{"uuid": "5141a60f-5021-41e1-bd58-6518140603c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14257", "type": "seen", "source": "https://gist.github.com/djlan/5f36a7e602ac41dbecc35abef4cb589b", "content": "# PR 766453\uff1a\u4fee\u590d `brace-expansion` \u6f0f\u6d1e\uff08CVE-2026-14257\uff09\n\n> **\u4e00\u53e5\u8bdd\u603b\u7ed3\uff1a** \u6b64 PR \u901a\u8fc7\u91cd\u65b0\u89e3\u6790 20 \u4e2a npm \u9501\u6587\u4ef6\uff0c\u5c06\u53d7\u5f71\u54cd\u7684 `brace-expansion` \u4f20\u9012\u4f9d\u8d56\u5347\u7ea7\u5230\u5df2\u4fee\u590d\u7248\u672c\uff0c\u4ee5\u6d88\u9664\u6076\u610f\u82b1\u62ec\u53f7\u5c55\u5f00\u8f93\u5165\u53ef\u80fd\u89e6\u53d1\u7684\u5185\u5b58\u8017\u5c3d\u578b\u62d2\u7edd\u670d\u52a1\u98ce\u9669\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [766453](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453) |\n| \u539f\u59cb\u6807\u9898 | `[SECURITY][SFI] Resolve Vulnerability in brace-expansion (CVE-2026-14257)` |\n| \u4f5c\u8005 | Agency |\n| \u72b6\u6001 | Active\uff0c\u975e Draft\uff1b\u5305\u4e2d\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `copilot/api-690bd71d-28f2e587` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-05 09:49:53\uff08\u5206\u6790\u5305\u539f\u59cb\u65f6\u95f4\u683c\u5f0f\u672a\u6ce8\u660e\u65f6\u533a\uff09 |\n| \u53d8\u66f4\u7edf\u8ba1 | 20 \u4e2a\u6587\u4ef6\uff0c\u7ea6 +182 / -204 \u884c\uff1b2 \u4e2a\u63d0\u4ea4\uff0c3 \u6b21\u8fed\u4ee3 |\n| \u5dee\u5f02\u6570\u636e | \u672c\u5730 Git \u5dee\u5f02\u5171 51,947 \u5b57\u8282\uff1b20/20 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u6709\u5b8c\u6574 diff |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5de5\u4f5c\u539f\u7406](#\u5de5\u4f5c\u539f\u7406)\n4. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n5. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n6. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n7. [\u5dee\u5f02\u8986\u76d6\u8303\u56f4](#\u5dee\u5f02\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5 PR \u9488\u5bf9 Component Governance \u8b66\u62a5 15766343 / CVE-2026-14257\u3002\u5206\u6790\u5305\u4e2d\u7684 PR \u63cf\u8ff0\u6307\u51fa\uff0c\u6f0f\u6d1e\u6e90\u4e8e `brace-expansion` \u7684\u5c55\u5f00\u903b\u8f91\u9650\u5236\u4e86\u7ed3\u679c\u6570\u91cf\uff0c\u5374\u6ca1\u6709\u5145\u5206\u9650\u5236\u5355\u4e2a\u7ed3\u679c\u7684\u957f\u5ea6\uff1b\u7279\u5236\u7684\u5c0f\u578b\u8f93\u5165\u53ef\u80fd\u4ee4 Node.js \u8fdb\u7a0b\u56e0\u5185\u5b58\u8017\u5c3d\u800c\u5d29\u6e83\u3002\n\n\u4fee\u6539\u6ca1\u6709\u8c03\u6574\u4efb\u4f55 `package.json` \u6216\u4e1a\u52a1\u6e90\u4ee3\u7801\uff0c\u800c\u662f\u66f4\u65b0\u5404 npm \u9879\u76ee\u7684 `package-lock.json`\u3002\u4e3b\u8981\u53d7\u5f71\u54cd\u7684 1.x \u4f9d\u8d56\u4ece `1.1.11` \u6216 `1.1.16` \u63d0\u5347\u81f3 `1.1.18`\uff0c\u9ad8\u4e8e PR \u63cf\u8ff0\u6240\u5217\u7684 `>=1.1.17` \u4fee\u590d\u4e0b\u9650\u3002\u9501\u6587\u4ef6\u540c\u65f6\u66f4\u65b0\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u6458\u8981\uff0c\u786e\u4fdd\u540e\u7eed\u5b89\u88c5\u5b9e\u9645\u83b7\u53d6\u65b0\u7248\u672c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u590d\u7528\u65e7 tarball\u3002\n\n\u9664 1.x \u4fee\u590d\u5916\uff0c\u90e8\u5206\u4f9d\u8d56\u6811\u8fd8\u5c06 `brace-expansion` 2.x \u4ece `2.0.1`\u3001`2.0.2` \u6216 `2.1.1` \u7edf\u4e00\u5230 `2.1.4`\uff1b`NotebookExtensions` \u4e2d\u591a\u4e2a 5.x \u5b9e\u4f8b\u4ece `5.0.4`/`5.0.6` \u66f4\u65b0\u5230 `5.0.9`\u3002\u8fd9\u4e9b\u53d8\u5316\u8868\u660e\u6267\u884c\u9501\u6587\u4ef6\u66f4\u65b0\u65f6\uff0cnpm \u5bf9\u6ee1\u8db3\u73b0\u6709\u7248\u672c\u8303\u56f4\u7684\u591a\u4e2a `brace-expansion` \u5206\u652f\u90fd\u8fdb\u884c\u4e86\u91cd\u65b0\u89e3\u6790\uff0c\u800c\u4e0d\u53ea\u662f\u66ff\u6362\u5355\u4e00 1.x \u8282\u70b9\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u793a\u4f8b\u6e32\u67d3\u5668\u4e0e\u5bbf\u4e3b\u5e94\u7528\n\n\u6d89\u53ca\u6587\u4ef6\uff1a\n\n- [`sample/aznb-custom-renderer-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/aznb-custom-renderer-sample/package-lock.json&_a=files)\n- [`sample/aznb-helloworld-output-renderer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files)\n- [`sample/extension-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extension-sample/package-lock.json&_a=files)\n- [`sample/react-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/react-host-app/package-lock.json&_a=files)\n\n\u8fd9\u4e9b\u793a\u4f8b\u9879\u76ee\u7684\u9501\u6587\u4ef6\u5c06 1.x `brace-expansion` \u66f4\u65b0\u5230 `1.1.18`\u3002\u5176\u4e2d\u81ea\u5b9a\u4e49\u6e32\u67d3\u5668\u539f\u6765\u5df2\u4f7f\u7528 `1.1.16`\uff0c\u5176\u4f59\u9879\u76ee\u4e3b\u8981\u4ece `1.1.11` \u5347\u7ea7\u3002React \u5bbf\u4e3b\u5e94\u7528\u8fd8\u628a `filelist` \u4e0b\u7684 2.x \u5b9e\u4f8b\u4ece `2.0.1` \u66f4\u65b0\u4e3a `2.1.4`\u3002\n\nHello World \u8f93\u51fa\u6e32\u67d3\u5668\u7684\u9501\u6587\u4ef6\u53d8\u5316\u8303\u56f4\u66f4\u5927\uff1anpm \u5728\u5347\u7ea7\u76ee\u6807\u5305\u65f6\u8fd8\u53bb\u9664\u4e86 `fs-extra`\u3001`jsonfile`\u3001`unzipper` \u4e0b\u91cd\u590d\u7684 `graceful-fs 