Bogus mutation error related to type inference

type A<'t>(i : IEnumerator<'t>) = class end

type B<'t>(i) =
    inherit A<'t>(i)
    let x = i.Current
    let y = i.MoveNext() // error FS0256: A value must be mutable in order to mutate the contents or take the address of a value type, e.g. 'let mutable x = ...'

type B2<'t>(i : IEnumerator<'t>) =
    inherit A<'t>(i)
    let x = i.Current
    let y = i.MoveNext() // ok

See above, F# 4.0 compiler.
The only difference between B and B2 is the type annotation in the ctor. The compiler successfully infers IEnumerator for i without the annotation (b/c it's passed to base ctor), but issues a bogus error if the annotation is missing.

This is by design - the type of i is still a (constrained) variable type at the point where the method is invoked.


Entry generator

Need a generator to create "entries" (webpack bundles).

[x] Creates an entry .ts file
[x] Creates a Riot component file

Stub for this generator now exists.

First draft of this is done: 408aa72512516f7dbc394c60117fcc8f363c7999


Update and verify directions for getting running on M1.

@danpopnyc
Ok, went through and verified with a clean install.
Signed-off-by: Ville Aikas<EMAIL_ADDRESS>

seeing an issue with the mysql image

machine is running no issues after running new steps! :)

Woot Woot, and just to double-check, the error with mysql not coming up was running with release.yaml vs. release-arm.yaml?

correct.  runs perfectly after changing to release-arm.yaml

Visual confirmation


chore: use Signal.emit instead of emit_signal to avoid UNUSED_SIGNAL warning

Alternatively, the UNUSED_SIGNAL warning could be fully disabled.
Upstream bug report: https://github.com/godotengine/godot/issues/89632

Actually this shouldn't be needed once https://github.com/godotengine/godot/pull/89675 is merged and cherry-picked.
Another alternative would be the use Signal.emit instead of emit_signal. I'll update the PR to do that.

Thanks!


fix: view on open sauced location

Description
changed the unique identifier from bio to the whole profile editable section and added the "View on Opensauced" button  on top of it.
What type of PR is this? (check all applicable)

[ ] 🍕 Feature
[x] 🐛 Bug Fix
[ ] 📝 Documentation Update
[ ] 🎨 Style
[ ] 🧑💻 Code Refactor
[ ] 🔥 Performance Improvements
[ ] ✅ Test
[ ] 🤖 Build
[ ] 🔁 CI
[ ] 📦 Chore (Release)
[ ] ⏩ Revert

Related Tickets & Documents
Fixes #146
Mobile & Desktop Screenshots/Recordings

Added tests?

[ ] 👍 yes
[✅ ] 🙅 no, because they aren't needed
[ ] 🙋 no, because I need help

Added to documentation?

[ ] 📜 README.md
[ ] 📓 docs.opensauced.pizza
[ ] 🍕 dev.to/opensauced
[ ] 📕 storybook
[ ✅] 🙅 no documentation needed

[optional] Are there any post-deployment tasks we need to perform?
[optional] What gif best describes this PR or how it makes you feel?

FYI @Pratham-19

[x] 🐛 Bug Fix

@bdougie  are u referring to mark this pr as bug fix, as I already did that..

@diivi I have made the recommended changes let me know if there's anything more to change

@bdougie are u referring to mark this pr as bug fix, as I already did that. Also I have removed the unwanted lint changes now

I was not. You provided very little context in your description and no story around what you tried or how you came to the conclusion. Each merged PR gets bundled as release notes, and the pr description is a place transfer or gain knowledge.
I went ahead updated the description using the ai extension feature.

@Pratham-19 Thank you for the PR it's great to see it merged.
I am a bit late to the party, yet as for my review, one of the things that I was hoping to solve with this issue is the inconsistency of the button's location.
Here is the screenshots from the merged PR:
Others profile:

Profile with Bio:

Profile with sponsorship:

A profile without bio is the image you added.
You can find all the cases documented if you check the issue itself.


binWidth is allowed to go so low that it does not produce a histogram

when sliding the bin width slider low - all the way to lowest left - the histogram now longer displays anything. We should not allow the binWidth to go so low that it cannot graph anything.
I have tested it on other studies. The following screenshot is from India ICEMR Behavior Cross-sectional study.

adding the question, because we may need to talk about what the new max number of bins should be. also transferring to plot.data


Eq.rec unification problem

Prerequisites

[X] Put an X between the brackets on this line if you have done all of the following:

Checked that your issue isn't already filed.
Reduced the issue to a self-contained, reproducible test case.

Steps to Reproduce
inductive Foo: List α → Type _
| mk (l): Foo l

def Foo.length: Foo l → Nat
| mk l => l.length

variable {Γ Γ': List α} {p: Foo Γ} {h: Γ = Γ'}

@[simp]
theorem eq_rec_length : (h.rec (motive := fun Γ _ => Foo Γ) p).length = p.length
  := h.recOn (motive:= fun x h => (h ▸ p: Foo x).length = p.length) rfl

example               : (h.rec (motive := fun Γ _ => Foo Γ) p).length = p.length := by
  simp only [eq_rec_length]

example               : (h.rec (motive := fun Γ _ => Foo Γ) p).length = p.length := by
  rw [eq_rec_length]

example               : (h.rec (motive := fun Γ _ => Foo Γ) p).length = p.length := eq_rec_length

