Generate cylc8 syntax

Description
The python code which generates the cylc configuration files was generating cylc 7 compliant configurations.
Cylc 7 is deprecated, and cylc 8 is being used on derecho. So the files which generate the cylc configurations need to be updated.
Issue closed
Issue 267
Closes #(if applicable)
Tests completed
Tier 1:

[x] 3dvar_OIE120km_WarmStart
[x] 3denvar_OIE120km_IAU_WarmStart
[x] 3dvar_OIE120km_ColdStart
[x] 3dvar_O30kmIE60km_ColdStart
[x] 3denvar_O30kmIE60km_WarmStart
[x]  4denvar_OIE120km_WarmStart
[x] eda_OIE120km_WarmStart
[x] getkf_OIE120km_WarmStart
[x] ForecastFromGFSAnalysesMPT

Tier 2 (optional):

[ ] GenerateGFSAnalyses
[ ] GenerateObs

Issues to be addressed
The changes will eliminate the following warning messages, which are generated when running cylc validate

WARNING - deprecated graph items were automatically upgraded in "workflow definition":

(8.0.0) [scheduling][dependencies][X]graph -> [scheduling][graph]X - for X in:
T00

WARNING -  * (8.0.0) [runtime][BATCH][job]execution time limit -> [runtime][BATCH]execution time limit - value unchanged
WARNING -  * (8.0.0) [runtime][LinkExternalAnalysis-120km-0hr][job]execution retry delays -> [runtime][LinkExternalAnalysis-120km-0hr]execution retry delays - value unchanged
WARNING -  * (8.0.0) [scheduling]max active cycle points -> [scheduling]runahead limit - "4" -> "P3"
WARNING - The event handler template variable "%(suite)s" is deprecated - use "%(workflow)s" instead.
WARNING -  * (8.0.0) [runtime][root][events]submission timeout handler -> [runtime][root][events]submission timeout handlers - value unchanged
WARNING -  * (8.0.0) [cylc] -> [scheduler] - value unchanged
WARNING -  * (8.0.0) [visualization] - DELETED (OBSOLETE)
WARNING - deprecated settings found (please replace with [runtime][BATCH]platform):
[runtime][BATCH][job]batch system = pbs

@liujake Do we want these changes (after they are approved) to get merged into develop, and then tag v2.1.0?

Ok with me to merge. But I think we'd better to have @RGNystrom 's fix about hourly output before making a 2.1.0 branch/tag. You could experiment with the develop branch for now, which works with 2.1 bundle code.


Extended Gemm interface to support mixed precision operations

Extend Gemm operator interface to support mixed precision operations, namely by decoupling matrix A and B type element_in_t from output matrix C and scalars alpha and beta type element_out_t.
Following oneMKL's spec notation for Gemm API : https://spec.oneapi.io/versions/latest/elements/oneMKL/source/domains/blas/gemm.html#onemkl-blas-gemm, this PR enables (Ta==Tb) to be set independently from (Tc==Ts). This feature has been enabled at a first stage for Ta=Tb=sycl::half and Tc=Ts=float. Thus enabling half support also enables the mixed precision case of (half, float) for gemm.
Changes include:

Updating different Gemm kernel implementations to account for the decoupled types.
Necessary CMake and Kernel generation scripts updates to account for the couple of types instead of single type in gemm case.
Necessary changes to unit-tests to account for this feature in the Gemm case.

Note :
Following oneMKL expected Gemm API, Support of bfloat16-float  and std::int8_t-float would be straightforward afterwards, but the additional cases of Ta==Tb==Tc while Ts (alpha & beta) is separate will require additional decoupling & re-design work..

@s-Nick @Rbiessy @hjabird I've rebased and fixed some bugs in the current PR after recent commits. Feel free to check it ! Thanks.


Upgrade itertools to 0.7

That matches the version in prost-derive to not depend on two version of the itertools crate.

Thanks!


fix(close) state.bufnr is now cleared when the spectre buffer is closed.

require("spectre").close() doesn't work fine when mixed with toggle. This PR fixes it. Related to #148
M.toggle = function(opts)
    if state.bufnr ~= nil then M.close()
    else M.open(opts) end
end

M.close = function()
    if state.bufnr ~= nil then
        local wins = vim.fn.win_findbuf(state.bufnr)
        for _, win_id in pairs(wins) do
            vim.api.nvim_win_close(win_id, true);
        end
        state.bufnr = nil -- By having this line here instead of in toggle, we ensure the state is always cleared once the buffer cease existing.
    end
end

LGTM

@Zeioth @EpsilonKu Okay, after some testing, it seems like this PR introduced a bug where calling the close method causes an error to be thrown when writing to the buffer in certain situations.

To reproduce,

Select any word and run
:lua require("spectre").open_visual { select_word = true } or
:lua require("spectre").open_visual { select_word = true }
Close spectre with :lua require("spectre").close()
Write to file with :w
Error is thrown:

Error detected while processing BufWritePost Autocommands for "*":
Error executing lua callback: ....local/share/nvim/lazy/nvim-spectre/lua/spectre/init.lua:611: Expected Lua number
stack traceback:
	[C]: in function 'nvim_buf_clear_namespace'
	....local/share/nvim/lazy/nvim-spectre/lua/spectre/init.lua:611: in function 'search'
	....local/share/nvim/lazy/nvim-spectre/lua/spectre/init.lua:313: in function <....local/share/nvim/lazy/nvim-spectre/lua/spectre/init.lua:311>

@Subjective What is ur version of nvim? I can't reproduce it.

@Subjective I've followed all the steps with that lorem ipsum and I cannot repro either. Do you still experience it after deleting the plugin and reinstalling it from main?
My nvim version is NVIM v0.10.0-dev-549+g8d4a53fe6 (AUR, neovim-git)

I found a different bug though: I sometimes get this error when searching in my personal directory. I imagine there is some file spectre is not capable of reading. I've never found this bug during my normal usage of spectre, just be aware it is there:

@Zeioth @EpsilonKu Sorry, I forgot to mention that I have live_update enabled to refresh spectre when saving a file. Could you try adding this to your opts table?
opts = {
  live_update = true
}

I found a different bug though: I sometimes get this error when searching in my personal directory.

Yeah, I also get that error. I can consistently reproduce it by searching through a file without any extensions.

With live_update I can repro.

The traceback poins to:
https://github.com/nvim-pack/nvim-spectre/blob/1ef252c1bf569b88e7e2fafde1eb0861d4f06aa3/lua/spectre/init.lua#L199
https://github.com/nvim-pack/nvim-spectre/blob/1ef252c1bf569b88e7e2fafde1eb0861d4f06aa3/lua/spectre/init.lua#L311
...
It doesn't seem to have any relationship with this PR. I would open a new issue. Actually two issues, because we found two different bugs that need to be researched separately.

Did you get the error before this PR? When I tested it on the commit immediately before, I wasn't able to reproduce it strangely enough.

@Subjective @EpsilonKu  Apologies again for the delay, I finally had some time to test.
This is the thing:
Even if I revert this PR, and remove M.toggle() entirely, I can still repro this, menaning the issue was present before, and not related to this PR.
Now again:

I see we do have an autocmd that triggers M.search(), which requires state.bufnr in order to work properly.

So even if this PR is not the original cause for the issue, it could cause trouble too (which is the reason why originally encapsulated the state management inside M.toggle(), I don't know 100% of the codebase).
The solution should be simple: instead of using state.bufnr to manage the state, we can use a property to manage state like in the alternative implementation I originally proposed.
Give me a moment, I'm gonna send that PR.
Again, this is not gonna fix the issue you report, but at least we can have peace of mind the toggle() state management do not collide with anything.

I've submitted #152 which should fix all issues, while getting outside of the way of any other spectre feature.


Remove .travis.yml

Since datafaker uses GitHub actions .travis.yml looks as a useless file

Cheers! I think we naar need it to get some code coverage info, not sure about that


DAv4 SKU is not available for reservation but document says D series are supported

[DAv4 SKU is not available for reservation but document says D series are supported]

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: d0337435-b6d6-58cc-fc5c-e7ccf1456423
Version Independent ID: e1e011f5-a2f9-54a9-0561-962bd8222de5
Content: On-demand Capacity Reservation in Azure - Azure Virtual Machines
Content Source: articles/virtual-machines/capacity-reservation-overview.md
Service: virtual-machines
GitHub Login: @bdeforeest
Microsoft Alias: bidefore

@KanagarajMSFT
Thanks for your feedback! We will investigate and update as appropriate.

@KanagarajMSFT
I'm going to assign this to the document author so they can take a look at it accordingly.
@bdeforeest
Can you please check and add your comments on this doc update request as applicable.

Tarannum looked into this. It appears that portal is placing the VM in a specific category, but it does show as supported if the customer has access permission to the VM size.
From: Saibaba Balapur Hireka @.>
Sent: Monday, February 13, 2023 8:00 PM
To: MicrosoftDocs/azure-docs @.>
Cc: Bill DeForeest @.>; Mention @.>
Subject: Re: [MicrosoftDocs/azure-docs] DAv4 SKU is not available for reservation but document says D series are supported (Issue #105098)
@KanagarajMSFThttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FKanagarajMSFT&data=05|01|bill.deforeest%40microsoft.com|ac61d1548454480bded908db0e3fe743|72f988bf86f141af91ab2d7cd011db47|1|0|638119439856843710|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=eKN7byfIzZ%2B95s2EzmLhfopTLm6rdLRz7%2BM%2FimQaFh8%3D&reserved=0
I'm going to assign this to the document author so they can take a look at it accordingly.
@bdeforeesthttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbdeforeest&data=05|01|bill.deforeest%40microsoft.com|ac61d1548454480bded908db0e3fe743|72f988bf86f141af91ab2d7cd011db47|1|0|638119439856843710|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=FTYASa4CnAqLV9%2FQSi1FPrdiGtwpPlnniTx6Dn%2FrgT8%3D&reserved=0
Can you please check and add your comments on this doc update request as applicable.

Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fissues%2F105098%23issuecomment-1429077789&data=05|01|bill.deforeest%40microsoft.com|ac61d1548454480bded908db0e3fe743|72f988bf86f141af91ab2d7cd011db47|1|0|638119439856843710|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=Uv7gT53O0%2FAqYwz%2BBlzcstFWwX%2Fyt1PDYpkb9n6dQ4k%3D&reserved=0, or unsubscribehttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAL3EHXUXZ2JLYGL3AFGMSHLWXL7K5ANCNFSM6AAAAAAUXUF4OI&data=05|01|bill.deforeest%40microsoft.com|ac61d1548454480bded908db0e3fe743|72f988bf86f141af91ab2d7cd011db47|1|0|638119439856843710|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=SOJAYIFA%2BGZM6iBrrAmsFqOdupCexAnIyxMm4or2QRI%3D&reserved=0.
You are receiving this because you were mentioned.Message ID: @.***>

It sounds like this issue was transient or specific to the customers quota. Closing for now. Please reopen if there is still an issue. Thank you!
#please-close


Mark all modified monomers on canvas (flex and snake modes)

Background
Especially on a crowded canvas, modified monomers are not that easy to find. Introducing marked monomers on canvas can more easily draw the attention of the user to them.
Requirement

Every modified amino acid, sugar, base and phosphate on canvas (flex and snake modes) should be marked as modified (see mockup).

Only amino acids, sugars, phosphates and bases can be considered modified. That means that there is no need for marking CHEMs, (unsplit) nucleotides, and unresolved nucleotides.
The list of non-modified amino acids can be found here: #5629, and the list of non-modified bases, sugars and phosphates here: #3734
Ambiguous monomers (amino acids/bases) that we have in the library are to be considered non-modified. All other ambiguous monomers should be considered modified.

UX

Verified.

Ketcher Version 2.28.0-rc.1 Build at 2024-12-03; 17:04:52
Indigo Version 1.27.0-rc.1.0-g8d656a341-wasm32-wasm-clang-19.0.0
Chrome Version 131.0.6778.109 (Official Build) (64-bit)
Win10


⚠ Roblox Devforum has degraded performance

In 06c9f39, Roblox Devforum (https://devforum.roblox.com) experienced degraded performance:

HTTP code: 200
Response time: 15505 ms

Resolved: Roblox Devforum performance has improved in 9153ed8 after 10 minutes.


Invalid Extension: No warning badge on activity bar, should it have one?

Testing #229394
When an extension is invalid and hence is not able to activate, we do not show a badge on the activity bar, should we?

Also, the warning is saying property engines.vscode is mandatory and must be of type string. I think it would be helpful if we prepended something like: Invalid Extension:

Can you please try this on latest insider, because I fixed this yesterday.

This is latest Insiders

Yes

I got into a broken state after messing with the package.json. I did this

Remove engines.vscode from the package.json of the installed marketplace version of copilot chat
Click "uninstall" on the extension
Click "install pre-release"
Get this error

2024-09-27 11:49:22.364 [error] ScanningExtension: Cannot read the extension from /Users/roblou/.vscode-insiders/extensions/github.copilot-chat-0.21.2024092702
    at Ql.scanLocalExtension (file:///Applications/Visual%20Studio%20Code%20-%20Insiders.app/Contents/Resources/app/out/vs/code/electron-utility/sharedProcess/sharedProcessMain.js:70:73154)
2024-09-27 11:49:22.366 [error] Cannot read the extension from /Users/roblou/.vscode-insiders/extensions/github.copilot-chat-0.21.2024092702: ScanningExtension: Cannot read the extension from /Users/roblou/.vscode-insiders/extensions/github.copilot-chat-0.21.2024092702
    at Ql.scanLocalExtension (file:///Applications/Visual%20Studio%20Code%20-%20Insiders.app/Contents/Resources/app/out/vs/code/electron-utility/sharedProcess/sharedProcessMain.js:70:73154)

and I couldn't get it fixed until I manually deleted the extension folder under ~/.vscode-insiders/extensions, and reinstalled. Lmk if you want an issue

I am aware of this. One can get into this state only manually. So deleting manually seems to be reasonable option.


fix(deps): update all non-major

This PR contains the following updates:

Package
Type
Update
Change

leptos
dependencies
patch
0.5.0 -> 0.5.1

leptos_actix
dependencies
patch
0.5.0 -> 0.5.1

leptos_meta
dependencies
patch
0.5.0 -> 0.5.1

leptos_router
dependencies
patch
0.5.0 -> 0.5.1

reqwest
dependencies
patch
0.11.20 -> 0.11.22

rust
final
minor
1.72-alpine3.17 -> 1.73-alpine3.17

Release Notes

leptos-rs/leptos (leptos)
v0.5.1
Compare Source
This is primarily a bugfix release, but it also includes a new feature: making the fallback prop on Show, Suspense, and Transition optional.
For 0.5 release notes in general, click here.
What's Changed

docs: fix For view prop name (closes #1813) by @gbj in https://github.com/leptos-rs/leptos/pull/1814
Missing docs and Copy impl for Callback by @gbj in https://github.com/leptos-rs/leptos/pull/1818
Fix template! cfg condition by @Dragonink in https://github.com/leptos-rs/leptos/pull/1822
Docs: DX improvements: add section about jetbrains intellij-rust by @sebadob in https://github.com/leptos-rs/leptos/pull/1804
made show fallback optional by @maccesch in https://github.com/leptos-rs/leptos/pull/1817
Fixes #1828, making SSR behavior match the Hydrate behavior. by @dgsantana in https://github.com/leptos-rs/leptos/pull/1829
fix: make explicit allowances for local-only suspense fragments in SSR/hydrate mode (closes #1823) by @gbj in https://github.com/leptos-rs/leptos/pull/1824
fix: correctly quote spread attributes in {..attrs} syntax (fixes #1826) by @gbj in https://github.com/leptos-rs/leptos/pull/1831
Allow disposing of Signal & StoredValue by @PaulWagener in https://github.com/leptos-rs/leptos/pull/1849
Make Async Mode return Content-Type header in Response by @benwis in https://github.com/leptos-rs/leptos/pull/1851
feat: support stored values in with! and update! by @blorbb in https://github.com/leptos-rs/leptos/pull/1836
Removed warning in build artefacts. by @martinfrances107 in https://github.com/leptos-rs/leptos/pull/1840
fix: update log debug to use get_untracked for logged in user to resolve client side console error by @kevinold in https://github.com/leptos-rs/leptos/pull/1834
fix: panic during generate_route_list if you immediately dispatch an action (closes #1832) by @gbj in https://github.com/leptos-rs/leptos/pull/1853
fix: clippy "needless lifetimes" warning (closes #1825) by @gbj in https://github.com/leptos-rs/leptos/pull/1852
"#two" was being hidden. Added another # to unhide by @he00741098 in https://github.com/leptos-rs/leptos/pull/1847

New Contributors

@Dragonink made their first contribution in https://github.com/leptos-rs/leptos/pull/1822
@kevinold made their first contribution in https://github.com/leptos-rs/leptos/pull/1834
@he00741098 made their first contribution in https://github.com/leptos-rs/leptos/pull/1847

Full Changelog: https://github.com/leptos-rs/leptos/compare/v0.5.0...v0.5.1

seanmonstar/reqwest (reqwest)
v0.11.22
Compare Source

Fix compilation on Windows when trust-dns is enabled.

v0.11.21
Compare Source

Add automatically detecting macOS proxy settings.
Add ClientBuilder::tls_info(bool), which will put tls::TlsInfo into the response extensions.
Fix trust-dns resolver from possible hangs.
Fix connect timeout to be split among multiple IP addresses.

Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

:tada: This PR is included in version 0.20.1 :tada:
The release is available on:

GitHub release
v0.20.1

Your semantic-release bot :package::rocket:


Scans fail with OpenShift 4.15 clusters

OpenShift 4.15 clusters are more strict about SCCs associated with pods, which causes the scanner pods to fail, leaving the scan in a LAUNCHING state forever (or at least until it times out).
Here is an example of the trace from the operator log:
{"level":"error","ts":"2023-11-17T15:39:07.613Z","logger":"scanctrl","msg":"Failed to launch a pod","Request.Namespace":"openshift-compliance","Request.Name":"upstream-ocp4-cis-node-worker","Pod.Name":"openscap-pod-8bf02d4b600c7b5be62eb0d10093b098b6f7679e","error":"pods \"openscap-pod-8bf02d4b600c7b5be62eb0d10093b098b6f7679e\" is forbidden: violates PodSecurity \"restricted:latest\": privileged (containers \"runtime-kubeletconfig-helper\", \"scanner\" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (containers \"runtime-kubeletconfig-helper\", \"scanner\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers \"runtime-kubeletconfig-helper\", \"scanner\" must set securityContext.capabilities.drop=[\"ALL\"]), restricted volume types (volume \"host\" uses restricted volume type \"hostPath\"), runAsNonRoot != true (pod or containers \"content-container\", \"runtime-kubeletconfig-helper\", \"log-collector\", \"scanner\" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers \"content-container\", \"runtime-kubeletconfig-helper\", \"log-collector\", \"scanner\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")",

I was able to recreate this with 587e0385a373e7099036ed557efec73a103f2744 using make deploy-local and applying any scan binding that runs a node scan (e.g., ocp4-cis-node).

This seems to have resolved itself?

Looks like @xiaojiey may have hit this in https://github.com/ComplianceAsCode/content/pull/11241#issuecomment-1832082564


[MNOE-549] Add tasks controllers, models and routes

@x4d3 @ouranos

@ouranos  I am going to merge this branch in order to be able to test. You can still comment on it, and we will review when we merge on 3.3.


Change font color of only inline code

Hi @colineckert,
thank you for your amazing theme!
I was wondering if it was possible to change the font color of code but keep the
code blocks

font color.
I was able to change the font color for both using style settings -> Inline code blocks font color (Light mode) (even though I am using dark mode - maybe a bug?) but it changes both code and code blocks.
Thank you!

You could add the following CSS snippet to specify the inline code color that are in the code block:
.markdown-rendered pre code{
    color: red;
}

@moziar thanks for the advice. However, the inline code is still unchanged.
I added your snippet to /vault/.obsidian/snippets/code.css and enabled it in Settings -> Appearance -> CSS snippets. I used LF linebreaks and UTF-8.
Do you have an idea why it's not applied?

Maybe I didn't describe it clearly.
Use the CSS snippet here:
/* modify the inline code color*/
body {
    --code-normal: green;
}

/* modify code block color */
.markdown-rendered pre code{
    color: red;
}

It will looks like this:

This code could only take effect on Reading View but not source mode or live mode.

That has works somewhat. I put your CSS snippet into my code.css, but for me it looks like this:

I want to be able to only change the color of the inline code while the code block stays the same. However, this snippet changes all of my code green unless it is a special character.
body {
    --code-normal: green;
}

I am, however, in live mode. When I switch to reading mode, everything in the code block is red.