4.2.10` \u8282\u70b9\uff0c\u5e76\u4e3a\u82e5\u5e72\u65e7\u5f0f\u9501\u6587\u4ef6\u6761\u76ee\u8865\u5145\u7a7a\u7684 `requires` \u5bf9\u8c61\u3002\u8fd9\u770b\u8d77\u6765\u5c5e\u4e8e\u9501\u6587\u4ef6\u4f9d\u8d56\u53bb\u91cd\u548c\u5e8f\u5217\u5316\u7ed3\u679c\uff0c\u800c\u975e\u5e94\u7528\u4ee3\u7801\u884c\u4e3a\u8c03\u6574\uff0c\u4f46\u4f1a\u6539\u53d8\u6700\u7ec8\u5b89\u88c5\u6811\u7684\u7269\u7406\u5e03\u5c40\uff0c\u56e0\u6b64\u5e94\u7eb3\u5165\u5b89\u88c5\u4e0e\u6784\u5efa\u9a8c\u8bc1\u3002\n\n### 2. \u901a\u7528\u5ba2\u6237\u7aef\u6269\u5c55\u793a\u4f8b\n\n\u6d89\u53ca\u6587\u4ef6\uff1a\n\n- [`sample/extensions/common-extensions/AzNB.Gather/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/AzNB.Gather/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/AzNB.Spellchecker/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/AzNB.Spellchecker/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/InlineCompletionsTest/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/InlineCompletionsTest/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/MLFunctionGen/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/MLFunctionGen/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/MenuButtonTest/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/MenuButtonTest/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/MetadataViewer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/MetadataViewer/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/Pyforest/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/Pyforest/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/ReverseSelection/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/ReverseSelection/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/ReverseSelectionStateful/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/ReverseSelectionStateful/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/SmartRun/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/SmartRun/package-lock.json&_a=files)\n- [`sample/extensions/common-extensions/StaticViewTest/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/common-extensions/StaticViewTest/package-lock.json&_a=files)\n\n\u8fd9\u4e00\u7ec4\u4fee\u6539\u9ad8\u5ea6\u4e00\u81f4\uff1a\u901a\u8fc7\u73b0\u6709 `minimatch`/`glob` \u7b49\u4e0a\u6e38\u4f9d\u8d56\u5141\u8bb8\u7684\u7248\u672c\u8303\u56f4\uff0c\u628a\u5d4c\u5957\u6216\u9876\u5c42\u7684 `brace-expansion 1.1.11` \u89e3\u6790\u4e3a `1.1.18`\u3002\u90e8\u5206\u73b0\u4ee3 lockfile \u6761\u76ee\u540c\u65f6\u8865\u5145\u4e86 