Expected behavior: eq_rec_length can be used without arguments as it works in Lean3:
inductive Foo {α: Type}: list α → Type
| mk (l: list α): Foo l

def Foo.length {α: Type} {l: list α}: Foo l → ℕ
| (Foo.mk l) := l.length

variables {α: Type} {Γ Γ': list α} {p: Foo Γ} {h: Γ = Γ'}

@[simp]
theorem eq_rec_length : (h.rec p).length = p.length := eq.drec_on h rfl
theorem ex1           : (h.rec p).length = p.length := by simp
theorem ex2           : (h.rec p).length = p.length := by rw [eq_rec_length]
theorem ex3           : (h.rec p).length = p.length := eq_rec_length

Actual behavior: got errors on three examples:
unsolved goals
α : Type ?u.416
Γ Γ' : List α
p : Foo Γ
h : Γ = Γ'
⊢ Foo.length (h ▸ p) = Foo.length p

unsolved goals
α : Type ?u.597
Γ Γ' : List α
p : Foo Γ
h : Γ = Γ'
⊢ Foo.length (h ▸ p) = Foo.length p

α : Type ?u.597
Γ Γ' : List α
p : Foo Γ
h : Γ = Γ'
⊢ Γ' = Γ'

type mismatch
  eq_rec_length
has type
  Foo.length (?m.769 ▸ h ▸ p) = Foo.length (h ▸ p) : Prop
but is expected to have type
  Foo.length (h ▸ p) = Foo.length p : Prop

Reproduces how often: 100%
Versions
nightly-2022-04-23

Lean 3 has a special elaboration function for recursor-like applications. It has special support for inferring the motive for the recursor application. We decided not to implement this feature in Lean 4 and make sure all applications are elaborated using the same code for consistency. We are assuming that match expressions, the ▸ notation, and tactics are better alternatives for using recursors anyway.
That being said, your example exposes a limitation in the ▸ notation: the expected had to be available. The commit above addresses this limitation. We can now write
inductive Foo: List α → Type _
  | mk (l): Foo l

def Foo.length: Foo l → Nat
  | mk l => l.length

variable {α : Type u} {Γ Γ': List α} {p: Foo Γ} {h: Γ = Γ'}

theorem eq_rec_length : (h ▸ p).length = p.length := by
  cases h; rfl

example : (h ▸ p).length = p.length :=
  eq_rec_length

example : (h ▸ p).length = p.length := by
  simp only [eq_rec_length]

example : (h ▸ p).length = p.length := by
  rw [eq_rec_length]

example : (h ▸ p).length = p.length := by
  subst h; rfl

example : (h ▸ p).length = p.length :=
  match h with
  | rfl => rfl

example : (h ▸ p).length = p.length :=
  let (rfl) := h; rfl

If match +  the ▸ notation is not sufficient for all use cases. Our plan is to add a new notation for constructing recursor-like applications in term mode.

I am closing this issue because I think the commit above addresses the issue reported here. Please feel free to reopen if you disagree.


Add @_used and @_section attributes to match #65901

See https://github.com/apple/swift/pull/65901.

@swift-ci please test

Hi @kubamracek 👋
You need to run the code generation to get attribute kinds updated with your changes.
You can read about it here: https://github.com/apple/swift-syntax/blob/main/CodeGeneration/README.md

@kimdv Thanks for the info, I actually did run the regenerate step, but the SimpleDeclAttributes seem to simply have no effect (no need?) on the generated swift files?

...which made me realize that @_used is supposed to be an SimpleDeclAttribute, but @_section isn't and it's supposed to have arguments, so I need to do some more work here :)

@swift-ci please test

@swift-ci please test

And I’m removing the code generation of decl modifiers and type attributes here: https://github.com/apple/swift-syntax/pull/1715

Do we need this at all? They can be parsed as custom attributes, and it's fine, right?

Ah, true. We would need if @_used and @_section were type attributes to disambiguate @_used () -> Void but that doesn’t appear to be the case.

Ha! So I don't even need the parser changes (section attr takes a string argument), and I can just close this PR?

Yes, looks like it.


REPL & Host Output has double-spaced output

When we dump output from a cmd in REPL the output has alot whitespace and causes wordwrap and then double spaced output in the window.  This also happens to api callers that dump to the output window.

Thoughts: Perhaps related to #230 as that provides the window size?

Closing this out as a Duplicate


Conversational agent returning action plan as response after 0.0.260 release

System Info
After I upgraded my Langchain to version 0.0.260, the ConversationalChatAgent returns the action plan as the chat response.
Who can help?
No response
Information

[ ] The official example notebooks/scripts
[ ] My own modified scripts

Related Components

[ ] LLMs/Chat Models
[ ] Embedding Models
[ ] Prompts / Prompt Templates / Prompt Selectors
[ ] Output Parsers
[ ] Document Loaders
[ ] Vector Stores / Retrievers
[ ] Memory
[ ] Agents / Agent Executors
[ ] Tools / Toolkits
[ ] Chains
[ ] Callbacks/Tracing
[ ] Async

Reproduction
Steps to reproduce: request something that will make a ConversationalChatAgent call a tool.
Expected behavior
The agent should pass the action and action_input to the tool and not return it as a final response to the user.

