp": "2026-09-09T00:19:56.992246Z"}, {"uuid": "79268f80-ef74-4faa-943c-e9db903faf56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73088", "type": "seen", "source": "https://bsky.app/profile/aksharadev.bsky.social/post/3mvas2hutfa2s", "content": "django-jet-3-calm 5.5.2 is out \ud83d\udd12\n\nsecurity patch: browserslist \u2192 4.28.9 (CVE-2026-73088) and decode-uri-component pinned to 0.5.0 (ReDoS, CVE-2026-45822). drop-in upgrade.\n\ngithub.com/aksharahegde/django-jet-3-calm/blob/main/CHANGELOG.md", "creation_timestamp": "2026-09-11T14:36:02.134497Z"}]}