MIT \u8bb8\u53ef\u8bc1\u5143\u6570\u636e\u3002\u6ca1\u6709\u6269\u5c55\u5b9e\u73b0\u4ee3\u7801\u6216\u76f4\u63a5\u4f9d\u8d56\u58f0\u660e\u53d8\u5316\uff0c\u56e0\u6b64\u529f\u80fd\u63a5\u53e3\u4fdd\u6301\u4e0d\u53d8\uff1b\u5b9e\u9645\u6548\u679c\u53d1\u751f\u5728\u5b89\u88c5\u9636\u6bb5\u548c\u540e\u7eed\u6587\u4ef6\u6a21\u5f0f\u5339\u914d\u8c03\u7528\u4e2d\u3002\n\n### 3. \u670d\u52a1\u7aef\u6269\u5c55\u793a\u4f8b\n\n\u6d89\u53ca\u6587\u4ef6\uff1a\n\n- [`sample/extensions/server-extensions/TestFormatting/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/sample/extensions/server-extensions/TestFormatting/package-lock.json&_a=files)\n\n\u8be5\u9879\u76ee\u5c06\u9501\u5b9a\u7684 `brace-expansion 1.1.11` \u66f4\u65b0\u4e3a `1.1.18`\uff0c\u8986\u76d6\u670d\u52a1\u7aef\u683c\u5f0f\u5316\u6269\u5c55\u793a\u4f8b\u7ecf\u4f20\u9012\u4f9d\u8d56\u8c03\u7528\u82b1\u62ec\u53f7\u5c55\u5f00\u903b\u8f91\u7684\u8def\u5f84\u3002\u4fee\u6539\u4ec5\u6d89\u53ca\u9501\u6587\u4ef6\u89e3\u6790\u7ed3\u679c\u3002\n\n### 4. Azure Notebooks \u670d\u52a1\u7ec4\u4ef6\n\n\u6d89\u53ca\u6587\u4ef6\uff1a\n\n- [`src/service/aznb/AzNB.Collab/AzNB.Lobby/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/src/service/aznb/AzNB.Collab/AzNB.Lobby/package-lock.json&_a=files)\n- [`src/service/aznb/AzNB.DataSmarts/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/src/service/aznb/AzNB.DataSmarts/package-lock.json&_a=files)\n- [`src/service/aznb/NotebookLanguageServer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/src/service/aznb/NotebookLanguageServer/package-lock.json&_a=files)\n\nLobby\u3001DataSmarts \u548c Notebook Language Server \u5747\u628a 1.x \u5206\u652f\u5347\u7ea7\u5230 `1.1.18`\u3002\u9501\u6587\u4ef6\u4e2d\u7684\u5305\u6e90\u4ecd\u6307\u5411 AzureNotebooksEntry \u79c1\u6709 npm feed\uff0c\u4ec5\u7248\u672c\u3001\u5b8c\u6574\u6027\u6458\u8981\u53ca\u5c11\u91cf\u751f\u6210\u5143\u6570\u636e\u53d1\u751f\u53d8\u5316\uff0c\u56e0\u6b64\u6ca1\u6709\u6539\u53d8\u5305\u6765\u6e90\u6216\u8ba4\u8bc1\u65b9\u5f0f\u3002\n\n### 5. NotebookExtensions \u591a\u5305\u5de5\u4f5c\u533a\n\n\u6d89\u53ca\u6587\u4ef6\uff1a\n\n- [`src/service/aznb/NotebookExtensions/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766453?path=/src/service/aznb/NotebookExtensions/package-lock.json&_a=files)\n\n\u8fd9\u662f\u53d8\u66f4\u6700\u590d\u6742\u7684\u9501\u6587\u4ef6\u3002\u5b83\u540c\u65f6\u66f4\u65b0\u4e86\u591a\u6761 `brace-expansion` \u4f9d\u8d56\u94fe\uff1a\n\n| \u5206\u652f | \u539f\u7248\u672c | \u65b0\u7248\u672c | \u5178\u578b\u4e0a\u6e38 |\n|---|---|---|---|\n| 1.x | `1.1.11` | `1.1.18` | \u9876\u5c42/\u65e7\u7248 `minimatch` \u94fe |\n| 2.x | `2.0.1`\u3001`2.0.2`\u3001`2.1.1` | `2.1.4` | `filelist`\u3001`cacache`\u3001TypeScript ESLint\u3001`rimraf` |\n| 5.x | `5.0.4`\u3001`5.0.6` | `5.0.9` | npm CLI\u3001Nx\u3001TUF\u3001workspace/ignore-walk \u76f8\u5173\u94fe |\n\nnpm \u8fd8\u91cd\u65b0\u6807\u8bb0\u4e86\u82e5\u5e72 workspace \u4e0e\u5de5\u5177\u4f9d\u8d56\u7684 `dev` \u5c5e\u6027\u3002\u4e24\u4e2a\u53ef\u9009\u4f9d\u8d56 `encoding`\u3001`iconv-lite` \u7684 `dev` \u6807\u8bb0\u88ab\u79fb\u9664\uff0c\u5176\u4ed6\u6d4b\u8bd5\u3001XML \u548c\u5de5\u5177\u76f8\u5173\u5305\u5219\u65b0\u589e `dev: true`\u3002\u8fd9\u4e0d\u4f1a\u6539\u5199\u5305\u7248\u672c\uff0c\u4f46\u53ef\u80fd\u5f71\u54cd\u751f\u4ea7\u6a21\u5f0f\u5b89\u88c5\u65f6 npm \u5bf9\u4f9d\u8d56\u7684\u88c1\u526a\u5224\u65ad\u3002\n\n\u503c\u5f97\u6ce8\u610f\u7684\u662f\uff0c`brace-expansion 5.0.9` \u7684\u9501\u6587\u4ef6\u5143\u6570\u636e\u628a Node.js \u5f15\u64ce\u8981\u6c42\u4ece `18 || 20 || >=22` \u6536\u7d27\u4e3a `20 || >=22`\u3002\u56e0\u6b64\u5373\u4f7f\u672c PR \u7684\u6838\u5fc3\u5b89\u5168\u4fee\u590d\u9488\u5bf9 1.x\uff0c`NotebookExtensions` \u7684\u4f9d\u8d56\u6811\u91cd\u7b97\u4e5f\u5f15\u5165\u4e86\u660e\u786e\u7684 Node.js 18 \u517c\u5bb9\u6027\u5173\u6ce8\u70b9\u3002\n\n## \u5de5\u4f5c\u539f\u7406\n\n1. `brace-expansion` \u662f `minimatch`\u3001`glob`\u3001`rimraf`\u3001npm/Nx \u5de5\u5177\u94fe\u7b49\u7ec4\u4ef6\u7528\u4e8e\u5c55\u5f00 `{a,b}` \u6216\u8303\u56f4\u8868\u8fbe\u5f0f\u7684\u5e95\u5c42\u4f9d\u8d56\u3002\n2. \u5404\u9879\u76ee\u7684\u76f4\u63a5\u4f9d\u8d56\u7248\u672c\u8303\u56f4\u5df2\u7ecf\u5141\u8bb8\u91c7\u7528\u4fee\u590d\u540e\u7684\u7248\u672c\uff0c\u6240\u4ee5\u65e0\u9700\u4fee\u6539 `package.json` \u6216\u589e\u52a0 `overrides`\u3002\n3. \u66f4\u65b0 `package-lock.json` \u540e\uff0c`npm ci`/`npm install` \u4f1a\u6839\u636e\u9501\u5b9a\u7248\u672c\u3001\u79c1\u6709 feed URL \u548c\u65b0\u7684\u5b8c\u6574\u6027\u6458\u8981\u4e0b\u8f7d\u4fee\u590d\u7248\u3002\n4. \u5e94\u7528\u4e0e\u5de5\u5177\u4ecd\u901a\u8fc7\u539f\u6709\u4e0a\u6e38\u5305\u8c03\u7528\u76f8\u540c API\uff1b\u5b89\u5168\u4fee\u590d\u7531\u66f4\u65b0\u540e\u7684\u4f20\u9012\u4f9d\u8d56\u5b9e\u73b0\uff0c\u56e0\u6b64\u4e0d\u9700\u8981\u4e1a\u52a1\u4ee3\u7801\u63a5\u5165\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u5b89\u5168\u5f71\u54cd\n\n\u4e3b\u8981\u6536\u76ca\u662f\u79fb\u9664\u9501\u6587\u4ef6\u4e2d\u5df2\u77e5\u6613\u53d7\u653b\u51fb\u7684\u65e7\u7248 