It's very difficult to come up with a solution without you giving the exact code that you used. In my case, I used the ConversationalChatAgent as follows and everything is working fine. If I don't turn the verbosity, it only gives me the final response:

from langchain.agents.conversational_chat.base import ConversationalChatAgent
from langchain.agents import load_tools, AgentExecutor
from langchain.chat_models import ChatOpenAI
from langchain.chains import LLMChain
from langchain.memory import ConversationBufferMemory
import os

os.environ['OPENAI_API_KEY'] = '<TEST>'
chat_llm = ChatOpenAI(model_name="gpt-3.5-turbo-16k")
tools = load_tools(["arxiv", "wikipedia"])
prompt = ConversationalChatAgent.create_prompt(tools = tools)
llm_chain = LLMChain(llm=chat_llm,prompt=prompt)
agent = ConversationalChatAgent(llm_chain=llm_chain)
executor = AgentExecutor.from_agent_and_tools(
    agent=agent,
    tools=tools,
    memory=ConversationBufferMemory(input_key="input", memory_key="chat_history",return_messages=True),
)
while True:
    print(executor.run(input()))

My Conversation
Hello
Hello! How can I assist you today?
Who is John wick?
John Wick is an American neo-noir action thriller media franchise created by Derek Kolstad. It centers on the character John Wick, a former hitman who is forced back into the criminal underworld. The franchise includes several films, starting with 'John Wick' in 2014, followed by sequels such as 'John Wick: Chapter 2' in 2017, 'John Wick: Chapter 3 – Parabellum' in 2019, and 'John Wick: Chapter 4' in 2023. The films have been critically acclaimed and have collectively earned over $1 billion worldwide.
How many sequenls of the above movie has been released?
There have been four sequels of the John Wick movie released so far.


feat: add mocks  for indexer

fixes #441 #442 #443

Closing this PR as i didn't noticed the #444 PR


added support to jakartaee for scheduled annotation plugin

What does this PR do?

relates to #1543
Checklist

[x] This is an enhancement of existing features, or a new feature in existing plugins

[x] I have updated CHANGELOG.asciidoc
[x] I have added tests that prove my fix is effective or that my feature works
[x] I have made corresponding changes to the documentation

:grey_exclamation: Build Aborted

The PR is not allowed to run in the CI yet

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Reason: The PR is not allowed to run in the CI yet

Start Time: 2021-11-09T18:40:26.173+0000

Duration: 3 min 27 sec

Commit: ed0130a63b64a861afb10268f47477e6fbf0e267

:robot: GitHub comments
To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

run benchmark tests : Run the benchmark test.

run compatibility tests : Run the JDK Compatibility test.

run integration tests : Run the APM-ITs.

/test

/test

@elasticmachine run elasticsearch-ci/docs


[Enhancement] Support Alter finish task process queued

What type of PR is this：

[ ] bug
[ ] feature
[x] enhancement
[ ] others

Which issues of this PR fixes ：

Fixes #
Problem Summary(Required) ：

Now, FE handle alter finish request directly, there will be be_num * alter_tablet_worker_count concurrency request, each request will acquire db write lock & write bdbje, it will affect other operation like ingestion.

run starrocks_fe_unittest

run starrocks_fe_unittest

run starrocks_fe_unittest

run starrocks_fe_unittest

run starrocks_fe_unittest

run starrocks_fe_unittest

run starrocks_fe_unittest

[FE PR Coverage check]
:disappointed: fail : 48 / 65 (73.85%)
file detail

path
covered line
new line
coverage

:large_blue_circle:
com/starrocks/master/MasterImpl.java
4
11
36.36%

:large_blue_circle:
com/starrocks/task/AlterReplicaTask.java
38
48
79.17%

:large_blue_circle:
com/starrocks/common/ThreadPoolManager.java
1
1
100.00%

:large_blue_circle:
com/starrocks/common/Config.java
2
2
100.00%

:large_blue_circle:
com/starrocks/alter/AlterHandler.java
3
3
100.00%


Added error codes for international calls

For the Committer

[ ] I made sure that the site looks great and functions perfectly live
[ ] I ran splell check
[ ] I'm ready for these changes to be made live

For the Reviewer
General Review

[ ] All changes/updates requested were intentionally changed or added (no extraneous file or partial updates)
[ ] The live rendered page behaves and looks like intended.
[ ] All links work as intended. (click every link to make sure that it takes the user to the expected place).
[ ] The markdown was rendered to HTML as intended. (Tables look right, code samples are gated properly).
[ ] Any style or CSS changes are tested on multiple different pages to ensure nothing unexpected broke or changed.
[ ] I proof-read the live site (gitbook serve) and there are no oblivious splelling or grammer misteaks.

Gitbook Specific

[ ] Any new documentation pages have been added to the SUMMARY.md file so they are rendered to HTML.
[ ] Any links to other pages within this documentation use relative links ([read more about ...](guides/voice/voicemail.md)).
[ ] Gitbook can install and build the documentation (gitbook install & gitbook build)

Code Specific

[ ] All code has been tested against the live API.
[ ] All code can be run without throwing errors or new warnings.
[ ] All code is formatted correctly and consistently (spaces, tabs).
[ ] All code is legible and idiomatic to the language.
[ ] All code uses sensical method, function, and variable names.
[ ] All code samples use the appropriate syntax highlighting.
[ ] Any examples re-use same phone numbers, uuids, variable names, etc... throughout (IE don't have something like {from: '+19191231234', to: '+19191231234'} unless it's meant to show the same phone number calling/texting itself ).