Do you think its possible to change the color of the inline code only, without affecting the code block colors in live mode?
Thank you!

That works great! Now when I am in live mode the inline code has a custom color (red) and the block code has the default color.
/* modify the inline code color*/
body {
    --code-normal: #e4374b;
}

/* avoid code block color changed in live mode */
.markdown-source-view.mod-cm6 .cm-line.HyperMD-codeblock {
    color: #BEC6CF;
}

Live mode:

However, now in reading mode, everything in the block quote is now red as well. Is there a way to change that back as well?
Reading mode:

I just checked my theme version and it is the last one (theme.css). I also just copied the contents of theme.css into my themes folder but without change.
I also just discovered something when only using the theme without any snippets:
When I am in live mode I have syntax highlighting in the code block.:

But when I am in in reading mode, there is no syntax highlighting. I've tried that with the Things theme and the default theme.

Maybe thats why it does not work?
Is there something else I could test?
Thank you!

Maybe the hightlight issue is about the community plugins? Try to turn on the Restricted mode by Setting -> Options -> Community plugins, and see if it works.
Btw, in fact, you should use all the three snippets to make the effect you want, like this:
/* modify the inline code color*/
body {
    --code-normal: #e4374b;
}

/* avoid code block color changed in live mode */
.markdown-source-view.mod-cm6 .cm-line.HyperMD-codeblock {
    color: #BEC6CF;
}

/* avoid code block color changed in Reading mode */
.markdown-rendered pre code{
    color: #BEC6CF;
}

And, yes, it's not quite elegant.

Thank you @moziar, that works perfectly!
I also tried out the restricted mode and apparently the shell block code does not color highlight in read mode. I've tried it with a javascript code block as well and it works both in live and in read mode.
Live mode:

Read mode:

Or does the shell block code get highlighted for you in read mode?
Thanks again for you help!

Yep, shell block code get highlighted here.
I'am now on Restrict mode and use only the above code snipptest, the code block looks like as follow:

live mode:

Reading view:

I've no idea why it did not work for you.

Ah interesting. I put sh as a language previously. I now changed it to shell and I get the same syntax highlighting like you in both views.
Thank you for your time!


[Snyk] Security upgrade @nestjs/core from 7.6.15 to 9.0.5

This PR was automatically created by Snyk using the credentials of a real user.Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

package.json
package-lock.json

Vulnerabilities that will be fixed
With an upgrade:

Severity
Priority Score (*)
Issue
Breaking Change
Exploit Maturity

471/1000  Why? Recently disclosed, Has a fix available, CVSS 3.7
Information Exposure SNYK-JS-NESTJSCORE-2869127
Yes
No Known Exploit

(*) Note that the real score may have changed since the PR was raised.
Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
🛠 Adjust project settings
📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Checkmarx One – Scan Summary & Details – ad22a53b-0757-4762-80c3-8e040077a198
New Issues

Severity
Issue
Source File / Package
Checkmarx Insight

CVE-2015-5312
Npm-libxmljs-0.19.7
Vulnerable Package

CVE-2016-20018
Npm-knex-0.21.19
Vulnerable Package

CVE-2017-9048
Npm-libxmljs-0.19.7
Vulnerable Package

CVE-2021-43138
Npm-async-2.6.3
Vulnerable Package

CVE-2022-1650
Npm-eventsource-1.1.0
Vulnerable Package

CVE-2022-21144
Npm-libxmljs-0.19.7
Vulnerable Package

CVE-2022-23539
Npm-jsonwebtoken-8.5.1
Vulnerable Package

CVE-2022-23540
Npm-jsonwebtoken-8.5.1
Vulnerable Package

CVE-2022-23541
Npm-jsonwebtoken-8.5.1
Vulnerable Package

CVE-2022-24434
Npm-dicer-0.3.0
Vulnerable Package

CVE-2022-24771
Npm-node-forge-0.10.0
Vulnerable Package

CVE-2022-24772
Npm-node-forge-0.10.0
Vulnerable Package

CVE-2022-24999
Npm-qs-6.7.0
Vulnerable Package

CVE-2022-24999
Npm-qs-6.5.2
Vulnerable Package

CVE-2022-24999
Npm-qs-6.10.1
Vulnerable Package

CVE-2022-25858
Npm-terser-5.7.0
Vulnerable Package

CVE-2022-25858
Npm-terser-5.10.0
Vulnerable Package

CVE-2022-25858
Npm-terser-4.8.0
Vulnerable Package

CVE-2022-29078
Npm-ejs-2.7.4
Vulnerable Package

CVE-2022-31129
Npm-moment-2.29.1
Vulnerable Package

CVE-2022-31129
Npm-moment-2.24.0
Vulnerable Package

CVE-2022-3517
Npm-minimatch-3.0.4
Vulnerable Package

CVE-2022-38900
Npm-decode-uri-component-0.2.0
Vulnerable Package

CVE-2022-39288
Npm-fastify-3.14.0
Vulnerable Package

CVE-2022-40303
Npm-libxmljs-0.19.7
Vulnerable Package

CVE-2022-40304
Npm-libxmljs-0.19.7
Vulnerable Package

CVE-2022-41919
Npm-fastify-3.14.0
Vulnerable Package

CVE-2022-46175
Npm-json5-2.2.0
Vulnerable Package

CVE-2022-46175
Npm-json5-1.0.1
Vulnerable Package

Cx10578cb2-c0fc
Npm-cypress-6.9.1
Vulnerable Package

Cx15879720-9801
Npm-knex-0.21.19
Vulnerable Package

Cx62f5bb1b-fa5e
Npm-moment-2.29.1
Vulnerable Package

Cx62f5bb1b-fa5e
Npm-moment-2.24.0
Vulnerable Package

Cxc7705965-e0f0
<EMAIL_ADDRESS>Vulnerable Package

Cxc7705965-e0f0
<EMAIL_ADDRESS>Vulnerable Package

Docker Socket Mounted In Container
/docker-compose.yml: 67
Docker socket docker.sock should not be mounted on host. If the docker socket is mounted, it can allow its processes to execute docker commands.

SQL_Injection
/src/testimonials/testimonials.controller.ts: 91
Attack Vector

Volume Has Sensitive Host Directory
/docker-compose.yml: 67
Container has sensitive host directory mounted as a volume

CVE-2022-24773
Npm-node-forge-0.10.0
Vulnerable Package

CVE-2022-29824
Npm-libxmljs-0.19.7
Vulnerable Package

CVE-2022-33987
Npm-got-9.6.0
Vulnerable Package

CVE-2022-36083
Npm-jose-2.0.5
Vulnerable Package

Client_HTML5_Store_Sensitive_data_In_Web_Storage
/public/src/pages/main/Userprofile.tsx: 33
Attack Vector

Client_HTML5_Store_Sensitive_data_In_Web_Storage
/public/src/api/ApiUrl.ts: 7
Attack Vector

Container Traffic Not Bound To Host Interface
/docker-compose.local.yml: 37
Incoming container traffic should be bound to a specific host interface

Container Traffic Not Bound To Host Interface
/docker-compose.yml: 50
Incoming container traffic should be bound to a specific host interface

Container Traffic Not Bound To Host Interface
/docker-compose.local.yml: 50
Incoming container traffic should be bound to a specific host interface

Container Traffic Not Bound To Host Interface
/docker-compose.local.yml: 24
Incoming container traffic should be bound to a specific host interface

Healthcheck Not Set
/docker-compose.yml: 45
Check containers periodically to see if they are running properly.

Healthcheck Not Set
/docker-compose.local.yml: 46
Check containers periodically to see if they are running properly.

Healthcheck Not Set
/docker-compose.local.yml: 29
Check containers periodically to see if they are running properly.

Healthcheck Not Set
/docker-compose.yml: 59
Check containers periodically to see if they are running properly.

Healthcheck Not Set
/docker-compose.yml: 27
Check containers periodically to see if they are running properly.

Host Namespace is Shared
/docker-compose.yml: 95
The hosts process namespace should not be shared by containers

Host Namespace is Shared
/docker-compose.local.yml: 46
The hosts process namespace should not be shared by containers

Host Namespace is Shared
/docker-compose.local.yml: 4
The hosts process namespace should not be shared by containers

Host Namespace is Shared
/docker-compose.local.yml: 29
The hosts process namespace should not be shared by containers

Host Namespace is Shared
/docker-compose.yml: 45
The hosts process namespace should not be shared by containers

Host Namespace is Shared
/docker-compose.yml: 4
The hosts process namespace should not be shared by containers

Host Namespace is Shared
/docker-compose.yml: 27
The hosts process namespace should not be shared by containers

Host Namespace is Shared
/docker-compose.yml: 70
The hosts process namespace should not be shared by containers

Host Namespace is Shared
/docker-compose.yml: 59
The hosts process namespace should not be shared by containers

Memory Not Limited
/docker-compose.yml: 4
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Memory Not Limited
/docker-compose.yml: 35
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Memory Not Limited
/docker-compose.yml: 59
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Memory Not Limited
/docker-compose.yml: 45
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Memory Not Limited
/docker-compose.local.yml: 4
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Memory Not Limited
/docker-compose.yml: 70
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Memory Not Limited
/docker-compose.local.yml: 46
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Memory Not Limited
/docker-compose.local.yml: 29
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Memory Not Limited
/docker-compose.yml: 95
Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...

Missing_HSTS_Header
/src/components/any-files.interceptor.ts: 21
Attack Vector

Networks Not Set
/docker-compose.yml: 27
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.

Networks Not Set
/docker-compose.local.yml: 46
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.

Networks Not Set
/docker-compose.yml: 4
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.

Networks Not Set
/docker-compose.local.yml: 29
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.

Networks Not Set
/docker-compose.local.yml: 4
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.

Networks Not Set
/docker-compose.yml: 59
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.

Networks Not Set
/docker-compose.yml: 70
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.

Networks Not Set
/docker-compose.yml: 45
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.

Networks Not Set
/docker-compose.yml: 95
Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.

Privileged Ports Mapped In Container
/docker-compose.local.yml: 50
Privileged ports (1 to 1023) should not be mapped. Also you should drop net_bind_service linux capability from the container unless you absolutely ...

Privileged Ports Mapped In Container
/docker-compose.yml: 50
Privileged ports (1 to 1023) should not be mapped. Also you should drop net_bind_service linux capability from the container unless you absolutely ...

Security Opt Not Set
/docker-compose.yml: 27
Attribute 'security_opt' should be defined.