1.x \u5b9e\u4f8b\uff0c\u5e76\u5c06\u5176\u63d0\u5347\u5230 PR \u63cf\u8ff0\u58f0\u660e\u7684\u4fee\u590d\u4e0b\u9650\u4ee5\u4e0a\u3002\u8fd9\u964d\u4f4e\u4e86\u53ef\u63a7\u6a21\u5f0f\u5b57\u7b26\u4e32\u5bfc\u81f4\u8fdb\u7a0b\u5185\u5b58\u8017\u5c3d\u548c\u62d2\u7edd\u670d\u52a1\u7684\u98ce\u9669\u3002\u5305\u4e2d\u6ca1\u6709\u6f0f\u6d1e\u5229\u7528\u6d4b\u8bd5\u6216\u6f0f\u6d1e\u5b9e\u73b0\u7ec6\u8282\uff0c\u56e0\u800c\u65e0\u6cd5\u8fdb\u4e00\u6b65\u5224\u65ad\u5404\u5e94\u7528\u8def\u5f84\u662f\u5426\u53ef\u7531\u4e0d\u53ef\u4fe1\u8f93\u5165\u76f4\u63a5\u89e6\u8fbe\u3002\n\n### \u529f\u80fd\u5f71\u54cd\n\n\u6ca1\u6709\u4e1a\u52a1\u6e90\u4ee3\u7801\u3001\u516c\u5171 API\u3001\u914d\u7f6e\u6587\u4ef6\u6216 `package.json` \u53d8\u5316\uff0c\u9884\u671f\u529f\u80fd\u884c\u4e3a\u4fdd\u6301\u4e0d\u53d8\u3002\u53ef\u80fd\u89c2\u5bdf\u5230\u7684\u5dee\u5f02\u4ec5\u6765\u81ea\u65b0\u7248\u672c\u5bf9\u6781\u7aef\u6216\u5f02\u5e38\u82b1\u62ec\u53f7\u8868\u8fbe\u5f0f\u7684\u5904\u7406\uff0c\u4ee5\u53ca npm \u5b89\u88c5\u6811\u7684\u53bb\u91cd/\u5206\u7c7b\u53d8\u5316\u3002\n\n### \u6784\u5efa\u4e0e\u90e8\u7f72\u5f71\u54cd\n\n\u6240\u6709\u9501\u5b9a tarball \u4ecd\u6765\u81ea\u540c\u4e00 Azure DevOps \u79c1\u6709 feed\u3002\u6784\u5efa\u73af\u5883\u5fc5\u987b\u80fd\u83b7\u53d6\u65b0\u589e\u7248\u672c `1.1.18`\u3001`2.1.4` \u548c `5.0.9`\u3002`NotebookExtensions` \u82e5\u4ecd\u5728 Node.js 18 \u4e0a\u6267\u884c\u4e25\u683c\u5f15\u64ce\u68c0\u67e5\uff0c5.x \u66f4\u65b0\u53ef\u80fd\u4ea7\u751f\u5b89\u88c5\u8b66\u544a\u6216\u5931\u8d25\uff1bNode.js 20 \u6216\u66f4\u9ad8\u7248\u672c\u4e0d\u53d7\u8be5\u65b0\u589e\u7ea6\u675f\u5f71\u54cd\u3002\n\n### \u8fd0\u7ef4\u5f71\u54cd\n\n\u4e0d\u6d89\u53ca\u8fd0\u884c\u65f6\u914d\u7f6e\u3001\u6570\u636e\u8fc1\u79fb\u3001\u670d\u52a1\u63a5\u53e3\u6216\u90e8\u7f72\u6e05\u5355\u3002\u5b89\u5168\u626b\u63cf\u5e94\u5728\u91cd\u65b0\u89e3\u6790\u7ec4\u4ef6\u6e05\u5355\u540e\u5173\u95ed\u5bf9\u5e94\u8b66\u62a5\uff0c\u4f46\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u626b\u63cf\u5668\u590d\u68c0\u7ed3\u679c\uff0c\u56e0\u6b64\u4e0d\u80fd\u636e\u6b64\u786e\u8ba4\u8b66\u62a5\u5df2\u7ecf\u6b63\u5f0f\u5173\u95ed\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669 | \u7ea7\u522b | \u4f9d\u636e\u4e0e\u5efa\u8bae |\n|---|---|---|\n| `NotebookExtensions` \u7684 Node.js 18 \u517c\u5bb9\u6027 | \u4e2d | `brace-expansion 5.0.9` \u7684\u5f15\u64ce\u58f0\u660e\u4e3a `20 || >=22`\u3002\u5e94\u786e\u8ba4\u8be5\u5de5\u4f5c\u533a\u53ca CI \u4e0d\u4f9d\u8d56 Node.js 18\uff0c\u6216\u81f3\u5c11\u9a8c\u8bc1\u5f53\u524d npm \u914d\u7f6e\u4e0d\u4f1a\u56e0 engine-strict \u800c\u5931\u8d25\u3002 |\n| \u9501\u6587\u4ef6\u66f4\u65b0\u8303\u56f4\u5927\u4e8e\u5355\u4e00\u6f0f\u6d1e\u7248\u672c\u66ff\u6362 | \u4e2d | `NotebookExtensions` \u540c\u65f6\u66f4\u65b0 2.x/5.x \u5206\u652f\u5e76\u8c03\u6574\u591a\u9879 `dev` \u6807\u8bb0\uff1bHello World \u6e32\u67d3\u5668\u8fd8\u6267\u884c\u4e86 `graceful-fs` \u53bb\u91cd\u3002\u9700\u7528\u5e72\u51c0\u73af\u5883\u5b89\u88c5\u5e76\u8fd0\u884c\u5bf9\u5e94\u6784\u5efa/\u6d4b\u8bd5\uff0c\u786e\u8ba4\u751f\u4ea7\u4f9d\u8d56\u88c1\u526a\u7ed3\u679c\u4e00\u81f4\u3002 |\n| \u4ec5\u4fee\u6539 lockfile | \u4f4e | \u4f9d\u8d56\u8303\u56f4\u5141\u8bb8\u66f4\u65b0\u662f\u672c\u65b9\u6848\u6210\u7acb\u7684\u524d\u63d0\uff1b\u5982\u679c\u67d0\u4e9b\u6d41\u6c34\u7ebf\u4e0d\u7528\u9501\u6587\u4ef6\u6216\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\uff0c\u53ef\u80fd\u89e3\u6790\u5230\u4e0d\u540c\u7248\u672c\u3002\u5e94\u786e\u4fdd CI/\u53d1\u5e03\u6d41\u7a0b\u4f7f\u7528\u63d0\u4ea4\u7684 lockfile\u3002 |\n| \u591a\u9879\u76ee\u8986\u76d6\u9057\u6f0f | \u4f4e | \u5305\u5185\u5217\u51fa\u7684 20 \u4e2a\u53d7\u5f71\u54cd\u4e14\u53d7\u7248\u672c\u63a7\u5236\u7684\u9501\u6587\u4ef6\u5747\u5df2\u4fee\u6539\uff1bPR \u63cf\u8ff0\u79f0 `/dst/NotebookLanguageServer` \u548c `/out/NotebookLanguageServer` \u4e0b\u7684\u6784\u5efa\u8f93\u51fa\u9501\u6587\u4ef6\u672a\u7eb3\u5165\u7248\u672c\u63a7\u5236\u3002\u5206\u6790\u5305\u65e0\u6cd5\u9a8c\u8bc1\u4ed3\u5e93\u4e2d\u662f\u5426\u8fd8\u5b58\u5728\u5176\u4ed6\u672a\u5217\u51fa\u7684\u9501\u6587\u4ef6\u3002 |\n| \u79c1\u6709 feed \u53ef\u7528\u6027 | \u4f4e | \u65b0\u7248\u672c\u7684 `resolved` URL \u6307\u5411\u73b0\u6709 AzureNotebooksEntry feed\u3002\u82e5 feed \u672a\u540c\u6b65\u76f8\u5e94 tarball\uff0c\u5e72\u51c0\u5b89\u88c5\u4f1a\u5931\u8d25\uff1b\u5e94\u4ee5 CI \u7684\u65e0\u7f13\u5b58\u5b89\u88c5\u7ed3\u679c\u4e3a\u51c6\u3002 |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u4e2d\u7684 PR \u63cf\u8ff0\u58f0\u660e\u5df2\u5b8c\u6210\u4ee5\u4e0b\u68c0\u67e5\uff1a\n\n- \u53d7\u8ddf\u8e2a\u9501\u6587\u4ef6\u4e2d\u4e0d\u518d\u5f15\u7528 `brace-expansion-1.1.11.tgz`\u3002\n- 20 \u4e2a\u9501\u6587\u4ef6\u7684 1.x \u5b9e\u4f8b\u5747\u89e3\u6790\u5230 `1.1.18`\u3002\n- \u6587\u4ef6\u8303\u56f4\u3001\u7248\u672c\u65b9\u5411\u3001JSON \u8bed\u6cd5\u3001\u5305\u6e90\u5206\u7c7b\u53ca\u8bed\u4e49\u9a8c\u8bc1\u95e8\u7981\u901a\u8fc7\u3002\n- \u672a\u4fee\u6539 `.npmrc`\u3001`NuGet.Config`\uff0c\u4e5f\u672a\u52a0\u5165 `SYSTEM_ACCESSTOKEN` \u5f15\u7528\u3002\n\n\u8fd9\u4e9b\u662f PR \u63cf\u8ff0\u4e2d\u7684\u9a8c\u8bc1\u7ed3\u8bba\uff1b\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u6d41\u6c34\u7ebf\u8fd0\u884c\u3001\u6784\u5efa\u65e5\u5fd7\u3001\u5355\u5143\u6d4b\u8bd5\u7ed3\u679c\u6216 Component Governance \u590d\u626b\u7ed3\u679c\u3002\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u5df2\u72ec\u7acb\u786e\u8ba4\u5b8c\u6574\u6784\u5efa\u3001\u8fd0\u884c\u65f6\u56de\u5f52\u6d4b\u8bd5\u6216\u5b89\u5168\u8b66\u62a5\u5173\u95ed\u3002\u7279\u522b\u5efa\u8bae\u5173\u6ce8\uff1a\n\n1. \u5bf9 20 \u4e2a\u9879\u76ee\u6267\u884c\u57fa\u4e8e\u9501\u6587\u4ef6\u7684\u5e72\u51c0\u5b89\u88c5\u3002\n2. \u81f3\u5c11\u6784\u5efa\u5e76\u6d4b\u8bd5 `NotebookExtensions` \u4e0e Hello World \u8f93\u51fa\u6e32\u67d3\u5668\uff0c\u56e0\u4e3a\u4e24\u8005\u5b58\u5728\u76ee\u6807\u5305\u7248\u672c\u66ff\u6362\u4e4b\u5916\u7684\u9501\u6811\u53d8\u5316\u3002\n3. \u5728 Node.js 18\uff08\u82e5\u4ecd\u53d7\u652f\u6301\uff09\u548c\u5f53\u524d\u6b63\u5f0f\u6784\u5efa Node.js \u7248\u672c\u4e0a\u9a8c\u8bc1 `NotebookExtensions`\u3002\n4. \u91cd\u65b0\u8fd0\u884c Component Governance \u626b\u63cf\uff0c\u786e\u8ba4\u8b66\u62a5 15766343 \u88ab\u5173\u95ed\u4e14\u672a\u5f15\u5165\u65b0\u7684\u7ec4\u4ef6\u544a\u8b66\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u8303\u56f4\n\n\u5206\u6790\u5305\u58f0\u660e `diffTruncated: false`\uff0c\u5e76\u4e14 20 \u4e2a `changedFiles` \u5747\u6709\u5bf9\u5e94 diff\uff0c\u6240\u6709\u5355\u6587\u4ef6\u5dee\u5f02\u4e5f\u90fd\u6807\u8bb0\u4e3a `truncated: false`\u3002\u603b\u5dee\u5f02\u5927\u5c0f\u4e3a 51,947 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5305\u8bb0\u5f55\u7684 524,288 \u5b57\u8282\u603b\u4e0a\u9650\uff1b\u6700\u5927\u7684\u5355\u6587\u4ef6\u5dee\u5f02\u4e5f\u4f4e\u4e8e 65,536 \u5b57\u8282\u5355\u6587\u4ef6\u4e0a\u9650\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u4e2d\u63d0\u4f9b\u7684\u5168\u90e8\u6587\u4ef6\u5dee\u5f02\uff0c\u6ca1\u6709\u56e0\u622a\u65ad\u800c\u7f3a\u5931\u7684\u5df2\u77e5\u7247\u6bb5\u3002\n\n\u8986\u76d6\u7ed3\u8bba\u53ea\u9002\u7528\u4e8e\u8be5 JSON \u5206\u6790\u5305\uff1a\u672c\u8bf4\u660e\u6ca1\u6709\u8bfb\u53d6\u5305\u5916\u7684\u4ed3\u5e93\u6587\u4ef6\u3001\u6d41\u6c34\u7ebf\u65e5\u5fd7\u3001PR \u8ba8\u8bba\u6216\u5b89\u5168\u626b\u63cf\u8be6\u60c5\uff0c\u4e5f\u4e0d\u5bf9\u8fd9\u4e9b\u672a\u63d0\u4f9b\u5185\u5bb9\u4f5c\u63a8\u65ad\u3002\n", "creation_timestamp": "2026-08-31T16:13:56.282919Z"}