TL;DR

[ ] I did these things
[ ] I'm ready for these changes to be made live

 International-lite error codes and FAQ updates

Preview Changes at:
http://bw-apdocs-add-international-error-codes.s3-website-us-east-1.amazonaws.com/


[BC Idea]: Unix Timestamp handling

BC Idea Link
https://experience.dynamics.com/ideas/idea/?ideaid=9f991316-73fd-ee11-a73c-6045bdb93e93
Description
Creating a unix timestamp in AL code is usually pretty straightforward, but not when the code used by different client types. A webservice client is always in UTC and does not need any time zone corrections, while a web client session does. E.g.
OriginDateTime := System.CreateDateTime(DMY2Date(1, 1, 1970), 0T);
TimeZoneOffset := TimeZone.GetTimezoneOffset(OriginDateTime);
OriginDateTime := OriginDateTime + TimeZoneOffset;
exit((CurrentDateTime - OriginDateTime) div 1000)

We run into issues when a webservice client is started by a regular user (using authorization code grant flow). Such a user has a time zone offset, while the webservice client session is in UTC. The timestamp generated by code above would be off by the user timezone offset (that is actually only applicable to the web client). The client type can be determined using CurrentClientType(), but that doesn't help if you need a unix timestamp is in a background client that was created by either a web client or webservice client.
Idea: add a wrapper for the C# code below:
DateTimeOffset.UtcNow.ToUnixTimeSeconds()
This far more straightforward and always works, regardless of the client type.
I've suggested to add this to Type Helper in de Base App. However, @JesperSchulz suggested to add it to the System App instead. It could be added to the "Date and Time" component as a codeunit (facade/impl) that can handle various conversions between Unix timestamps and regular DateTime-variables.
I will provide the implementation for this BC Idea

[X] I will provide the implementation for this BC Idea

Makes a lot of sense. Approved.


Two files exported when trying to rename filename.

Hi,
Anyone tried to rename output file to some_style.min.css?
I am trying to change the output file name with the following task:
gulp.task('compass', false, function () {
  return gulp.src([SASS_PATH + '/**/*.scss')
    .pipe(changed(DEST_PATH, {extension: '.min.css'}))
    .pipe(compass({
      config_file: 'config.rb',
      css: DEST_PATH,
      sass: SASS_PATH,
      style: 'compressed',
      debug: false,
      require: ['susy'],
    }))
    .pipe($.autoprefixer())
    .pipe($.rename({
      suffix: ".min"
    }))
    .pipe(gulp.dest(DEST_PATH))
    .pipe(reload({stream: true}));
});

When I run the above task, it exports some_style.css as well as some_style.min.css.
How can I export only some_style.min.css file?

Same case for me, adding a suffix creates both with and without suffix files.
Have you found a way to handle this ?

It's actually not an issue of gulp-compass but Compass itself.
You could rename it in ruby callback in  config_file (config.rb) by placing
require "fileutils"

on_stylesheet_saved do |file|
  if File.exists?(file)
    filename = File.basename(file, File.extname(file))
    File.rename(file, css_dir + "/" + filename + ".min" + File.extname(file))
  end
end

http://h3r2on.com/2013/05/17/rename-css-on-compile.html

The best solution I found is Delete files in a pipeline to delete unneeded some_style.css file after renaming into some_style.min.css
the result task could be
var del = require('del');
var vinylPaths = require('vinyl-paths');

gulp.task('compass', false, function () {
  return gulp.src([SASS_PATH + '/**/*.scss')
    .pipe(changed(DEST_PATH, {extension: '.min.css'}))
    .pipe(compass({
      config_file: 'config.rb',
      css: DEST_PATH,
      sass: SASS_PATH,
      style: 'compressed',
      debug: false,
      require: ['susy'],
    }))
    .pipe($.autoprefixer())
    .pipe(vinylPaths(del))
    .pipe($.rename({
      suffix: ".min"
    }))
    .pipe(gulp.dest(DEST_PATH))
    .pipe(reload({stream: true}));
});


Tax Changes in purchase modules

[x] No Tax needed for transaction with 'non vat registered', 'GCC non vat registered' and 'Non GCC'

issue fixed !


Surface Domains v1

#4862 will migrate Domains to owlbot.
googleapis-gen repo now has google/cloud/domains/v1.
We should think about surfacing v1.

Closing this as we have V1 in Domains. Probably this issue never got closed when V1 was introduced in Domains.


fix: remove order from DocumentInfo as apparently unneeded (fixes #5245)

Fixes #5245. Includes migration, however I did not test the reverse.

Holding for after deploy of feat/postgres (as it contains migrations)

Yuck, I seem to have botched my attempt to helpfully update this.

Ok, that's cleaned up. Sorry for the distraction!


Update developing get started page

Related Ticket(s)
Closes #1491
Description

Changelog
New

Adds React wrapper section
Added React deprecation notice to the React section

Changed

all React wrapper links direct use to the Frameworks / React wrapper page

Removed

{{removed thing}}

Direct link: https://ibmdotcom-library.s3-web.us-south.cloud-object-storage.appdomain.cloud/deploy-previews/1518/developing

@RichKummer for me the roadmap link is going to the git/zenhub road map (screen shot) is that what you see too?

We might want to delete that wiki roadmap, it was last updated in 2021 😅

For some reason it's dropping me at the Github homepage. This is what I'm seeing when clicking on the link in the build:

And yeah wasn't sure about the wiki page for the same reason!

@RichKummer I am guessing it's because you don't have the zenhub plugin installed in Github, so maybe it makes more sense to use the zenhub link, since the roadmap is part of the Zenhub service and not Github  https://app.zenhub.com/workspaces/carbon-for-ibmcom-5d449f3642eb1962336cbe52/roadmap

The last link worked for me @oliviaflory if we want to use that instead!


Update 2015-07-17-sparkberry-pi.markdown

This tutorial was updated to

resolved issues with classloader.
documented new installation process for groovy.
updated Spark version.
added slf4j logging.