Security Opt Not Set
/docker-compose.yml: 70
Attribute 'security_opt' should be defined.

Security Opt Not Set
/docker-compose.yml: 59
Attribute 'security_opt' should be defined.

Security Opt Not Set
/docker-compose.yml: 45
Attribute 'security_opt' should be defined.

Security Opt Not Set
/docker-compose.yml: 4
Attribute 'security_opt' should be defined.

Security Opt Not Set
/docker-compose.local.yml: 29
Attribute 'security_opt' should be defined.

Security Opt Not Set
/docker-compose.local.yml: 4
Attribute 'security_opt' should be defined.

Security Opt Not Set
/docker-compose.yml: 95
Attribute 'security_opt' should be defined.

Security Opt Not Set
/docker-compose.local.yml: 46
Attribute 'security_opt' should be defined.

Container Capabilities Unrestricted
/docker-compose.yml: 95
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...

Container Capabilities Unrestricted
/docker-compose.local.yml: 29
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...

Container Capabilities Unrestricted
/docker-compose.yml: 4
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...

Container Capabilities Unrestricted
/docker-compose.yml: 70
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...

Container Capabilities Unrestricted
/docker-compose.local.yml: 4
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...

Container Capabilities Unrestricted
/docker-compose.yml: 27
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...

Container Capabilities Unrestricted
/docker-compose.yml: 45
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...

Container Capabilities Unrestricted
/docker-compose.yml: 59
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...

Container Capabilities Unrestricted
/docker-compose.local.yml: 46
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...

Cpus Not Limited
/docker-compose.local.yml: 46
CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Cpus Not Limited
/docker-compose.yml: 45
CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Cpus Not Limited
/docker-compose.yml: 4
CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Cpus Not Limited
/docker-compose.local.yml: 29
CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Cpus Not Limited
/docker-compose.yml: 95
CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Cpus Not Limited
/docker-compose.yml: 70
CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Cpus Not Limited
/docker-compose.local.yml: 4
CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Cpus Not Limited
/docker-compose.yml: 59
CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Fixed Issues

Severity
Issue
Source File / Package
Checkmarx Insight

CVE-2021-23440
Npm-set-value-2.0.1
Vulnerable Package

Missing User Instruction
/Dockerfile: 1
A user should be specified in the dockerfile, otherwise the image will run as root

Missing User Instruction
/Dockerfile: 18
A user should be specified in the dockerfile, otherwise the image will run as root

Healthcheck Instruction Missing
/Dockerfile: 1
Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working

Healthcheck Instruction Missing
/Dockerfile: 18
Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working

Multiple RUN, ADD, COPY, Instructions Listed
/Dockerfile: 9
Multiple commands (RUN, Copy, And) should be grouped in order to reduce the number of layers.


[Snyk] Upgrade @aws-sdk/client-sns from 3.606.0 to 3.613.0

Snyk has created this PR to upgrade @aws-sdk/client-sns from 3.606.0 to 3.613.0.
:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 2 versions ahead of your current version.

The recommended version was released on 22 days ago.

Release notes

Package name: @aws-sdk/client-sns

3.613.0 - 2024-07-093.613.0(2024-07-09)
Chores

clients:  add automatic id tokens for header values (#6260) (2697d89a)

New Features

clients:  update client endpoints as of 2024-07-09 (d5e32c24)
client-sagemaker:  This release 1/ enables optimization jobs that allows customers to perform Ahead-of-time compilation and quantization. 2/ allows customers to control access to Amazon Q integration in SageMaker Studio. 3/ enables AdditionalModelDataSources for CreateModel action. (ec13654a)
client-fsx:  Adds support for FSx for NetApp ONTAP 2nd Generation file systems, and FSx for OpenZFS Single AZ HA file systems. (cd5cd966)
client-datazone:  This release deprecates dataProductItem field from SearchInventoryResultItem, along with some unused DataProduct shapes (5d3596b7)
client-opensearch:  This release adds support for enabling or disabling Natural Language Query Processing feature for Amazon OpenSearch Service domains, and provides visibility into the current state of the setup or tear-down. (069e2475)

Bug Fixes

middleware-eventstream:  lowercase headers more consistently (#6259) (1965eb04)

For list of updated packages, view updated-packages.md in assets-3.613.0.zip

3.609.0 - 2024-07-023.609.0(2024-07-02)
Chores

add clean-nested make target (#6250) (bc48ccea)
bump smithy versions (#6243) (3da4203c)
core:  emit warning for Node.js versions < 18.x (#6247) (3c64d786)
codegen:  bump smithyVersion=1.50.0 (#6245) (72db2b5a)

Documentation Changes

fix link to middleware stack blog post (#6234) (675cdf84)
update FetchHttpHandler link (#6244) (15066e95)

New Features

client-ec2:  Documentation updates for Elastic Compute Cloud (EC2). (c155b9e2)
client-fms:  Increases Customer API's ManagedServiceData length (b5ca0231)
client-s3:  Added response overrides to Head Object requests. (ac9f3d20)

For list of updated packages, view updated-packages.md in assets-3.609.0.zip

3.606.0 - 2024-06-283.606.0(2024-06-27)
Chores

client-sso-oidc:  move sts to peer (#6224) (1cc4de91)

Documentation Changes

client-rds:  Updates Amazon RDS documentation for TAZ export to S3. (cee790fe)
client-cloudfront:  Doc only update for CloudFront that fixes customer-reported issue (85a220c6)

New Features

clients:  update client endpoints as of 2024-06-27 (9cc63d2c)
client-datazone:  This release supports the data lineage feature of business data catalog in Amazon DataZone. (dc63d2cb)
client-qconnect:  Adds CreateContentAssociation, ListContentAssociations, GetContentAssociation, and DeleteContentAssociation APIs. (c6917b44)
client-application-auto-scaling:  Amazon WorkSpaces customers can now use Application Auto Scaling to automatically scale the number of virtual desktops in a WorkSpaces pool. (2bd900fc)
client-quicksight:  Adding support for Repeating Sections, Nested Filters (be6cd948)
client-workspaces:  Added support for WorkSpaces Pools. (729c2087)
client-mq:  This release makes the EngineVersion field optional for both broker and configuration and uses the latest available version by default. The AutoMinorVersionUpgrade field is also now optional for broker creation and defaults to 'true'. (8c6b66ae)
client-sagemaker:  Add capability for Admins to customize Studio experience for the user by showing or hiding Apps and MLTools. (c8b653f9)
client-chime-sdk-media-pipelines:  Added Amazon Transcribe multi language identification to Chime SDK call analytics. Enabling customers sending single stream audio to generate call recordings using Chime SDK call analytics (2028122c)
client-elasticache:  Add v2 smoke tests and smithy smokeTests trait for SDK testing. (d3a5651d)

For list of updated packages, view updated-packages.md in assets-3.606.0.zip

    from @aws-sdk/client-sns GitHub release notes

[!IMPORTANT]

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:

🧐 View latest project report
📜 Customise PR templates
🛠 Adjust upgrade PR settings
🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 100.00%. Comparing base (5643eb0) to head (83fa8d1).

Additional details and impacted files
@@            Coverage Diff            @@
##              main       #30   +/-   ##
=========================================
  Coverage   100.00%   100.00%
=========================================
  Files            2         2
  Lines           58        58
=========================================
  Hits            58        58

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


feat: opts: begin_line_num

I added a begin_line_num in M.open's opts.
Every time I open the spectre with the givin word, the cursor position always in search placeholder, makes me need to move down multi lines to scan the result
Having this option, I set the keymap below, it feels so good

Does it stay on search when you open spectre on standard way?

Does it stay on search when you open spectre on standard way?

Yes, i set this default value to 3


Istio Egress Gateway using secret from other namespace for mTLS request

(NOTE: This is used to report product bugs:
To report a security vulnerability, please visit https://istio.io/about/security-vulnerabilities
To ask questions about how to use Istio, please visit https://discuss.istio.io)
Bug description
We want to use istio egress gateway in a multi tenant way where each namespace will be having its own Egress Gateway created to connect with external endpoints. Now suppose if there is same external endpoint which can only be connected with mTLS is created  in both namespaces it needs a Destination Rule where a secret name is given in tls field of DR as shown below
 tls:
   credentialName: secret-name
   mode: MUTUAL

Now in both namespaces the name of secret is name, lets set it secret-name.
So ideally if secret-name is created in one namespace, then only the requests originating from that namespace should be successful and the requests from other namespace where the secret is not created should fail.
But thats not happening. If i create secret in one namespace...its automatically sent to egress gateway of other namespace creating a kind of security breach since namespace resources should be isolated from each other.
So egress gateway of one namespace can use the secrets created only in its own namespace
[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
[ ] Upgrade
Expected behavior
Steps to reproduce the bug

Install istio with PILOT_SCOPE_GATEWAY_TO_NAMESPACE set to true.
Set up egress gateways with different label selectors in two namespaces.
Expose a mTLS endpoint in both namespaces by creating Service Entry, Virtual Service and Destination Rule.
Destination rules should be like this

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
spec:
  exportTo:
  - .
  host: <mtls-host>
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: <port>
      tls:
        credentialName: secret-name
        mode: MUTUAL
        sni: <mtls-host>

Create secret secret-name needed by DR only in one namespace.
Hit requests from both of the namespaces. The requests will work.

Ideally they shouldn't. Or if they are doing it right is there a way to restrict that.
There is one environment variable set in istiod i.e ISTIOD_ENABLE_SDS_SERVER=false. But that also didn't help
Version
root@machine:~$ sudo istioctl version
client version: 1.9.5
control plane version: 1.9.5
data plane version: 1.9.5 (86 proxies)

How was Istio installed?
 istioctl install -f ~/istio-operator.yaml``
Environment where the bug was observed (cloud vendor, OS, etc)
AWS EKS
Additionally, please consider running istioctl bug-report and attach the generated cluster-state tarball to this issue.
Refer cluster state archive for more details.

Hey, thanks for the report. This is an (unfortunately fairly long standing) feature request that can be followed here https://github.com/istio/istio/issues/14598.
Thanks!

Hi, Thanks for the reply. I read the issue you shared. The issue looks more concerned towards fetching secret from other namespace whereas we want totally opposite of that i.e to deny access of secrets from other namespaces.
Does your work on that ticket also has some feature regarding that?