Thanks!


rtabmap_ros: 0.20.18-2 in 'melodic/distribution.yaml' [bloom]

Increasing version of package(s) in repository rtabmap_ros to 0.20.18-2:

upstream repository: https://github.com/introlab/rtabmap_ros.git
release repository: https://github.com/introlab/rtabmap_ros-release.git
distro file: melodic/distribution.yaml
bloom version: 0.10.7
previous version for package: 0.20.16-1

Note: merge https://github.com/ros/rosdistro/pull/31965 before this one


feat(postgraphql): support graphql GET requests (#442)

Resolves #442
Updates to PostGraphQL to support GraphQL GET requests:
http://graphql.org/learn/serving-over-http/#get-request

I'm concerned if we merge this as-is it may open a potentially huge XSS security flaw - it does not seem to prevent mutations? This would mean you could link someone like
<a
  href='http://blah/graphql?query=mutation{deleteMyAccount() { clientMutationId } }'>
    Check out my Twitter!
</a>

Good point. Okay I will add checks to throw 4xx on GET mutations and add a unit test or two for that.

Awesome, thanks Matt. Are you aware of anyone detailing the security implications/best practices for GraphQL - it would be good to check we're compliant.

Thanks Benjie --
Sure, I'll look into security best practices.
I Just looked around to see how other projects are handling mutation get requests.
The first project I looked into, graphql-go, allows mutations via GET.
Here's an issue where it is discussed: https://github.com/graphql-go/graphql/issues/60#issuecomment-154350258
And some examples: https://github.com/graphql-go/graphql/blob/master/examples/todo/main.go#L219
--
Thinking more about the XSS security -- and the link you gave as an example. If that mutation were secured the XSS attacker would need a token to authorize the request. It would be a best practice to have something like a deleteMyAccount mutation require an authenticated user.
An attacker would not know the token to add it to the query params or to the headers.
Is it correct that only default role mutations would be at risk?
Common public / anonymous mutations would be for signup / account creation and that likely would be secured with email verification or OAuth.

Yeah, I realised after sending that the GET isn't really much more vulnerable than POST in that regard since you can submit a form to a different domain too; however it's generally advised that you don't use GET for mutations anyway for many reasons including caching, leaking info via logs, tracking, etc. E.g. a createAccount mutation may specify an email or password which would then be in the query string which may well make it through to the server logs.

Query params will be encrypted the same as a POST request body. HTTPS encrypts query parameters so we should be safe in that regard.

Yes, the caching concerns are something we'll want to resolve. It's possible to run into caching issues if the cache is configured for all GET requests.
We could add Cache-Control headers to prevent mutation caching.

So express-graphql only allow mutations on POST; here's the code for that:
https://github.com/graphql/express-graphql/blob/f5f37b4f1fa0566c5e5e7eacbea076ed54951d72/src/index.js#L234-L253
Can we add something like that?

Absolutely, Thanks. I will make updates to add that.

The XSS attacks are mitigated by HTTP-only cookies, and the CSRF attacks are mitigated by double-submit SameOrigin HttpOnly cookies.  We would need to build these into postgraphile -- see https://github.com/postgraphql/postgraphql/issues/501

Could you point me to documentation on these "SameOrigin" cookies? My knowledge of cookies is a little dated, but AFAIK cookies are only ever sent back to the location that they originated (hence: same origin); however I'm not aware of a feature that prevents a submit from another website to our target origin from sending the cookie (other than features that the attacker can opt out of), which is what we need to prevent to protect against CSRF. A quick google does not reveal anything to the contrary, and I would expect an advancement like this to be big news.
Additional validations can take place (for example looking at the Referer and Origin headers of the incoming request) but these are not 100% reliable (though they're getting more reliable as time passes and more browsers enforce them).
CORS does not protect us because to perform an attack you don't need to receive the response, just send the request, so you don't need to opt into CORS.
The reason that the technique is called "Double Submit" is that you send it once through the HttpOnly cookie and once through the request itself; hence double submit. If you only send it through the cookie that's only a single submit and does not confer any protections.
Someone is going to have to prove to me beyond a shadow of a doubt that this is secure against CSRF before I allow it for mutations.

Yes, SameSite, sorry.  And it is implemented in Chrome 51+ and Opera.  That said, we don't need to rely on it.
Double-submit cookies are designed to protect against CSRF attacks.
From the OWASP page: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Double_Submit_Cookie

When a user authenticates to a site, the site should generate a (cryptographically strong) pseudorandom value and set it as a cookie on the user's machine separate from the session id. The site does not have to save this value in any way, thus avoiding server side state. The site then requires that every transaction request include this random value as a hidden form value (or other request parameter). A cross origin attacker cannot read any data sent from the server or modify cookie values, per the same-origin policy. This means that while an attacker can force a victim to send any value he wants with a malicious CSRF request, the attacker will be unable to modify or read the value stored in the cookie. Since the cookie value and the request parameter or form value must be the same, the attacker will be unable to successfully force the submission of a request with the random CSRF value.

The important part to note about that is it's not JUST a cookie, you also must submit the value through other means, just like the JWT. It cannot be passive or it will not work.

The site then requires that every transaction request include this random value as a hidden form value (or other request parameter).

(By the way, you can implement this by just using the csurf middleware before PostGraphQL and injecting the double submit cookie value into the page HTML, then sending it along with every XHR (which I do via a header to keep things tidy); I do this in a client project combined with pgSettings since we don't use JWT and I don't want it vulnerable to CSRF attacks.)

The important part to note about that is it's not JUST a cookie, you also must submit the value through other means, just like the JWT. It cannot be passive or it will not work.

Yeah, I get that.  I don't get why you keep saying it.

By the way, you can implement this by just using the csurf middleware before PostGraphQL and injecting the double submit cookie value into the page HTML,

No, because my API and my SSR server are different.  The API would have to write the token to the DB and the SSR server would also have to be directly connected to the DB (currently SSR server only talks to API) -- this is why they're a thing.  Moreover, the cookie-part of the token needs to be signed so an attacker can't just write over top of it from a sub-domain.
I will definitely be implementing double-submit tokens and HttpOnly JWT cookies because I do believe they are more secure.  You've given me a great deal of guidance on the subject, and I hope to be able to contribute the effort back into the repo -- no love lost if you don't merge my PR at that point in time though.

I don't get why you keep saying it.

My apologies, I was under the impression you thought that sending the JWT through "properly configured" cookies only (and not also sending the DoubleSubmit value through another means) would be more secure - I see now I was misreading your messages and apologise for the miscommunication.

No, because my API and my SSR server are different. The API would have to write the token to the DB and the SSR server would also have to be directly connected to the DB (currently SSR server only talks to API). Because of this, the double-submit CSRF token is a good fit.

Ah, I get your intention now! By leveraging the fact that both servers can share the same domain regarding cookies they can share both the JWT cookie without having to communicate with each other (just using the user agent as the propagation mechanism). The SSR server can then just pass this cookie on verbatim to the GraphQL API for validation and authorization. To solve the CSRF issues this would introduce you introduce a DoubleSubmit cookie (with associated additional data transfer). Makes sense!
I think you can implement your CSRF token generation and cookie setting on your SSR server, and still validate it on your GraphQL API without needing to modify PostGraphQL in any way? Seems possible but I've not spent much time thinking about it. If you do achieve it that way it'd make a great documentation article!

I'm not saying the current JWT method should be tossed

I, however, am. I don't use the JWT features in my own apps and there are a number of security reasons I want to move away from JWT, but I've not yet formulated a full stateless solution that I am certain is secure and doesn't carry with it a large number of trade-offs. I really want to deprecate JWT with the release of v4 but cannot until I have a suitable alternative in place. More on this in a future issue though ;)

My apologies, I was under the impression you thought that sending the JWT through "properly configured" cookies only (and not also sending the DoubleSubmit value through another means) would be more secure - I see now I was misreading your messages and apologise for the miscommunication.

Double-submit tokens are in addition to the typical JWT.  They don't have expiration times -- they last the duration of the session.  They're just a random CSRF token.  The double-submit token is not the JWT.  I do suggest sending the JWT only through an HTTP only cookie -- protected by the double-submit token alongside it.

Ah, I get your intention now! By leveraging the fact that both servers can share the same domain regarding cookies they can share both the JWT cookie without having to communicate with each other (just using the user agent as the propagation mechanism). The SSR server can then just pass this cookie on verbatim to the GraphQL API for validation and authorization. To solve the CSRF issues this would introduce you introduce a DoubleSubmit cookie (with associated additional data transfer). Makes sense!

Yes!!!!!

I think you can implement your CSRF token generation and cookie setting on your SSR server, and still validate it on your GraphQL API without needing to modify PostGraphQL in any way? Seems possible but I've not spent much time thinking about it. If you do achieve it that way it'd make a great documentation article!

My plan was to generate the JWT and the CSRF token alongside eachother when auth'd.  Then, when the user requests a page from the SSR server, the SSR server would get the cookie too (same domain) and could pass it along to the API with the SSR server's own requests.  Also, the SSR server would be able to see the additional double-submit token in the cookie and could simply replicate it from there.

I'm not saying the current JWT method should be tossed
I, however, am.

If we do get rid of it, we should make sure we replace it with something that pushes tokens into redis and has proper expiration times and refresh tokens.

Hi! What is the status on this? If this PR is abandoned, perhaps it should be archived @benjie .

This is effectively a TODO for me. I need to spend some time ensuring I understand the security implications/best practices; then I intend to add/merge this functionality. As always, lack of time is the issue here.


Fix typo Devolopers to Developers

Replaced Devolopers with Developers.

Docs Build status updates of commit 848ba51:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

docs/Xamarin.Forms/ListViewCachingStrategy.xml
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching in the Docs contributor and Admin GuideSee the frequently asked questionsPost your question in the Docs support channel


feat: Add photo discovery sample built with Flutter, Vertex AI Search, and Reasoning Engine

Description
Adding the sample app built for I/O 2024 session with @kazunori279: Build generative AI agents with Vertex AI Agent Builder and Flutter
Thank you for opening a Pull Request!
Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

[x] Follow the CONTRIBUTING Guide.
[x] You are listed as the author in your notebook or README file.

[x] Your account is listed in CODEOWNERS for the file(s).

[x] Make your Pull Request title in the https://www.conventionalcommits.org/ specification.
[x] Ensure the tests and linter pass (Run nox -s format from the repository root to format).
[x] Appropriate docs were updated (if necessary)

CC @koverholt! First time opening a PR for this repo, so please let me know if anything needs fixing. Thank you!

Thanks for your contribution here! I'll review now and post feedback shortly. But this looks like a great example and companion code for your existing talk! 🙏

Accept your suggestions @holtskinner! Thanks so much for the review!
@kazunori279 There's a few comments remaining from Kris for Vertex Agent side of things. Once you've resolved those, I think we're good to land!


Pi constant is not pie emoji

Pls fix.

This is a really nice idea.  Which emoji do you propose? 🍰?
🍰 is currently reserved for variable declarations, but that doesn’t make much sense either so we could change that.