Hi,
To verify again...i exposed same dummy  mTLS endpoint example.com in two namespaces.
The content of the resources is as follows
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: test-cross-secret
spec:
  exportTo:
    - .
  hosts:
    - example.com
  location: MESH_EXTERNAL
  ports:
    - name: https
      number: 443
      protocol: HTTPS
  resolution: DNS

---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: test-cross-secret
spec:
  exportTo:
    - .
  gateways:
    - istio-egressgateway
    - mesh
  hosts:
    - example.com
  http:
    - match:
        - gateways:
            - mesh
          port: 80
      route:
        - destination:
            host: istio-egressgateway.psd2-2.svc.cluster.local #namespace changes here for egress gateway
            port:
              number: 80
    - match:
        - gateways:
            - istio-egressgateway
          port: 80
      route:
        - destination:
            host: example.com
            port:
              number: 443

---

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: test-cross-secret
spec:
  exportTo:
    - .
  host: example.com
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      - port:
          number: 443
        tls:
          credentialName: test-cross-secret
          mode: MUTUAL
          sni: example.com

I created secret only in one namespace
The output is as follows

Then i run the istioctl pc s command for both of the gateways
Here is the output
root@machine:~$ sudo istioctl pc s istio-egressgateway-5d6c8bddbd-27n7w.psd2-1
RESOURCE NAME                                                 TYPE           STATUS     VALID CERT     SERIAL NUMBER                                        NOT AFTER                NOT BEFORE
kubernetes://test-cross-secret                                Cert Chain     ACTIVE     true<PHONE_NUMBER>06992197                                   2021-08-07T15:51:31Z     2018-08-07T15:51:31Z
kubernetes://test-cross-secret-cacert                         CA             ACTIVE     true<PHONE_NUMBER>8952040374951832963794454346               2031-11-10T00:00:00Z     2006-11-10T00:00:00Z
root@machine:~$ sudo istioctl pc s istio-egressgateway-5cc9954f98-dz5kt.psd2-2
RESOURCE NAME                                                 TYPE           STATUS     VALID CERT     SERIAL NUMBER                                        NOT AFTER                NOT BEFORE
kubernetes://test-cross-secret                                Cert Chain     ACTIVE     true<PHONE_NUMBER>06992197                                   2021-08-07T15:51:31Z     2018-08-07T15:51:31Z
kubernetes://test-cross-secret-cacert                         CA             ACTIVE     true<PHONE_NUMBER>8952040374951832963794454346               2031-11-10T00:00:00Z     2006-11-10T00:00:00Z

Hi,
To verify again...i exposed same dummy  mTLS endpoint example.com in two namespaces.
The content of the resources is as follows
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: test-cross-secret
spec:
  exportTo:
    - .
  hosts:
    - example.com
  location: MESH_EXTERNAL
  ports:
    - name: https
      number: 443
      protocol: HTTPS
  resolution: DNS

---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: test-cross-secret
spec:
  exportTo:
    - .
  gateways:
    - istio-egressgateway
    - mesh
  hosts:
    - example.com
  http:
    - match:
        - gateways:
            - mesh
          port: 80
      route:
        - destination:
            host: istio-egressgateway.tenant-2.svc.cluster.local #namespace changes here for egress gateway for tenant-2
            port:
              number: 80
    - match:
        - gateways:
            - istio-egressgateway
          port: 80
      route:
        - destination:
            host: example.com
            port:
              number: 443

---

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: test-cross-secret
spec:
  exportTo:
    - .
  host: example.com
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      - port:
          number: 443
        tls:
          credentialName: test-cross-secret
          mode: MUTUAL
          sni: example.com

I created secret only in one namespace
The output is as follows
root@machine:~$ sudo kubectl get secret -n tenant-1 | grep test-cross-secret
root@machine:~$ sudo kubectl get secret -n tenant-2 | grep test-cross-secret
test-cross-secret                                 Opaque                                3      27m

Then i run the istioctl pc s command for both of the gateways
Here is the output
root@machine:~$ sudo istioctl pc s istio-egressgateway-5d6c8bddbd-27n7w.tenant-1
RESOURCE NAME                                                 TYPE           STATUS     VALID CERT     SERIAL NUMBER                                        NOT AFTER                NOT BEFORE
kubernetes://test-cross-secret                                Cert Chain     ACTIVE     true<PHONE_NUMBER>06992197                                   2021-08-07T15:51:31Z     2018-08-07T15:51:31Z
kubernetes://test-cross-secret-cacert                         CA             ACTIVE     true<PHONE_NUMBER>8952040374951832963794454346               2031-11-10T00:00:00Z     2006-11-10T00:00:00Z
root@machine:~$ sudo istioctl pc s istio-egressgateway-5cc9954f98-dz5kt.tenant-2
RESOURCE NAME                                                 TYPE           STATUS     VALID CERT     SERIAL NUMBER                                        NOT AFTER                NOT BEFORE
kubernetes://test-cross-secret                                Cert Chain     ACTIVE     true<PHONE_NUMBER>06992197                                   2021-08-07T15:51:31Z     2018-08-07T15:51:31Z
kubernetes://test-cross-secret-cacert                         CA             ACTIVE     true<PHONE_NUMBER>8952040374951832963794454346               2031-11-10T00:00:00Z     2006-11-10T00:00:00Z

Thank you for the report @nv1-0 ! This is fixed in 1.10.2 and 1.9.6: https://istio.io/latest/news/releases/1.10.x/announcing-1.10.2/
Please let me know if you would like us to accredit you on https://istio.io/latest/news/security/istio-security-2021-007/, and if so under what name. Thanks!

Yes thanks!!
Well it will be great if you can accredit us(not only me) as it was a team effort. So i would like you to mention me i.e Nishant Virmani, Stephane Mercier  and Antonin Nycz. We work for Sopra Banking Software.

Thanks @howardjohn
I tested the scenario with istio 1.9.6 and it is working fine now.
Closing the ticket.


KAFKA-10404; Use higher poll timeout to avoid rebalance in testCoordinatorFailover

Tests use 6s poll timeout, which isn't sufficient to ensure that clients don't leave the group due to poll timeout. The PR increases poll timeout to 15s. Session timeout of 5s is also low, but leaving it as-is for now with lower heartbeat timeout to make sure we catch unexpected rebalances during the failover.
Committer Checklist (excluded from commit message)

[ ] Verify design and implementation
[ ] Verify test coverage and CI build status
[ ] Verify documentation (including upgrade notes)

@omkreddy Thanks for the review, merging to trunk, 2.6 and 2.5.


client: keep context error type in Do

Fixes https://github.com/coreos/etcd/issues/4544.

/cc @xiang90 @heyitsanthony
This line does not compare the deadline excess error correctly:
if err == context.Canceled || err == context.DeadlineExceeded {
    return nil, nil, err
}

err == context.Canceled is ok, but err == context.DeadlineExceeded error is overwritten by the old line in my patch. For example,
package main

import (
	"log"
	"time"

	"github.com/coreos/etcd/Godeps/_workspace/src/golang.org/x/net/context"
	"github.com/coreos/etcd/client"
)

func main() {
	cfg := client.Config{
		Endpoints: []string{"http://localhost:12379"},
		Transport: client.DefaultTransport,
		HeaderTimeoutPerRequest: time.Nanosecond,
	}

	c, err := client.New(cfg)
	if err != nil {
		log.Fatal(err)
	}
	kapi := client.NewKeysAPI(c)

	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	resp, err := kapi.Set(ctx, "/foo", "bar", nil)
	if err != nil {
		log.Fatal(err)
	} else {
		log.Printf("Set is done. Metadata is %q\n", resp)
	}
}

This does not return client: endpoint http://localhost:12379 exceeded header timeout, it returns client: etcd cluster is unavailable or misconfigured. Let's just make it return context deadline exceeded in context package.

lgtm, deferring to @xiang90


The help text incorrectly refers to CFG scale as "Prompt configuration" scale instead of "Classifier Free Guidance" scale

CFG does not stand for configuration, it stands for Classifier Free Guidance, as mentioned in the title.

Thanks for pointing it out. I'll add it to my next bug fix patch.

This has been fixed in commit 19e4298cf9d9fbe0c1ee855f808e36101a811f18


Uncaught (in promise) DOMException: The play() request was interrupted by a call to pause().

Uncaught (in promise) DOMException: The play() request was interrupted by a call to pause().
in chrome

I was also getting this error when I was trying to pause other players in a success callback.But this error was removed after upgrading to latest version of 4.x.x as now its been taken care by default.My previous version was 2.x.x.
Hope this helps.

Closing old issues. If you'd like to reopen this, let us know. Thanks!


Review Android-related documentation

The world keeps on turning, Android gets new updates, some things may go haywire if done according to the current Android-related instructions until those are updated. Beware.

Duplicate #235


Remove dev rake prime, or migrate our seeder over to it

https://dzone.com/articles/priming-the-pump


Exactly where are the role definitions stored?

In this document it states: "Custom roles are stored in an Azure Active Directory (Azure AD) directory". As far as I've been able to tell they are stored at "/subscriptions/{guid}/providers/Microsoft.Authorization/roleDefinitions".
According to "https://docs.microsoft.com/da-dk/rest/api/authorization/roledefinitions/getbyid":
The fully qualified role definition ID. Use the format, /subscriptions/{guid}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} for subscription level role definitions, or /providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} for tenant level role definitions.
Is there a way to specify storing a custom role definition outside of a subscription, thus making is independent of the subscription lifecycle?
This is not related to the "assignableScopes" property, it is in relation to the longevity of the role definition it self.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 46298566-60f8-0d7b-6dd1-7225f59204c2
Version Independent ID: 86898efd-12a9-67d1-2772-64616c6a5684
Content: Create or update Azure custom roles using the Azure portal (Preview) - Azure RBAC
Content Source: articles/role-based-access-control/custom-roles-portal.md
Service: role-based-access-control
GitHub Login: @rolyon
Microsoft Alias: rolyon

@tom-ditlev Thank you for your query, our team will further look into it and get back to you at the earliest.

@tom-ditlev Apologies for the delay. I am working on it internally and update you with my findings.

@tom-ditlev We can create custom roles at management group as well as tenant scope(which isn't supported yet).
However both the above choices aren't supported from the UI currenlty.  However, creating custom roles at management group scope is still in preview and has some limitations.

@tom-ditlev We will now proceed to close this thread. If there are further questions regarding this matter, please reopen it and we will gladly continue the discussion.


Enable Grafana keycloack integration on Ayekan

Depends on https://github.com/lsst-it/k8s-cookbook/pull/277 and the work being done to Fleetise the prometheus-stack. Those should be done first.

Is there anything left in this branch that hasn't been merged through other PRs?

@jhoblitt a quick glance makes me think not. Most things have been merged, changed or been deprecated one way or another.


Mention that users might get logged in Upgrade Notes

Relevant discussion is before https://chat.zulip.org/#narrow/stream/3-backend/topic/Django.203.2E2/near/1174015

I merged the first change after some documentation changes as 684908bdce44610c93ce9ef63d5a56f98bc233e1.  For the second commit, I think we want to actually be migrating to functions like do_set_realm_property when updating state; it's more robust to use Zulip's actual abstractions.


Replace snapshot id with url parameters

Once again, it looks (and it got) bigger that what I had in mind when starting to move things! sorry for that :(
At the end, here are the changes that this PR would introduce:

A snapshot would have a #snapshotId and an #exceptionId
The #exceptionId identify a specific exception reported by SnapDump (what was previously the #id)
The #snapshotId identify a specific snapshot being registered for a given exception. Several #snapshotId can be associated to the same #exceptionId

The intention is to be able to collect several snapshots for a similar exception occuring at different point in time.
With a limit  on server side on the number of snapshot that can be registered for a same #exceptionId.
This could give information about the frequency of a given exception.
Maybe later some specific context information could be reported within each snapshot.

I kept the concept of #snapshotId and snapshot calls with a single path parameter.
I think it would still be handy to perform some server queries with just an id.
And anyway the server perform a lot of actions in a "flat way":
it iterates on a memory list of snapshots, that gets reset on each addition / removal.
I understand that all snapshots should always be "manageable" in memory, as snapdump is not intended to archive snapshots.

The handler is no longer initialized with project and version objects, but just project name and version strings.
The snapshots generated by handler also point to a simple project name and version string (project and version objects are left nil).
This goes in the direction of having a handler as simple as possible, not depending from the snapdump model

The snapshot call would have some optional query parameters: #projectName #versionName #exceptionId
They are currently used by the #put and #head actions
Doing that way makes it easier to build dynamic url (on handler side) with possible empty values for projectName and versionName.
It also feels more flexible than requiring path parameters for any http method.

The server decides how he wants to manage empty project and version values. He is the only one that has to deal with default project and version names.
(Currently this change has limited interest regarding version and project parameters, as these ones could already be read from meta information).

The file structure on server side has changed from flat to a project dir => version dir => snapshot file structure.
Right now there is no actual benefit with this change, as most of the actions are taking advantages of the snapshot memory list.
But it feels natural without adding much complexity.

All the tests are green and the examples work fine.
Here are a list of plans / "useful" idea that I had in mind while working on that.
Feel free to tell me if it goes totally out of scope :)

update the UI to take advantage of the #exceptionId concept.
I guess I would start with an extra column to group snapshots from a same exception id.
Also having the ability to remove all snapshot from a same exceptionId.

attach a "textual" stack trace to the snapshot generated by the handler.
It would be nice to still be able to take advantage of snapshots without having the exact same image context that the reported exception.
The UI could offer to display / download stack traces for a given snapshot.

I am not sure how to do that without making snapdump too specific, but it would nice if we could also plug and attach some "log extracts" to the snap dump generated by the handler.
In our case, we could for example have access to last 30 lines of the application log before the exception occured.
From times to times, such logs context could help understand.
And managing docker container logs is a pain :)

A minimal seaside interface for the server image ?
This would give a quick overview of to the current reported snapshot without having to load and open snapdump in our local images.
And such information like stack-traces or logs could already be accessible from this interface ?

Some discussed points that should be worked on:

max number of uploadable snapshots for a given exception should be a configuration parameter
project and version should be required by the server calls. Using a default project and version could end up by mixing snapshots from different projects
go further with /version/snapshot directory hierarchy. take advantage of this new structure in order to remove the memory caching and optimize the PUT requests
house keeping:  On remove operation the directory needs to be checked afterwards and deleted if empty
change the snapshot format separator: The problem with a single 255 byte is that I'm not sure it can appear as second or third byte.
ideas: TLV kind of thing, use LENGTHLENGTH|LENGTH|JSON|FUEL

Here are the adjustments provided by the last commit

Server file structure is now: Project->Version->Exception->Snapshot.snap
Server no longer cache any snapshot in memory. It always re-build snapshots from file structure.
'serverName' 'versionName' and 'exceptionId' are mandatory parameters for snapshots PUT and HEAD calls
'serverName' 'versionName' and 'exceptionId' are optional parameters for snapshots GET and DELETE calls. Because it is handy
to keep being able to provide only the id, and it smooth out migration to new file structure
I made sure that when a snapshot is removed, empty parent directories are also removed
All tests are green. I adjusted and added some
The current client UI seems to works correctly. I started changing it in another branch


SAK-29148: Error in Assignment List

It's always helpful in a commit comment if you can have a body of the commit explaining why this is the right fix, and what was going wrong. It not only helps people reviewing the code, but also helps people when they are working on the code as they can do a git blame and see exactly why the change was made without having to jump into Jira and do lots of searching. Just something for the future.

Also, StringUtils.isNotBlank is preferable to !StringUtils.isBlank.
Okay, I'm going to close this PR and submit a new one.


Default vol mount path to vol name if absent

Signed-off-by: Maysun J Faisal<EMAIL_ADDRESS>What type of PR is this?
/kind bug
What does does this PR do / why we need it:
If vol mount path is absent, it defaults to vol mount name acc to the devfile schema https://devfile.github.io/devfile/api-reference.html
Which issue(s) this PR fixes:
Fixes #4005
PR acceptance criteria:

[x] Unit test

[x] Integration test

[ ] Documentation

[x] I have read the test guidelines

How to test changes / Special notes to the reviewer:

Comment out the vol mount path in a devfile and push
Confirm the volume mount path by oc/kubectl describe pod

/retest

We are hitting real failure on windows platform
--- FAIL: TestGetVolumes (0.00s)
    --- FAIL: TestGetVolumes/Case_5:_Valid_devfile_with_container_referencing_no_volume_mount_path (0.00s)
        utils_test.go:246: TestGetVolumes error - got map[mycontainer:[{myvolume1 \myvolume1 4Gi}]] wanted map[mycontainer:[{myvolume1 /myvolume1 4Gi}]]
FAIL
FAIL	github.com/openshift/odo/pkg/devfile/adapters/common

@maysunfaisal Could you please address this. Till then I am holding this pr.
/hold

/retest

/retest

/retest

Works for me. Tried with java-quarkus component by commenting the volume from it.
/approve

[mrinaldas@localhost project]$ odo storage list
The component 'nodejs' has the following storage attached:
NAME            SIZE     PATH             CONTAINER     STATE
nodejs-flhk     1Gi                       runtime       Not Pushed
nodejs-flhk     1Gi      /nodejs-flhk     runtime       Locally Deleted

storage list doesn't work properly when the path is not provided. We need to modify GetLocalDevfileStorage to use the default path too in such a case.

[odo]  ✗  Waiting for component to start [5m]
[odo]  ✗  Failed to start component with name rlfwai. Error: Failed to create the component: error while waiting for deployment rollout: timeout while waiting for rlfwai deployment roll out
Deleting project: thadwbtxdc
Running odo with args [odo project delete thadwbtxdc -f]
[odo] I1009 22:12:24.572511   68164 util.go:730] HTTPGetRequest: https://raw.githubusercontent.com/openshift/odo/master/build/VERSION
[odo] I1009 22:12:24.572651   68164 util.go:751] Response will be cached in /tmp/odohttpcache for 1h0m0s
[odo]  ✓  Deleted project : thadwbtxdc
[odo]  ⚠  Warning! Projects are deleted from the cluster asynchronously. Odo does its best to delete the project. Due to multi-tenant clusters, the project may still exist on a different node.
[odo] I1009 22:12:24.668278   68164 odo.go:72] Could not get the latest release information in time. Never mind, exiting gracefully :)
Setting current dir to: /go/src/github.com/openshift/odo/tests/integration/operatorhub
Deleting dir: /tmp/672223586
------------------------------
• Failure [362.648 seconds]
odo service command tests for OperatorHub
/go/src/github.com/openshift/odo/tests/integration/operatorhub/

/retest


Collapse child items in the Admin UI

Hi, I was testing a POC with strapi and your plugin and it looks superb.
One feature I miss is the possibility of collapse the child elements in the Admin UI as long as we have quite a lot of entries in the menu, it can be unbearable for the user.
I believe we can do a workaround creating different menu collections and setting up a relation field or something similar, so this request is only a nice feature that it could have.
Great job anyway! 👏

Hi @in-vbonilla Great suggestion! In a future release, I actually plan to implement drag and drop sorting as well as collapsing sub-menus. 🙂
I will ping this ticket once that feature is released in the future.


question: How to get client IP and custom headers in Lua filter

I am developing a framework that support Apache APISIX plugins run directly in Envoy Lua filter without modify Envoy. #13307
But in the process, I found that some header values, such as client IP and custom headers, cannot be get in Lua filter.
I think client IP and custom headers should be very commonly used.
I might misreading/misunderstanding, but I don't know how to get them, please remind me, thank you !

I found that some header values, such as client IP and custom headers, cannot be get in Lua filter.

Sorry, do you mean you have this information available on headers but it is not there when you tried to access it?
FWIW, I think the information is available here: https://github.com/envoyproxy/envoy/blob/319a9a647f19036d831a75f68350c90e98bfc365/include/envoy/stream_info/stream_info.h#L474-L479 However, yes currently we have the StreamInfo wrapper but not all information is accessible from Lua script.

Sorry, do you mean you have this information available on headers but it was not there when you tried to access it?

I reconfirmed that the custom headers are available by handle:headers(), sorry about that.

However, yes currently we have the StreamInfo wrapper but not all information is accessible from Lua script.

It seems that only protocol, dynamicMetadata and downstreamSslConnection are exposed.
Would We export downstreamRemoteAddress to Lua filter ?  😃

@nic-chen sure. I think this is a good exercise for a new contributor. Do you want to try? I can try to help with providing guidance and review. Here is a complete (well missing docs) patch to expose downstream local address: https://github.com/envoyproxy/envoy/compare/master...dio:lua-streaminfo-addresss?expand=1.

@nic-chen sure. I think this is a good exercise for a new contributor. Do you want to try? I can try to help with providing guidance and review. Here is a complete (well, it's still missing docs) patch to expose downstream local address: https://github.com/envoyproxy/envoy/compare/master...dio:lua-streaminfo-addresss?expand=1.

Wow, so nice you are!
I have always used JAVA, PHP, GO, Lua, JavaScript to work, and have never used C++.
But I would like to try it out and learn, hoping to contribute more in the future.

@nic-chen sure. I think this is a good exercise for a new contributor. Do you want to try? I can try to help with providing guidance and review. Here is a complete (well, it's still missing docs) patch to expose downstream local address: https://github.com/envoyproxy/envoy/compare/master...dio:lua-streaminfo-addresss?expand=1, you can then add more getters to StreamInfoWrapper as you wish 🙂.

Do you mind if I push directly to your repo? Or should I submit the code on my repo? Then create a pr.
Thanks !

@nic-chen I think I prefer for you to work on your own repo. Please note that the patch that I have exposes downstream local address, which probably not what you want. You can of course expose more, since the pattern will be the same (the remote ones: downstreamRemoteAddress(), downstreamDirectRemoteAddress(), etc).
Have you successfully built envoy on your local? Please let me know if you have any issues.
You can follow the official docs https://github.com/envoyproxy/envoy/blob/8a1d44422ba9ffa303c89b109b57e8889655b53a/bazel/README.md#building-envoy-with-bazel on building it, or the short one here (if you're on Linux (Debian-based) and want to use clang): https://gist.github.com/dio/9a7c826a2dbf004a81112db0d167d209.

@dio
OK. Thanks so much.
I will try to build and make some test.
It may take some time. There should be issues in this process that need your help, if so, I will ping you here. : )

@dio
I works on macOS, so took some time to build..
I think i could submit a pr today or tomorrow.

In case anyone is looking for a solution on how to populate x-real-ip header with real client IP address, here's the complete solution which works for me with GKE load balancer.
First, patch the load balancer:
kubectl patch svc istio-ingressgateway -n istio-system -p '{"spec":{"externalTrafficPolicy":"Local"}}'
Then apply the envoy filter:
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: set-remote-address-and-hops
  namespace: istio-system
spec:
  configPatches:
    - applyTo: NETWORK_FILTER
      match:
        context: ANY
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
      patch:
        operation: MERGE
        value:
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
            use_remote_address: true
            xff_num_trusted_hops: 1
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: lua-x-real-ip-filter
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: istio-ingressgateway
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.lua
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
            inlineCode: |
              function envoy_on_request(request_handle)
                request_handle:headers():replace("x-real-ip", request_handle:headers():get("x-envoy-external-address"))
              end

I tried to use downstreamDirectRemoteAddress instead of x-envoy-external-address but that doesn't work in case client passes malformed x-forwarded-for header.


vai_c_tensorflow2 compilation error when the ignore_layers option is specified in the function call vitis_quantize.VitisQuantizer.quantize_model

Description of the issue:
When the ignore_layers option is specified in the function call vitis_quantize.VitisQuantizer.quantize_model, attempt to compile the output quantized_model with vai_c_tensorflow2 will result in the following error

Steps to reproduce the issue:

Quantize a float model with the ignore_layers options in the function call vitis_quantize.VitisQuantizer.quantize_model and save the quantized model:

quantizer = vitis_quantize.VitisQuantizer(float_model)
quantized_model = quantizer.quantize_model(calib_dataset=quant_dataset, fold_conv_bn=False,
   ignore_layers=ignore_layers)
quantized_model.save(quant_model)

Compile the quantized model with the following command:

vai_c_tensorflow2 \
            --model           build/quant_model/q_simple_CNN.h5 \
            --arch            $ARCH \
            --output_dir      build/compiled_$TARGET \
            --net_name        simple_CNN_$TARGET \
            --options '{"input_shape": "4,28,28,1"}'

Possible cause of the error:
Layers listed in ignore_layers are not wrapped by any wrappers during quantization. In contrast, layer not in ignore_layers will be wrapped by either VitisQuantize or QuantizeWrapper. Thus, when the python script tensorflow_translator.py tries to execute
ksize = inner_layer_config.get("kernel_size")

in line 598, which is the previous function call before the error, the value of ksize will be None since inner_layer_config is still the config of previous quantized activation layer and a activation layer has no kernel_size.
The following is the simple CNN model I am testing with:
model = tf.keras.Sequential([
        tf.keras.layers.Conv2D(16, kernel_size=5, strides=2, padding='same', input_shape=in_shape),
        tf.keras.layers.BatchNormalization(),
        tf.keras.layers.Activation('relu'),
        tf.keras.layers.Conv2D(32, kernel_size=5, strides=2, padding='same', trainable=False, use_bias=False),
        tf.keras.layers.BatchNormalization(),
        tf.keras.layers.Activation('relu'),
        tf.keras.layers.Conv2D(64, kernel_size=3, strides=2, padding='same', trainable=False, use_bias=False),
        tf.keras.layers.BatchNormalization(),
        tf.keras.layers.Activation('relu'),
        tf.keras.layers.Conv2D(10, kernel_size=3, strides=3),
        tf.keras.layers.BatchNormalization(),
        tf.keras.layers.Flatten()
    ])

I ignore the second and third Conv2D during quantization.

Hi @williamliao28 ,
Could you please provide the float.h5 and quantized.h5 files? These would be very helpful in resolving the issue.

Hi @williamliao28 ，
Currently, vai_c_tensorflow2 does not support quantized models generated using the ignore_layers option.

Closing this for now. Please re-open if there are any other concerns. Thanks.


Force close with several nodes

Hi,
it is currently the second time, this happens. I don't know why or how.
Sometimes my node automatically closes channels (Today were 4 channels closed. Only 3 in the screenshot, the other one already closed).
Is there a setting i don't know? Or might this be a bug?
Has anyone else experienced this?
I am using the currently released version of RaspiBlitz 1.8.

I first experienced this 2 weeks ago, but due to "Remote Force Close" I thought they closed the channel, but thy don't know either, at least those I asked.

There is no special feature or setting in raspiblitz to force close channels automatically ... best would be (if you havent already) to ask in the Telegram groups if others saw similar things (links listed at https://raspiblitz.org) or ask in other lnd or cln user groups.

Did not happen again. -> Closed


Hugo hangs

When I try to build the website, hugo sometimes hangs. But sometimes it also works. Any idea what I am doing wrong?
➜  maplibre.github.io git:(main) ✗ ./hugow --get-extended serve
Watching for changes in /home/wipfli/maps/maplibre.github.io/{archetypes,assets,content,data,layouts,package.json,static}
Watching for config changes in /home/wipfli/maps/maplibre.github.io/config.toml
Start building sites …
hugo v0.118.2-da7983ac4b94d97d776d7c2405040de97e95c03d+extended linux/amd64 BuildDate=2023-08-31T11:23:51Z VendorInfo=gohugoio

I am running hugo on a clean system now. There, I don't have this error. Closing for now, maybe my setup is just strange...


Build problem with package_info_plus and device_info_plus dependencies

Hi team,
Could you update dependencies ?
package_info_plus: ^4.0.0
device_info_plus: ^9.0.0

Hi,
Those dependencies have already been updated on the dev branch.
We will make a dev release for the v5 on pub.dev soon. For now you can target the dev branch in your pubspec.yaml.


links outdated

links are outdated

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: d70fd385-ba68-efdb-f97e-4bfad385ff47
Version Independent ID: d2fc5e69-77a3-9e97-0869-d2ea54be8e70
Content: SmartCard Class (Windows.Devices.SmartCards) - Windows UWP applications
Content Source: https://cpubwin.visualstudio.com/DefaultCollection/windows-uwp/_git/winrt-api-build?path=%2fwinrt-api-build%2fwindows.devices.smartcards.smartcard.yml&version=GBlive&_a=contents
Product: uwp
Technology: winrt-reference
Git Login: stevewhims
Microsoft Alias: stwhi

Hi, @kb5ylg, and thanks for filing this issue. The link to the Smartcard sample application has a (case-sensitivity) typo in its url. The correct url is this: https://github.com/microsoft/Windows-universal-samples/tree/master/Samples/SmartCard.
I have a fix in the pipeline, and I'll update this comment when that change is live.
Thanks again!
-Steve


Improve Website Design

I would like to contribute to this project by improving the frontend design of the website by adding cards and colors to it. I would recommend to keep it minimalistic yet eye catching so that it attracts the user to the UI/UX of the webpage. I would request you to  assign this issue to me under 𝗚𝗦𝗦𝗼𝗖 '𝟮𝟰 𝗘𝘅𝘁𝗲𝗻𝗱𝗲𝗱. Thank you!

I would like to work on this please assign me this issue.

i want to work on making it more eye cachy and enhance it please assign it to me with tag of  gssoc-ext and hacktoberfest-accepted.

Please assign to me for work to improve website design to looking good and improve the design, then please assign to me work this project!!


Undefined reference to NVS if a component is named "core" (IDFGH-260)

Environment

Development Kit:      [AWS Lanyard]
Core (if using chip or module): [ESP-WROOM-32]
IDF version (git rev-parse --short HEAD to get the commit id.):
4b91c82 (also in release 3.1)
Development Env:		[Make]
Operating System:		[Ubuntu]
Power Supply:         [USB]

Problem Description
If a project includes a component named core, you get undefined reference errors during linking. On the ESP32 forums I was told that there are no built in components named core, so it shouldn't be overwriting anything.
Expected Behavior
It should build
Actual Behavior
LD build/scan.elf
/home/nick/esp-idf/components/esp32/lib/libnet80211.a(ieee80211_api.o):(.text.wifi_init_in_caller_task+0x14): undefined reference to `misc_nvs_init'
/home/nick/esp-idf/components/esp32/lib/libnet80211.a(ieee80211_api.o): In function `wifi_init_in_caller_task':
(.text.wifi_init_in_caller_task+0x50): undefined reference to `misc_nvs_init'
/home/nick/esp-idf/components/esp32/lib/libnet80211.a(ieee80211_ioctl.o):(.text.wifi_deinit_process+0x0): undefined reference to `misc_nvs_deinit'
/home/nick/esp-idf/components/esp32/lib/libnet80211.a(ieee80211_ioctl.o):(.text.wifi_deinit_process+0x16): undefined reference to `misc_nvs_deinit'
/home/nick/esp-idf/components/esp32/lib/libnet80211.a(ieee80211_ioctl.o):(.text.wifi_restore_process+0x0): undefined reference to `misc_nvs_restore'
/home/nick/esp-idf/components/esp32/lib/libnet80211.a(ieee80211_ioctl.o):(.text.wifi_restore_process+0x7): undefined reference to `misc_nvs_restore'
/home/nick/esp-idf/components/esp32/lib/libnet80211.a(ieee80211.o):(.text.wifi_mode_set+0x0): undefined reference to `g_misc_nvs'
collect2: error: ld returned 1 exit status

Steps to reproduce
Add a component named core
Code to reproduce this issue
See attached project. If you do not use the core component, it builds just fine. If you rename it to anything other than core, it also builds just fine.
Debug Logs
scan_test.zip

Hi @nick-atmosphereiot, such issue will happen when a component's name results in the static library name which matches one of the pre-built libraries shipped with IDF:
libc-psram-workaround.a
libm-psram-workaround.a
libc_nano.a
libg-psram-workaround.a
libm.a
libg.a
libc.a
libhal.a
libwps.a
libcoexist.a
libpp.a
libmesh.a
libsmartconfig.a
libwpa.a
libphy.a
libcore.a
librtc.a
libwpa2.a
libespnow.a
libnet80211.a
libbtdm_app.a

So the following component names will cause such issue:
c-psram-workaround
m-psram-workaround
c_nano
g-psram-workaround
m
g
c
hal
wps
coexist
pp
mesh
smartconfig
wpa
phy
core
rtc
wpa2
espnow
net80211
btdm_app

We will update build system documentation to mention this.

Maybe core libs with common name could adopt esp prefix

Hello @nick-atmosphereiot,
thank you for reporting this issue. At Espressif we really appreciate it when our users report issues as it helps us make our products better. Unfortunately there hasn't been any progress with this issue for the last 2 years and we are closing it to keep our backlog manageable.
If you don't agree with this decision, please feel free to reopen the issue or contact me directly.
Regards,
Tomas


Documentation for Allow/Disallow Transfer Others is backwards

In the online book, along with (presumably) the ingame one, the description text for the Allow Transfer Others spell is on the page for Disallow Transfer Others, and vice versa.

fixed for the next release


Better date parse

Related to #29

+1

Hey @xealot. This looks good to me :+1: Could you could squash your commits?

Closed in favour of #31 which is just a squash of this.


Reuqesting edited Architectury API for the NeoForge version

Hello again.
Based on the comment you provided to my previous request, an edited version of the Architectury API is needed for this mod to work with NeoForge 1.21.1 . I have not been able to make the necessary edit to that API, May you please provide the edited version of the Architectury API so I can run this mod? Based on the comments thread, this is a recurring problem so it would be useful for those who have the same issue and are looking for the fix.

I will not share my version - you can build your own using gradlew build. However, this is not a Java nor a Gradle teaching session. Please use Google or some GPT to guide you through the building process.


Swift 3 Support on the way?

Hi guys... I can't wait when you will support Swift 3. I've upgraded to XCode 8 already.. Hope that the update is very soon :) thanks for the great library

Hey @NemOry, we already have a Swift 3 branch

@lfarah I've installed the branch through cocoapods  pod 'EZSwiftExtensions', :git => 'https://github.com/goktugyil/EZSwiftExtensions', :branch => 'Swift3' and I'm still getting compile errors. What am I missing?

I pushed Swift 3 branch with a few errors I couldn't solve. @goktugyil said he'd take a look and fix them


Cluster-based stats improvements - potential GSoC (and future)

Mirroring the FieldTrip API
Eric @larsoner suggested to mirror fieldtrip's cluster-based API in mne python:

Mikolaj, perhaps instead of making a new API proposal, you could try Python-izing the FieldTrip API. No need to reinvent the wheel here if theirs is complete / extensible enough already, and it would have the added benefit of making user code porting simpler.

That makes sense, although I would prefer to change a few things, notably the design, ivar and uvar which are quite confusing for newcomers.
I can start with showing how an almost exact copy of fieldtrip's API would look
(I omit method='montecarlo', because we are considering now mirroring only the cluster-based API - or maybe not, as @jona-sassenhagen suggests):
# within-subjects t-test
from mne.stats import ttest_rel_no_p, cluster_based_statistic

conditions = ['condA', 'condB']

erp_list = list()
for epochs in epochs_list:
    erp_list += [epochs[cond].average() for cond in conditions]

# in fieldtrip, because all the files/trials are passed in a cell array (or
# just varargin) you need additional info sepcifying the design:
conditions = np.array([0, 1] * n_subjects)
subjects = np.array([[i, i] for i in range(n_subjects)]).ravel()
design = np.stack([subjects, conditions], axis=0)

# later in the function `uvar` denotes the row containing 'units of observation',
# (here these are single subject identifiers), while `ivar` denotes levels of independent
# variable. Additonally we have adjacency structure in `adjacency` var

cluster_based_statistic(erp_list, statistic=ttest_rel_no_p, alpha=0.025,
                        cluster_alpha=0.05, cluster_statistic='maxsum',
                        min_nb_chan=2, neighbours=adjacency, tail=0,
                        cluster_tail=0, n_permutations=1000, design=design,
                        uvar=0, ivar=1)
# the alpha is set to 0.025 above to correct for two-tail, fieldtrip also
# allows to set another parameter to have two-tail cluster p values returned

I like the Fieldtrip’s cluster-based API in general but not the design,
ivar, uvar approach. This is something that would require some further
thought. Passing a real design matrix might be ok to add some time later for more advanced users, but
the basic API should be much simpler. A sketchy idea I have:
erp_list = {cond: [epochs[cond].average() for epochs in epochs_list]
            for cond in cond_list}

cluster_based_statistic(erp_list, statistic=ttest_rel_no_p,
                        design='condA - condB', neighbours=adjacency)

and then in ANOVA cases, rm_anova API could be mirrored with factor_levels arg
(or levels to also accommodate linear regression) and effects could be
passed to design (which could be called effects instead of design BTW).
Additionally times or freqs (when dealing with TFR or spectra) could
be passed to crop the search space (this is be similar to fieldtrip’s API).
The next step would be to return some kind of object that holds the results together and allows for selecting clusters and plotting/inspecting results. But that’s another story (I had sketched an API for such object some time ago but couldn’t dig it up now).
So, overall, the fieldtrip API is not so different from what we have in mne, but following things are missing:

support for mne objects and simple interface for at least dependent and independent t-tests
(then adding anova and regression but that could all be followups)
support for 3d data (channel x frequency x time)
min_nb_chan filtering (other forms would be nice too, but as far as I remember they are not supported in fieldtrip)
separating tail and cluster_tail (minor detail, not that useful in most cases)
step_down is nice in mne and I think it should be included in top-level cluster API
some rudimentary viz for cluster-based

Other
I also attach the more general points I sketched in the first mail (those not covered above):

expose a public clustering function (one that works for 1d, 2d and 3d) - so that users can build their more exotic cluster-based approaches more easily (currently all clustering functions are private IIRC)
return an object that holds standard cluster-based results with simple easy API (currelntly 4 variables are returned) along with save and viz functionality (ideally, long-term)
ability to read and write fieldtrip format cluster-based results (conventionally stat in ft)
new cluster-based functions: cluster-based regression; using permutation tests within cluster-based (requires pre-computing the permutation distribution for the ‘smaller’ permutation tests that are used in cluster-based)

Other points gathered from the discussion below:

allow for data to be passed as a dictionary:erp_list = {cond: [epochs[cond].average() for epochs in epochs_list] for cond in cond_list}

define a relatively high level intermediate API that works with only arrays and some sort of high level dimension specification
use Patsy for the design matrices.
consider using HED tags
prefer an API that is agnostic to what method you use for correction for multiple tests:mass_univariate(erp_list, method=('fdr' | 'cluster' | ...), ...)

support regression from the start
show how to do baseline contrasts (#608)
allow threshold='tfce'? (#5534)

If we have an object with cluster-based results, I will write viz functions for it :)

@agramfort - Sure, a separate repo for early steps sounds reasonable.
@jona-sassenhagen

Or regexp: rt* -> rt10, rt11, rt12

I'm not sure I understand - you mean to always use the epochs metadata then?
We could either have use_metadata kwarg or automatically check if passed epochs have metadata with columns corresponding to levels.

I updated the first post a little and will be progressively organizing it as our ideas shape up.
Currently the early API direction seems to be to:

allow for dicts of data
use levels kwarg for specifying levels of factors/predictors
use epochs metadata (in within-subject analysis) when mentioned in levels (maybe with use_metadata safety kwarg)
allow for patsy-like formulas

For within-subject analyses we would have to adopt the 2-step approach (unless someone wants to mess with mixed models): estimating parameters for individual subjects and then testing whether these args are different from zero for example.

One thing that would help us here that we don't have is a tutorials/plot_background_statistical_contrasts.py that shows how to do commonly needed contrasts in Python starting with data in lists of arrays, probably with scipy.stats, patsy, and statsmodels:

t-test (1 sample, 2 sample)
1-way ANOVA (repeated measures, independent)
2-way ANOVA (test for main effects, interaction term x repeated measures / mixed / independent)
Others?

Ideally it would become clear from this tutorial how / why the dict approach can be used to simplify things. Is there some volunteer for this?
If we can settle on clear best practices for such a tutorial, then the clustering API probably does not have to add too much complexity on top of it. The "only" added complexity of clustering has to do with how to properly define adjacency among multiple dimensions, I think. So the mass_univariate API does seem quite appealing.

Im quite open to working on such a tutorial. It’s perhaps the biggest hurdle for people doing basic ERP work who want to use MNE rght now. At the last MNE tutorials I gave, this was the least smooth step.

@larsoner - might that be better suited to add to the biomag mne demos? Or maybe we can use the files from the faces dataset here (in main mne repo)?

No, I don't want to start with multidimensional Neuroimaging data.  If we want it to be like MEG data let's pretend that the data are peak amplitude or latency or something. But we should use synthetic data for this.

@jona-sassenhagen if you have time to work on this please do. There will be overlap with plot_background_statistics.py but we can refactor later.

Just a minor update, I have heard from folks recently that statsmodels has simplified some of the processes of getting your data into the right format for within/between contrasts.
@christianbrodbeck any idea if your testnd functionality could be ported here to take care of some of these problems? It looks like you have made some efforts to generalize our stats stuff.

@larsoner I would be all for it, but the history is completely separate from the mne stats functions (and so the implementation structure is probably also quite different). As far as the front-end is concerned, @agramfort was against including the model specification API I am using in mne, and for the backend I'm using Cython quite a lot...

@christianbrodbeck can you look at the top post to see how much overlap there would be between what @mmagnuski has summarized as our so-far consensus, and what you already have?
What do you use Cython for? Just the clustering step? Does it end up being much faster?