I suggest this one:
https://emojipedia.org/search/?q=pie
It was added as part of unicode 10 in Emoji 5.0
If you'd like a suggestion for declaration I think something like the loudspeaker emoji may make sense?
https://emojipedia.org/public-address-loudspeaker/

The loudspeaker does make a lot of sense, great idea! Do you want to create an issue for that? I try to collect all ideas on how to change the syntax separately so we can get the big picture for Emojicode 0.6.
As far as the Unicode 10 pie is concerned, not even Apple supports these emojis yet so this might be suboptimal.

Submitted an issue ticket for the variable declaration.
Should all syntax ideas have their own ticket?
Eventually it'll be on all computers! Maybe an issue for the future then.
Maybe something like a pizza pie 🍕 could work but it's only a slice.
Or a whole cake 🎂  ironically, and pi/4 (or tau/2 or 🎾  at the moment) could be the new 🍰 .

Yes, all syntax ideas should have their own issue. Feel free to submit as many as you want.
🎂 and  🍰 would certainly work if pie isn’t available widely enough, when the 0.6 release is imminent.

The pie emoji is coming to macOS in 10.13.1: https://www.macrumors.com/2017/10/17/apple-seeds-macos-high-sierra-10-3-1-beta-3/, other vendor's emojis are also already known: https://unicode.org/emoji/charts/full-emoji-list.html#1f967.  We'll therefore definitely go with U+1F967.

Will ship with Emojicode Symphonic 0.6


[Snyk] Security upgrade golang from 1.13 to 1.17.13

This PR was automatically created by Snyk using the credentials of a real user.As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user.
Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.
Changes included in this PR

Dockerfile

We recommend upgrading to golang:1.17.13, as this image has only 110 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.
Some of the most important vulnerabilities in your base image include:

Severity
Priority Score / 1000
Issue
Exploit Maturity

714
Directory Traversal SNYK-DEBIAN10-DPKG-2847944
No Known Exploit

714
Buffer Overflow SNYK-DEBIAN10-OPENSSL-1569403
No Known Exploit

714
OS Command Injection SNYK-DEBIAN10-OPENSSL-2807585
No Known Exploit

714
OS Command Injection SNYK-DEBIAN10-OPENSSL-2933515
No Known Exploit

614
Use After Free SNYK-DEBIAN10-SUBVERSION-2635642
No Known Exploit

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
🛠 Adjust project settings

Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

cc @mnezh as original author - is this Dockerfile still used anywhere?

cc @mnezh as original author - is this Dockerfile still used anywhere?

most probably not used anymore


Reporting issues - prevent spaming with empty messages or one word

Fixes #
Describe the changes you have made in this PR -

refactor reporting issues
adding a missing div
prevent submitting spamming messages which is less than 2 words

Reporting issues - prevent spamming with empty messages or one word

Screenshots of the changes (If any) -
Note: Please check Allow edits from maintainers. if you would like us to assist in the PR.

Coverage remained the same at 84.087% when pulling 1b2e48c73ef9db718c83d7e16203e8f36866fb5a on mahmodHammad:reportissue into bc89cead0b643d42eb6c38010b69c2bee52b4fa1 on CircuitVerse:master.

@mahmodHammad  change "input" spelling in popup

You can use 'require'  in input field  this will not send empty text I think

Rather than 2 words let's keep the error on not empty.
Also, is it possible this error message is displayed under the text field [like a validation] rather than a separate alert?

actually I am thinking  of  making the button disabled if  the input message is less than 2 words instead of that alert message
@nitin10s  what do you think about that?

Exactly solves the problem in a lot less code.

You can use 'require' in the input field this will not send an empty text I think
@yash15601  I have tried it, but for some reason, it doesn't work, also we want to prevent the spam messages which has one word, like "test" or "fiwhfhw"

Did you used require  or required According  to me it should work

Looks good great  work 😃

I tried required not require

I don't think we should have a minimum word limit. I can't decide what will be appropriate. I would prefer the Can't send an empty form.

I don't think we should have a minimum word limit. I can't decide what will be appropriate. I would prefer the Can't send an empty form.

I used just one-word limit, users will never provide us anything useful will one word.

@nitin10s
i removed the one word limit ,please check it again

@nitin10s  Please check it again after changes

Can you please resolve the AccessLint check @mahmodHammad


Enable OMPS integration plugins

OSBS-7542

Part of https://github.com/containerbuildsystem/atomic-reactor/pull/1227
Signed-off-by: Martin Bašti<EMAIL_ADDRESS>

Release notes:

Add push_operator_manifests plugin for integration with OMPS into arrangement 6 (must be explicitly enabled at atomic-reactor)


Different between .pd and .ckpt format model file?

Hi,
I am a little confused  about the pd format model files. Could you please teach me the difference between:
modelname.pd.meta/index/data-00000-of-00001
and
modelname.ckpt.meta/index/data-00000-of-00001
?
Thanks.
Best,
pengbol

hello,
in the project,both format model files are same.


CUBLAS and CLBLAST builds on Windows

Please write an instruction how to make CUBLAS and CLBLAST builds on Windows. I have spent like half of the day without any success. My current attempt for CUBLAS is the following bat file:
SET CUDAFLAGS="-arch=all -lcublas" && SET LLAMA_CUBLAS=1 && SET CMAKE_ARGS="-DLLAMA_CUBLAS=on" && SET FORCE_CMAKE=1 && pip install llama-cpp-python[server] --force-reinstall --upgrade --no-cache-dir
pause
pip uninstall pydantic
pip install "pydantic==1.*"
And for CLBLAST:
SET LLAMA_CLBLAST=1 && SET CMAKE_ARGS="-DLLAMA_CLBLAST=on" && SET FORCE_CMAKE=1 && pip install llama-cpp-python[server] --force-reinstall --upgrade --no-cache-dir
pause
pip uninstall pydantic
pip install "pydantic==1.*"
Somehow it doesn't like pydantic v2.* and I had to downgrade it.
Neither of them seem to work. When I run
python -m llama_cpp.server --model c:\ai\llama\Wizard-Vicuna-13B-Uncensored.ggmlv3.q5_K_M.bin  --n_gpu_layers 100 --use_mmap 0
All layers are loaded in to the RAM.

#182 might help, but if it doesn't I can't help you as I use Ubuntu. llama.cpp is not well supported on Windows as it was written for MacOS and ported to Linux.

If your issue is specific to pydantic #457 may be relevant.

#182 might help, but if it doesn't I can't help you as I use Ubuntu. llama.cpp is not well supported on Windows as it was written for MacOS and ported to Linux.

Thanks for a quick reply! I will try that tomorrow.

This worked for me (win10  + AMD GPU)

Ensure you have cmake installed
install python clblast package using conda

for some reason installation of pyclblast failed for me, so I used conda

conda install -c conda-forge clblast

then just install llama-cpp-python adding required PATH variables

set CMAKE_ARGS="-DLLAMA_CLBLAST=on" && set FORCE_CMAKE=1 && set LLAMA_CLBLAST=1 && pip install llama-cpp-python --no-cache-dir

You can optionally add  --verbose argument to verify it found and used BLAS
Check if it works

(base) C:\WINDOWS\system32>python
Python 3.10.12 | packaged by Anaconda, Inc. | (main, Jul  5 2023, 19:01:18) [MSC v.1916 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> from llama_cpp import Llama
ggml_opencl: selecting platform: 'AMD Accelerated Parallel Processing'
ggml_opencl: selecting device: 'gfx1031'
ggml_opencl: device FP16 support: true

and when loading model
>>> llm = Llama(model_path='./../models/nous-hermes-13b.ggmlv3.q4_K_M.bin', n_gpu_layers=8)
AVX = 1 | AVX2 = 1 | AVX512 = 0 | AVX512_VBMI = 0 | AVX512_VNNI = 0 | FMA = 1 | NEON = 0 | ARM_FMA = 0 | F16C = 1 | FP16_VA = 0 | WASM_SIMD = 0 | BLAS = 1 | SSE3 = 1 | VSX = 0 |

| BLAS = 1 |

Probably you also need to add GGML_OPENCL_DEVICE=... to system variables to specify which device to use by default (in the case you have several)

i will say that this worked well for me, i can make a cublas and a clblast version, and its fine on windows.
caveats:

clblast will work with nvidia, but won't use f16 (cuz bad nv opencl drivers)
clblast doesn't do multigpu (wish it could span my amd and nvidia! that would be cool!)
cublas tensor splitting is .... idiosyncratic.   not sure how to get it to "just auto-split" evenly and "only if needed".   manually setting the splits always seems to work tho.

For the installation and the solution that produced the result, see user jllllllllll's post:
Problem to install llama-cpp-python on Windows 10 with GPU NVidia Support CUBlast, BLAS = 0 #721
https://github.com/abetlen/llama-cpp-python/issues/721#issuecomment-1723205068


Assignment 2 commit

closing without accepting.  please include the jpegs in the README.md as per the instructions


MongoDB Adapter: db is not a function

Title
NextAuth MongoDB Adapter: db is not a function
How to reproduce ☕
n/a
Your question/bug report 📓
I am following the docs https://next-auth.js.org/adapters/mongodb but I got this error
"TypeError: db is not a function"
my adapter is already version 276 so this #210  doesn't help
[...nextauth].js file:
import NextAuth from "next-auth";
import GoogleProvider from "next-auth/providers/google";
import { MongoDBAdapter } from "@next-auth/mongodb-adapter";
import clientPromise from "../../../utils/mongodb";

export default async function auth(req, res) {
  return await NextAuth(req, res, {
    providers: [
      GoogleProvider({
        clientId: process.env.GOOGLE_CLIENT_ID,
        clientSecret: process.env.GOOGLE_CLIENT_SECRET,
      }),
    ],
    adapter: MongoDBAdapter({
      db: (await clientPromise).db("your-database"),
    }),
    callbacks: {
      redirect: async (url, _) => {
        if (url == "/api/auth/signin") {
          return Promise.resolve("/home");
        }
        return Promise.resolve("/home");
      },
      session: async (session, user, _sessionToken) => {
        return Promise.resolve(session);
      },
    },
  });
}

Contributing  🙌🏽
No, I'm afraid I cannot help regarding this

could you check the adapter version in node_modules to be sure?

Having the same issue.

could you check the adapter version in node_modules to be sure?

I have exactly the same issue for firebase adapter

I run npm uninstall and uninstall all packages then run this command from the docs:
npm install next-auth@beta @next-auth/mongodb-adapter@next mongodb
my problem is solved now


Expand test suite for SortedArrayStringMap

I noticed that some corner cases of the equals and serialization methods of the SortedArrayStringMap class were not (unit) tested, and that its hashCode method was not tested at all. This pull request provides small changes to the test suite to address this.
Let me know if you have any questions, or if you would like a similar PR against the master (3.x) branch.
I also included a change earlier made in master on this file to bring the 2.x and 3.x versions more in sync.
Thanks for your hard work on log4j.

These are great additions! Thanks so much @avandeursen! I will merge the changes as soon as build succeeds.


Revert the Deberta attention optimisation

The deberta optimisations made in #183 have memory issues with NER.
Reverting the optimisations for now.

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint.