yarn audit analyzer

Describe the bug
When analyzing projects with a yarn.lock file:
"java.util.NoSuchElementException: No value present" occurs at "org.owasp.dependencycheck.analyzer.YarnAuditAnalyzer.fetchYarnAuditJson(YarnAuditAnalyzer.java:244)"
Version of dependency-check used
The problem occurs using version 6.5.2 of the cli
Expected behavior
Finished Yarn Audit Analyzer

Your report is missing key information for debugging and/or analysis. Please use the issue template provided.

I've got exactly the same issue on the version 7.0.0...

I have the same issue with yarn 2 lockfile. Is yarn 2 (berry) already supported?

What I understand is, that it has nothing todo with the lockfile.
It tries to read the generated audit file from yarn and it should contain `Audit Request".
Possible issue:

tmp folder/file permissions
yarn audit output is not expected

So I run the  yarn audit --offline --json --verbose > yarn_audit.json manully.
In my usecase the output was not expected.
Instead of the audit line I got:
{"type":"verbose","data":"Error: Couldn't find a package.json file in.... .cache/yarn/v6/npm-caniuse-lite-1.0.30001204-256c85709a348ec4d175e847a3b515c66e79f2aa-integrity/node_modules/caniuse-lite\""}

@anthony-o did you perform yarn before audit and could you provide output of the audit command?

In my GitLab pipeline I was having the same problem and solved it by setting the yarn cache path to the current directory using yarn config set cache-folder $CI_PROJECT_DIR/.yarn_cache.
I am using owasp / dependency-check: 7.1.1 as a docker image for the scan job image which downloads the cache from the previous yarn install job, for which I use as the docker image  node: 16.16.0- alpine3.15 (yarn version 1.22.19).

This looks like dependencyCheckAggregate is not able to parse yarn.lock file. It is a bug because dependencyCheck of gradle is not updated to be able to check yarn v3' s yarn.lock file.
To resolve this we need to wait for a solution and till we have a solution we need to add the following setting to our build.gradle configuration :
dependencyCheck {
analyzers {
nodeAudit {
yarnEnabled = false
}
}
}

Hello, any news regarding this issue?

Hi Jeremy,
Sorry for the late response. I did not find time to correct that problem. But I know the root cause and whenever I finish it I will inform you.
Thank you so much.
Kind Regards,
Dede, Mehmet
Senior Java Developer
From: rjkf-cybermax2005 @.>
Date: Monday, 15 May 2023 at 18:15
To: jeremylong/DependencyCheck @.>
Cc: Dede, Mehmet @.>, Assign @.>
Subject: Re: [jeremylong/DependencyCheck] yarn audit analyzer (Issue #4215)
Hello, any news regarding this issue?
—
Reply to this email directly, view it on GitHubhttps://github.com/jeremylong/DependencyCheck/issues/4215#issuecomment-1548244991, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AZGAJIJIVADILW5YD4DVWDDXGJQDRANCNFSM5Q57XKQQ.
You are receiving this because you were assigned.Message ID: @.***>

This e-mail and any attachments is intended only for the attention of the addressee(s). Its unauthorised use, disclosure, storage or copying is not permitted. If you are not the intended recipient, please destroy all copies and inform the sender by return e-mail. Internet e-mail is not a secure medium. Any reply to this message could be intercepted and read by someone else. Please bear that in mind when deciding whether to send material in response to this message by e-mail. This e-mail (whether you are the sender or the recipient) may be monitored, recorded and retained by the Ministry of Justice. Monitoring / blocking software may be used, and e-mail content may be read at any time. You have a responsibility to ensure laws are not broken when composing or forwarding e-mails and their contents.

Any updates here?

Hello, are there any chances what it will be fixed in near future?

With Dependency-Check Core version 8.4.0 and yarn 1.22.19, we see the following log (when outputting to a --log file):
DEBUG - Launching: [yarn, audit, --offline, --json, --verbose]

DEBUG - Process Error Out: {"type":"error","data":"Couldn't find any versions for \"@types/prop-types\" that matches \"^15.7.5\" in our cache (possible versions are \"\"). This is usually caused by a missing entry in the lockfile, running Yarn without the --offline flag may help fix this issue."}

Executing yarn audit --offline --json --verbose (which it appears is what the OWASP Dependency Check is doing) results in the same error. Running yarn audit --json --verbose, i.e. without the --offline flag as the error suggests, results in a successful yarn audit scan.
Our yarn.lock file has an entry for "@types/prop-types@*":, which currently resolves to @types/prop-types/-/prop-types-15.7.7.
So this appears to be a problem with yarn audit when run in --offline mode (the package reference does exist within the lock file and has been downloaded to the node_modules and yarn cache folder).
I guess either yarn audit needs fixing or dependency-check needs to use the online version (maybe an option flag for the CLI & Maven/Gradle plugins?).

with yarn 3
yarn npm audit --json --recursive

gives me : ......."dependencies":1523,"devDependencies":14,"optionalDependencies":0,"totalDependencies":1537}
Can we launch the audit by ourself, and then tells ODC to analyse our audit to avoid errors ?

I've launch the following audit command on my project :
Yarn 1.22.19:
yarn audit --all --recursive --json > yarn1all.json

{
    "type": "auditAdvisory",
    "data": {
        "resolution": {
            "id": 1092971,
            "path": "cypress>@cypress/request",
            "dev": true,
            "optional": false,
            "bundled": false
        },
        "advisory": {
            "findings": [
                {
                    "version": "2.88.12",
                    "paths": [
                        "cypress>@cypress/request"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<=2.88.12",
            "module_name": "@cypress/request",
            "severity": "moderate",
            "github_advisory_id": "GHSA-p8p7-x288-28g6",
            "cves": [
                "CVE-2023-28155"
            ],
            "access": "public",
            "patched_versions": ">=3.0.0",
            "cvss": {
                "score": 6.1,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "updated": "2023-08-14T20:53:47.000Z",
            "recommendation": "Upgrade to version 3.0.0 or later",
            "cwe": [
                "CWE-918"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1092971,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2023-28155\n- https://github.com/request/request/issues/3442\n- https://github.com/request/request/pull/3444\n- https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf\n- https://security.netapp.com/advisory/ntap-20230413-0007/\n- https://github.com/github/advisory-database/pull/2500\n- https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116\n- https://github.com/request/request/blob/master/lib/redirect.js#L111\n- https://github.com/cypress-io/request/pull/28\n- https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f\n- https://github.com/cypress-io/request/releases/tag/v3.0.0\n- https://github.com/advisories/GHSA-p8p7-x288-28g6",
            "created": "2023-03-16T15:30:19.000Z",
            "reported_by": null,
            "title": "Server-Side Request Forgery in Request",
            "npm_advisory_id": null,
            "overview": "The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).\n\nNOTE: The `request` package is no longer supported by the maintainer.",
            "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6"
        }
    }
}
{
    "type": "auditAdvisory",
    "data": {
        "resolution": {
            "id": 1089270,
            "path": "cra-bundle-analyzer>webpack-bundle-analyzer>ejs",
            "dev": true,
            "optional": false,
            "bundled": false
        },
        "advisory": {
            "findings": [
                {
                    "version": "2.7.4",
                    "paths": [
                        "cra-bundle-analyzer>webpack-bundle-analyzer>ejs"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<3.1.7",
            "module_name": "ejs",
            "severity": "critical",
            "github_advisory_id": "GHSA-phwq-j96m-2c2q",
            "cves": [
                "CVE-2022-29078"
            ],
            "access": "public",
            "patched_versions": ">=3.1.7",
            "cvss": {
                "score": 9.8,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
            },
            "updated": "2023-01-30T05:02:57.000Z",
            "recommendation": "Upgrade to version 3.1.7 or later",
            "cwe": [
                "CWE-74"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1089270,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2022-29078\n- https://eslam.io/posts/ejs-server-side-template-injection-rce/\n- https://github.com/mde/ejs/commit/15ee698583c98dadc456639d6245580d17a24baf\n- https://github.com/mde/ejs/releases\n- https://security.netapp.com/advisory/ntap-20220804-0001/\n- https://github.com/advisories/GHSA-phwq-j96m-2c2q",
            "created": "2022-04-26T00:00:40.000Z",
            "reported_by": null,
            "title": "ejs template injection vulnerability",
            "npm_advisory_id": null,
            "overview": "The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).",
            "url": "https://github.com/advisories/GHSA-phwq-j96m-2c2q"
        }
    }
}
{
    "type": "auditAdvisory",
    "data": {
        "resolution": {
            "id": 1091181,
            "path": "gulp>glob-watcher>chokidar>glob-parent",
            "dev": true,
            "optional": false,
            "bundled": false
        },
        "advisory": {
            "findings": [
                {
                    "version": "3.1.0",
                    "paths": [
                        "gulp>glob-watcher>chokidar>glob-parent"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<5.1.2",
            "module_name": "glob-parent",
            "severity": "high",
            "github_advisory_id": "GHSA-ww39-953v-wcq6",
            "cves": [
                "CVE-2020-28469"
            ],
            "access": "public",
            "patched_versions": ">=5.1.2",
            "cvss": {
                "score": 7.5,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "updated": "2023-02-28T22:39:43.000Z",
            "recommendation": "Upgrade to version 5.1.2 or later",
            "cwe": [
                "CWE-400"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1091181,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2020-28469\n- https://github.com/gulpjs/glob-parent/pull/36\n- https://github.com/gulpjs/glob-parent/blob/6ce8d11f2f1ed8e80a9526b1dc8cf3aa71f43474/index.js%23L9\n- https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2\n- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093\n- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059092\n- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905\n- https://www.oracle.com/security-alerts/cpujan2022.html\n- https://github.com/gulpjs/glob-parent/pull/36/commits/c6db86422a9731d4f3d332ce4a81c27ea6b0ee46\n- https://github.com/advisories/GHSA-ww39-953v-wcq6",
            "created": "2021-06-07T21:56:34.000Z",
            "reported_by": null,
            "title": "glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex",
            "npm_advisory_id": null,
            "overview": "This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.",
            "url": "https://github.com/advisories/GHSA-ww39-953v-wcq6"
        }
    }
}
{
    "type": "auditAdvisory",
    "data": {
        "resolution": {
            "id": 1093882,
            "path": "react-scripts>@svgr/webpack>@svgr/plugin-svgo>svgo>css-select>nth-check",
            "dev": true,
            "optional": false,
            "bundled": false
        },
        "advisory": {
            "findings": [
                {
                    "version": "1.0.2",
                    "paths": [
                        "react-scripts>@svgr/webpack>@svgr/plugin-svgo>svgo>css-select>nth-check"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<2.0.1",
            "module_name": "nth-check",
            "severity": "high",
            "github_advisory_id": "GHSA-rp65-9cf3-cjxr",
            "cves": [
                "CVE-2021-3803"
            ],
            "access": "public",
            "patched_versions": ">=2.0.1",
            "cvss": {
                "score": 7.5,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "updated": "2023-09-13T21:49:55.000Z",
            "recommendation": "Upgrade to version 2.0.1 or later",
            "cwe": [
                "CWE-1333"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1093882,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2021-3803\n- https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726\n- https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0\n- https://lists.debian.org/debian-lts-announce/2023/05/msg00023.html\n- https://github.com/advisories/GHSA-rp65-9cf3-cjxr",
            "created": "2021-09-20T20:47:31.000Z",
            "reported_by": null,
            "title": "Inefficient Regular Expression Complexity in nth-check",
            "npm_advisory_id": null,
            "overview": "There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.\n\nThe ReDoS vulnerabilities of the regex are mainly due to the sub-pattern `\\s*(?:([+-]?)\\s*(\\d+))?` with quantified overlapping adjacency and can be exploited with the following code.\n\n**Proof of Concept**\n```js\n// PoC.js\nvar nthCheck = require(\"nth-check\")\nfor(var i = 1; i <= 50000; i++) {\n    var time = Date.now();\n    var attack_str = '2n' + ' '.repeat(i*10000)+\"!\";\n    try {\n        nthCheck.parse(attack_str) \n    }\n    catch(err) {\n        var time_cost = Date.now() - time;\n        console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\n    }\n}\n```\n\n**The Output**\n```\nattack_str.length: 10003: 174 ms\nattack_str.length: 20003: 1427 ms\nattack_str.length: 30003: 2602 ms\nattack_str.length: 40003: 4378 ms\nattack_str.length: 50003: 7473 ms\n```",
            "url": "https://github.com/advisories/GHSA-rp65-9cf3-cjxr"
        }
    }
}
{
    "type": "auditAdvisory",
    "data": {
        "resolution": {
            "id": 1094304,
            "path": "react-scripts>resolve-url-loader>postcss",
            "dev": true,
            "optional": false,
            "bundled": false
        },
        "advisory": {
            "findings": [
                {
                    "version": "7.0.39",
                    "paths": [
                        "react-scripts>resolve-url-loader>postcss"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<8.4.31",
            "module_name": "postcss",
            "severity": "moderate",
            "github_advisory_id": "GHSA-7fh5-64p2-3v2j",
            "cves": [
                "CVE-2023-44270"
            ],
            "access": "public",
            "patched_versions": ">=8.4.31",
            "cvss": {
                "score": 5.3,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
            },
            "updated": "2023-10-10T21:32:38.000Z",
            "recommendation": "Upgrade to version 8.4.31 or later",
            "cwe": [
                "CWE-74",
                "CWE-144"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1094304,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2023-44270\n- https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5\n- https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25\n- https://github.com/postcss/postcss/releases/tag/8.4.31\n- https://github.com/github/advisory-database/issues/2820\n- https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
            "created": "2023-09-30T00:31:10.000Z",
            "reported_by": null,
            "title": "PostCSS line return parsing error",
            "npm_advisory_id": null,
            "overview": "An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be `\\r` discrepancies, as demonstrated by `@font-face{ font:(\\r/*);}` in a rule.\n\nThis vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.",
            "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j"
        }
    }
}
{
    "type": "auditSummary",
    "data": {
        "vulnerabilities": {
            "info": 0,
            "low": 0,
            "moderate": 2,
            "high": 2,
            "critical": 1
        },
        "dependencies": 150,
        "devDependencies": 1854,
        "optionalDependencies": 0,
        "totalDependencies": 2004
    }
}

Yarn 3.2.2:
yarn npm audit --all --recursive --json > yarn3all.json

{
    "actions": [],
    "advisories": {
        "1092470": {
            "findings": [
                {
                    "version": "4.1.2",
                    "paths": [
                        "cypress>@cypress/request>tough-cookie",
                        "react-scripts>jest>@jest/core>jest-runner>jest-environment-jsdom>jsdom>tough-cookie",
                        "cra-bundle-analyzer>react-scripts>jest>@jest/core>jest-runner>jest-environment-jsdom>jsdom>tough-cookie",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>@jest/core>jest-runner>jest-environment-jsdom>jsdom>tough-cookie",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-runner>jest-environment-jsdom>jsdom>tough-cookie",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>jest-runner>jest-environment-jsdom>jsdom>tough-cookie"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<4.1.3",
            "module_name": "tough-cookie",
            "severity": "moderate",
            "github_advisory_id": "GHSA-72xf-g2v4-qvf3",
            "cves": [
                "CVE-2023-26136"
            ],
            "access": "public",
            "patched_versions": ">=4.1.3",
            "cvss": {
                "score": 6.5,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
            },
            "updated": "2023-07-11T13:44:36.000Z",
            "recommendation": "Upgrade to version 4.1.3 or later",
            "cwe": [
                "CWE-1321"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1092470,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2023-26136\n- https://github.com/salesforce/tough-cookie/issues/282\n- https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e\n- https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3\n- https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873\n- https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html\n- https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
            "created": "2023-07-01T06:30:16.000Z",
            "reported_by": null,
            "title": "tough-cookie Prototype Pollution vulnerability",
            "npm_advisory_id": null,
            "overview": "Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in `rejectPublicSuffixes=false` mode. This issue arises from the manner in which the objects are initialized.",
            "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3"
        },
        "1092971": {
            "findings": [
                {
                    "version": "2.88.11",
                    "paths": [
                        "cypress>@cypress/request"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<=2.88.12",
            "module_name": "@cypress/request",
            "severity": "moderate",
            "github_advisory_id": "GHSA-p8p7-x288-28g6",
            "cves": [
                "CVE-2023-28155"
            ],
            "access": "public",
            "patched_versions": ">=3.0.0",
            "cvss": {
                "score": 6.1,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "updated": "2023-08-14T20:53:47.000Z",
            "recommendation": "Upgrade to version 3.0.0 or later",
            "cwe": [
                "CWE-918"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1092971,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2023-28155\n- https://github.com/request/request/issues/3442\n- https://github.com/request/request/pull/3444\n- https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf\n- https://security.netapp.com/advisory/ntap-20230413-0007/\n- https://github.com/github/advisory-database/pull/2500\n- https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116\n- https://github.com/request/request/blob/master/lib/redirect.js#L111\n- https://github.com/cypress-io/request/pull/28\n- https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f\n- https://github.com/cypress-io/request/releases/tag/v3.0.0\n- https://github.com/advisories/GHSA-p8p7-x288-28g6",
            "created": "2023-03-16T15:30:19.000Z",
            "reported_by": null,
            "title": "Server-Side Request Forgery in Request",
            "npm_advisory_id": null,
            "overview": "The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).\n\nNOTE: The `request` package is no longer supported by the maintainer.",
            "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6"
        },
        "1093108": {
            "findings": [
                {
                    "version": "1.2.3",
                    "paths": [
                        "eslint>optionator>word-wrap",
                        "@typescript-eslint/parser>eslint>optionator>word-wrap",
                        "@typescript-eslint/eslint-plugin>@typescript-eslint/parser>eslint>optionator>word-wrap",
                        "eslint-config-airbnb-typescript>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>eslint>optionator>word-wrap",
                        "react-scripts>eslint-config-react-app>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>eslint>optionator>word-wrap",
                        "cra-bundle-analyzer>react-scripts>eslint-config-react-app>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>eslint>optionator>word-wrap",
                        "cra-bundle-analyzer>react-scripts>eslint-config-react-app>eslint-plugin-jest>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>eslint>optionator>word-wrap",
                        "cra-bundle-analyzer>react-scripts>eslint-config-react-app>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>eslint>@eslint-community/eslint-utils>eslint>optionator>word-wrap",
                        "cra-bundle-analyzer>react-scripts>eslint-config-react-app>eslint-plugin-jest>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>eslint>@eslint-community/eslint-utils>eslint>optionator>word-wrap",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-runner>jest-environment-jsdom>jsdom>escodegen>optionator>word-wrap",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>jest-runner>jest-environment-jsdom>jsdom>escodegen>optionator>word-wrap"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<1.2.4",
            "module_name": "word-wrap",
            "severity": "moderate",
            "github_advisory_id": "GHSA-j8xg-fqg3-53r7",
            "cves": [
                "CVE-2023-26115"
            ],
            "access": "public",
            "patched_versions": ">=1.2.4",
            "cvss": {
                "score": 5.3,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
            },
            "updated": "2023-08-24T21:37:44.000Z",
            "recommendation": "Upgrade to version 1.2.4 or later",
            "cwe": [
                "CWE-1333"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1093108,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2023-26115\n- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657\n- https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973\n- https://github.com/jonschlinkert/word-wrap/blob/master/index.js#L39\n- https://github.com/jonschlinkert/word-wrap/releases/tag/1.2.4\n- https://github.com/jonschlinkert/word-wrap/commit/420dce9a2412b21881202b73a3c34f0edc53cb2e\n- https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39\n- https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
            "created": "2023-06-22T06:30:18.000Z",
            "reported_by": null,
            "title": "word-wrap vulnerable to Regular Expression Denial of Service",
            "npm_advisory_id": null,
            "overview": "All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.\n",
            "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7"
        },
        "1093262": {
            "findings": [
                {
                    "version": "5.7.1",
                    "paths": [
                        "@typescript-eslint/eslint-plugin>semver",
                        "@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver",
                        "@typescript-eslint/eslint-plugin>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver",
                        "eslint-config-airbnb-typescript>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver",
                        "react-scripts>eslint-config-react-app>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver",
                        "cra-bundle-analyzer>react-scripts>eslint-config-react-app>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver",
                        "cra-bundle-analyzer>react-scripts>eslint-config-react-app>eslint-plugin-jest>@typescript-eslint/eslint-plugin>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver",
                        "cra-bundle-analyzer>react-scripts>eslint-config-react-app>eslint-plugin-jest>@typescript-eslint/eslint-plugin>@typescript-eslint/type-utils>@typescript-eslint/utils>@typescript-eslint/typescript-estree>semver",
                        "cra-bundle-analyzer>react-scripts>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-compilation-targets>@babel/core>semver",
                        "cra-bundle-analyzer>react-scripts>jest>@jest/core>jest-config>babel-jest>babel-preset-jest>babel-preset-current-node-syntax>@babel/plugin-syntax-optional-chaining>@babel/core>semver",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>@jest/core>jest-config>babel-jest>babel-preset-jest>babel-preset-current-node-syntax>@babel/plugin-syntax-optional-chaining>@babel/core>semver",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>babel-jest>babel-preset-jest>babel-preset-current-node-syntax>@babel/plugin-syntax-optional-chaining>@babel/core>semver",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>jest-runner>jest-runtime>jest-snapshot>babel-preset-current-node-syntax>@babel/plugin-syntax-optional-chaining>@babel/core>semver",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>jest-runner>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>semver",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-runner>jest-resolve>jest-haste-map>fsevents>nan>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>jest-runner>jest-resolve>jest-haste-map>fsevents>nan>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>jest-runner>jest-runtime>jest-resolve>jest-haste-map>fsevents>nan>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>jest-runner>jest-runtime>jest-snapshot>@jest/transform>jest-haste-map>fsevents>nan>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<5.7.2",
            "module_name": "semver",
            "severity": "moderate",
            "github_advisory_id": "GHSA-c2qf-rxjj-qqgw",
            "cves": [
                "CVE-2022-25883"
            ],
            "access": "public",
            "patched_versions": ">=5.7.2",
            "cvss": {
                "score": 5.3,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
            },
            "updated": "2023-09-01T23:43:55.000Z",
            "recommendation": "Upgrade to version 5.7.2 or later",
            "cwe": [
                "CWE-1333"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1093262,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/npm/node-semver/pull/585\n- https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c\n- https://github.com/npm/node-semver/pull/593\n- https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
            "created": "2023-06-21T06:30:28.000Z",
            "reported_by": null,
            "title": "semver vulnerable to Regular Expression Denial of Service",
            "npm_advisory_id": null,
            "overview": "Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.",
            "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"
        },
        "1093882": {
            "findings": [
                {
                    "version": "1.0.2",
                    "paths": [
                        "i18next-parser>cheerio>cheerio-select>css-select>nth-check",
                        "react-scripts>@svgr/webpack>@svgr/plugin-svgo>svgo>css-select>nth-check",
                        "cra-bundle-analyzer>react-scripts>@svgr/webpack>@svgr/plugin-svgo>svgo>css-select>nth-check",
                        "react-scripts>css-minimizer-webpack-plugin>cssnano>cssnano-preset-default>postcss-svgo>svgo>css-select>nth-check",
                        "cra-bundle-analyzer>react-scripts>css-minimizer-webpack-plugin>cssnano>cssnano-preset-default>postcss-svgo>svgo>css-select>nth-check"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<2.0.1",
            "module_name": "nth-check",
            "severity": "high",
            "github_advisory_id": "GHSA-rp65-9cf3-cjxr",
            "cves": [
                "CVE-2021-3803"
            ],
            "access": "public",
            "patched_versions": ">=2.0.1",
            "cvss": {
                "score": 7.5,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "updated": "2023-09-13T21:49:55.000Z",
            "recommendation": "Upgrade to version 2.0.1 or later",
            "cwe": [
                "CWE-1333"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1093882,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2021-3803\n- https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726\n- https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0\n- https://lists.debian.org/debian-lts-announce/2023/05/msg00023.html\n- https://github.com/advisories/GHSA-rp65-9cf3-cjxr",
            "created": "2021-09-20T20:47:31.000Z",
            "reported_by": null,
            "title": "Inefficient Regular Expression Complexity in nth-check",
            "npm_advisory_id": null,
            "overview": "There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.\n\nThe ReDoS vulnerabilities of the regex are mainly due to the sub-pattern `\\s*(?:([+-]?)\\s*(\\d+))?` with quantified overlapping adjacency and can be exploited with the following code.\n\n**Proof of Concept**\n```js\n// PoC.js\nvar nthCheck = require(\"nth-check\")\nfor(var i = 1; i <= 50000; i++) {\n    var time = Date.now();\n    var attack_str = '2n' + ' '.repeat(i*10000)+\"!\";\n    try {\n        nthCheck.parse(attack_str) \n    }\n    catch(err) {\n        var time_cost = Date.now() - time;\n        console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\n    }\n}\n```\n\n**The Output**\n```\nattack_str.length: 10003: 174 ms\nattack_str.length: 20003: 1427 ms\nattack_str.length: 30003: 2602 ms\nattack_str.length: 40003: 4378 ms\nattack_str.length: 50003: 7473 ms\n```",
            "url": "https://github.com/advisories/GHSA-rp65-9cf3-cjxr"
        },
        "1094304": {
            "findings": [
                {
                    "version": "7.0.39",
                    "paths": [
                        "react-scripts>postcss",
                        "cra-bundle-analyzer>react-scripts>postcss",
                        "cra-bundle-analyzer>react-scripts>tailwindcss>postcss",
                        "cra-bundle-analyzer>react-scripts>tailwindcss>postcss-import>postcss",
                        "cra-bundle-analyzer>react-scripts>css-loader>postcss-modules-local-by-default>icss-utils>postcss",
                        "cra-bundle-analyzer>react-scripts>css-minimizer-webpack-plugin>cssnano>cssnano-preset-default>css-declaration-sorter>postcss",
                        "cra-bundle-analyzer>react-scripts>css-minimizer-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-rules>cssnano-utils>postcss"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<8.4.31",
            "module_name": "postcss",
            "severity": "moderate",
            "github_advisory_id": "GHSA-7fh5-64p2-3v2j",
            "cves": [
                "CVE-2023-44270"
            ],
            "access": "public",
            "patched_versions": ">=8.4.31",
            "cvss": {
                "score": 5.3,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
            },
            "updated": "2023-10-10T21:32:38.000Z",
            "recommendation": "Upgrade to version 8.4.31 or later",
            "cwe": [
                "CWE-74",
                "CWE-144"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1094304,
            "references": "- https://nvd.nist.gov/vuln/detail/CVE-2023-44270\n- https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5\n- https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25\n- https://github.com/postcss/postcss/releases/tag/8.4.31\n- https://github.com/github/advisory-database/issues/2820\n- https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
            "created": "2023-09-30T00:31:10.000Z",
            "reported_by": null,
            "title": "PostCSS line return parsing error",
            "npm_advisory_id": null,
            "overview": "An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be `\\r` discrepancies, as demonstrated by `@font-face{ font:(\\r/*);}` in a rule.\n\nThis vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.",
            "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j"
        },
        "1094415": {
            "findings": [
                {
                    "version": "7.21.5",
                    "paths": [
                        "react-scripts>@babel/core>@babel/traverse",
                        "react-scripts>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>@svgr/webpack>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>@svgr/webpack>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>@svgr/webpack>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-compilation-targets>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>jest>@jest/core>jest-config>babel-jest>babel-preset-jest>babel-preset-current-node-syntax>@babel/plugin-syntax-optional-chaining>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>@jest/core>jest-config>babel-jest>babel-preset-jest>babel-preset-current-node-syntax>@babel/plugin-syntax-optional-chaining>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>babel-jest>babel-preset-jest>babel-preset-current-node-syntax>@babel/plugin-syntax-optional-chaining>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>jest-runner>jest-runtime>jest-snapshot>babel-preset-current-node-syntax>@babel/plugin-syntax-optional-chaining>@babel/core>@babel/helper-module-transforms>@babel/traverse",
                        "cra-bundle-analyzer>react-scripts>jest-watch-typeahead>jest>jest-cli>@jest/core>jest-config>jest-runner>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>@babel/helper-module-transforms>@babel/traverse"
                    ]
                }
            ],
            "metadata": null,
            "vulnerable_versions": "<7.23.2",
            "module_name": "@babel/traverse",
            "severity": "critical",
            "github_advisory_id": "GHSA-67hx-6x53-jw92",
            "cves": [
                "CVE-2023-45133"
            ],
            "access": "public",
            "patched_versions": ">=7.23.2",
            "cvss": {
                "score": 9.3,
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
            },
            "updated": "2023-10-20T13:27:09.000Z",
            "recommendation": "Upgrade to version 7.23.2 or later",
            "cwe": [
                "CWE-184"
            ],
            "found_by": null,
            "deleted": null,
            "id": 1094415,
            "references": "- https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92\n- https://nvd.nist.gov/vuln/detail/CVE-2023-45133\n- https://github.com/babel/babel/pull/16033\n- https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82\n- https://github.com/babel/babel/releases/tag/v7.23.2\n- https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4\n- https://www.debian.org/security/2023/dsa-5528\n- https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html\n- https://babeljs.io/blog/2023/10/16/cve-2023-45133\n- https://github.com/advisories/GHSA-67hx-6x53-jw92",
            "created": "2023-10-16T13:55:36.000Z",
            "reported_by": null,
            "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code",
            "npm_advisory_id": null,
            "overview": "### Impact\n\nUsing Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods.\n\nKnown affected plugins are:\n- `@babel/plugin-transform-runtime`\n- `@babel/preset-env` when using its [`useBuiltIns`](https://babeljs.io/docs/babel-preset-env#usebuiltins) option\n- Any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`\n\nNo other plugins under the `@babel/` namespace are impacted, but third-party plugins might be.\n\n**Users that only compile trusted code are not impacted.**\n\n### Patches\n\nThe vulnerability has been fixed in `<EMAIL_ADDRESS>6 does not receive security fixes anymore (see [Babel's security policy](https://github.com/babel/babel/security/policy)), hence there is no patch planned for<EMAIL_ADDRESS>Workarounds\n\n- Upgrade `@babel/traverse` to v7.23.2 or higher. You can do this by deleting it from your package manager's lockfile and re-installing the dependencies. `@babel/core` >=7.23.2 will automatically pull in a non-vulnerable version.\n- If you cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above, upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions:\n  - `@babel/plugin-transform-runtime` v7.23.2\n  - `@babel/preset-env` v7.23.2\n  - `@babel/helper-define-polyfill-provider` v0.4.3\n  - `babel-plugin-polyfill-corejs2` v0.4.6\n  - `babel-plugin-polyfill-corejs3` v0.8.5\n  - `babel-plugin-polyfill-es-shims` v0.10.0\n  - `babel-plugin-polyfill-regenerator` v0.5.3",
            "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92"
        }
    },
    "muted": [],
    "metadata": {
        "vulnerabilities": {
            "info": 0,
            "low": 0,
            "moderate": 43,
            "high": 5,
            "critical": 14
        },
        "dependencies": 1523,
        "devDependencies": 14,
        "optionalDependencies": 0,
        "totalDependencies": 1537
    }
}

Files does not have the same structure, and

I think the solution isn't necessarily that yarn should be friendlier in --offline mode, it's that the error from YarnAuditAnalyzer could be friendlier.
Like @ChrisSamo632, there is an error in the logs.  It doesn't pain me to have dependency-checker fail if the item resolved by yarn isn't the one in the yarn.lock, but it would be nice to have that as the error instead of something rather crytic.
That is, instead of
[WARN] An unexpected error occurred during analysis of '/src/yarn.lock' (Yarn Audit Analyzer): No value present
[ERROR]
java.util.NoSuchElementException: No value present
	at java.base/java.util.Optional.get(Optional.java:143)
	at org.owasp.dependencycheck.analyzer.YarnAuditAnalyzer.fetchYarnAuditJson(YarnAuditAnalyzer.java:240)
        ...

Have something like:
[WARN] An unexpected error occurred during analysis of '/src/yarn.lock' (Yarn Audit Analyzer): Couldn't find any versions for<EMAIL_ADDRESS>that matches \"4.0.1\".
[ERROR] Unable to generate a yarn audit because of a mismatch between the yarn.lock and resolved dependencies.

The full log:
DEBUG - Launching: [yarn, audit, --offline, --json, --verbose]
2024-01-19 21:41:35,175 org.owasp.dependencycheck.analyzer.YarnAuditAnalyzer:234
DEBUG - Process Error Out: {"type":"error","data":"Couldn't find any versions for<EMAIL_ADDRESS>that matches \"4.0.1\" in our cache (possible versions are \"\"). This is usually caused by a missing entry in the lockfile, running Yarn without the --offline flag may help fix this issue."}

2024-01-19 21:41:35,175 org.owasp.dependencycheck.analyzer.YarnAuditAnalyzer:235
DEBUG - Process Out:
2024-01-19 21:41:35,177 org.owasp.dependencycheck.AnalysisTask:94
WARN  - An unexpected error occurred during analysis of '/src/yarn.lock' (Yarn Audit Analyzer): No value present
2024-01-19 21:41:35,179 org.owasp.dependencycheck.AnalysisTask:96
ERROR -
java.util.NoSuchElementException: No value present
	at java.base/java.util.Optional.get(Optional.java:143)
	at org.owasp.dependencycheck.analyzer.YarnAuditAnalyzer.fetchYarnAuditJson(YarnAuditAnalyzer.java:240)
	at org.owasp.dependencycheck.analyzer.YarnAuditAnalyzer.analyzePackage(YarnAuditAnalyzer.java:280)
	at org.owasp.dependencycheck.analyzer.YarnAuditAnalyzer.analyzeDependency(YarnAuditAnalyzer.java:105)
	at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131)
	at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:88)
	at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:37)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:840)

Had a look at this, and it seems not so simple to resolve. The error handling is not great, and although relatively easily improved, it's not trivial to correct the real problem.
The old/existing implementation runs yarn audit in --verbose/--offline mode and then scrapes the query that yarn would otherwise make to the npm registry from the output. it is this output query scraping that fails, as it is no longer in the output, even if you correct the flags.
It then uses the same code as for the other analyzer to actually call the npm registry APIs directly, parse the response etc.
There does not seem an equivalent approach that will work with yarn npm audit on Yarn Berry, except to rely on yarn to query the registry instead. It's not really clear to me why the previous implementation worked the way it did, but if the JSON output is the same perhaps it's possible to just reuse the parsed output from the registry while allowing yarn to make the call.
In addition to this, it's probably required to validate this all works with corepack enable and various styles of usage of yarn (e.g the modern approach where it expects you to have the specific yarn version source controlled in .yarn and referred to via a .yarnrc.yml etc).

Its been a while since I looked at the Yarn implementation - but I believe we intercepted the request to get a complete listing of the dependencies. The results from the API call only contain the vulnerable dependencies.

Ahh ok, interesting, that makes sense. There's probably a different way to get that now, via yarn info --recursive --json but haven't really looked into it as it's not a command I regularly use.


Use MySQL function and column as conditional value

Hello,
I tried to use the clause grouping as mentioned in the doc PDO/docs/Clause/CONDITIONAL.md:
 // ... WHERE col_1 = ? AND (col_2 = ? OR col_3 = ?)
 $statement->where(
     new Clause\Grouping("AND", array(
         new Clause\Conditional("col_1", "=", "val_1"),
         new Clause\Grouping("OR", array(
             new Clause\Conditional("col_2", "=", 'val_2'),
             new Clause\Conditional("col_3", "=", 'val_2')
         )
     ));

Here's my code:
 $prizesStmt = $db->select(['id', 'value', 'text', 'isLosing', '_maxWinner', '_maxWinnerPerPeriod', '_maxWinnerPeriod', '_minDate', '_maxDate', 'totalWon'])
             ->from('game_prize_types')
             ->where(
                 new Grouping("AND",
                 [
                     new Grouping("OR",
                         new Conditional("totalWon", ">", "_maxWinner"),
                         new Conditional("_maxWinner", "IS", "NULL")
                     ),
                     new Grouping("OR",
                         new Conditional("_minDate", "<=", "NOW()"),
                         new Conditional("_minDate", "IS", "NULL")
                     ),
                     new Grouping("OR",
                         new Conditional("_maxDate", ">=", "NOW()"),
                         new Conditional("_maxDate", "IS", "NULL")
                     ),
                 ])
             );

But I have an error Uncaught PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '?) AND (_minDate <= ? OR _minDate IS ?) AND (_maxDate >= ? OR _maxDate IS ?)' at line 1.
Should I specify with a parameter that the value is a SQL function or a column name ?
Same for an update, I would like to increment column value but it doesn't work..
Thanks in advance,

I also have an error Fatal error: Uncaught PDOException: SQLSTATE[HY093]: Invalid parameter number
on this code:
$countStmt = $db->select(['count' => new Method('COUNT', 'id')])
                            ->from('game_prize_won')
                            ->where(new Conditional('creationDate', '>', date('c', strtotime('today midnight'))));

I also have an error Fatal error: Uncaught PDOException: SQLSTATE[HY093]: Invalid parameter number
on this code:
$countStmt = $db->select(['count' => new Method('COUNT', 'id')])
                            ->from('game_prize_won')
                            ->where(new Conditional('creationDate', '>', date('c', strtotime('today midnight'))));

Can you try with version 2.1 and let me know if you still have this problem.

Can you try with version 2.1 and let me know if you still have this problem.

U

Can you try with version 2.1 and let me know if you still have this problem.

Yep, still have both issues..

U

Can you try with version 2.1 and let me know if you still have this problem.

Yep, still have both issues..

So, any idea of the issue @kwhat ?

So, any idea of the issue @kwhat ?

Sorry, I've been out of town for a few days and things have been a bit busy at work.
There are a couple of problems with the first select statement.  The arguments for the Grouping do not require an array, the constructor should be veradic.  The Conditional statements for the data will need either Raw or Method to work correctly due to the statement being prepared.
    $db->select([
        'id',
        'value',
        'text',
        'isLosing',
        '_maxWinner',
        '_maxWinnerPerPeriod',
        '_maxWinnerPeriod',
        '_minDate',
        '_maxDate',
        'totalWon',
    ])
    ->from('game_prize_types')
    ->where(
        new Grouping(
            'AND',
            new Grouping(
                'OR',
                new Conditional('totalWon', '>', '_maxWinner'),
                new Conditional('_maxWinner', 'IS', 'NULL')
            ),
            new Grouping(
                'OR',
                new Conditional('_minDate', '<=', new Raw('NOW()')),
                new Conditional('_minDate', 'IS', 'NULL')
            ),
            new Grouping(
                'OR',
                new Conditional('_maxDate', '>=', new Method('NOW')),
                new Conditional('_maxDate', 'IS', 'NULL')
            )
        )
    )

The second is a little more subtle.  The issue is because you cannot prepare values for columns, so you need to use Raw instead of Method.  Method was really only conceived for calling stored procedures but will also work for functions called within conditionals.  I know, its a bit confusing and I am working on making it a bit more flexible with 3.x among other things.
$db->select(['count' => new Raw('COUNT(id)')])
        ->from('game_prize_won')
        ->where(new Conditional('creationDate', '>', date('c', strtotime('today midnight'))))

Sorry, I've been out of town for a few days and things have been a bit busy at work.
There are a couple of problems with the first select statement.  The arguments for the Grouping do not require an array, the constructor should be veradic.  The Conditional statements for the data will need either Raw or Method to work correctly due to the statement being prepared.
    $db->select([
        'id',
        'value',
        'text',
        'isLosing',
        '_maxWinner',
        '_maxWinnerPerPeriod',
        '_maxWinnerPeriod',
        '_minDate',
        '_maxDate',
        'totalWon',
    ])
    ->from('game_prize_types')
    ->where(
        new Grouping(
            'AND',
            new Grouping(
                'OR',
                new Conditional('totalWon', '>', '_maxWinner'),
                new Conditional('_maxWinner', 'IS', 'NULL')
            ),
            new Grouping(
                'OR',
                new Conditional('_minDate', '<=', new Raw('NOW()')),
                new Conditional('_minDate', 'IS', 'NULL')
            ),
            new Grouping(
                'OR',
                new Conditional('_maxDate', '>=', new Method('NOW')),
                new Conditional('_maxDate', 'IS', 'NULL')
            )
        )
    )

The second is a little more subtle.  The issue is because you cannot prepare values for columns, so you need to use Raw instead of Method.  Method was really only conceived for calling stored procedures but will also work for functions called within conditionals.  I know, its a bit confusing and I am working on making it a bit more flexible with 3.x among other things.
$db->select(['count' => new Raw('COUNT(id)')])
        ->from('game_prize_won')
        ->where(new Conditional('creationDate', '>', date('c', strtotime('today midnight'))))

No problem, thanks for answering !
It indeed works better thanks :)

No problem, thanks for answering !
It indeed works better thanks :)


pancake-frontend Failed to compile

when I start the pancake-frontend, and the path of this " ../../../deployments/31337" is right, the error info is as follows
Failed to compile.

./src/config/constants/contracts.ts
Module not found: You attempted to import ../../../deployments/31337/AnniversaryAchievement.json which falls outside of the project src/ directory. Relative imports outside of src/ are not supported.

when I start the pancake-frontend, and the path of this " ../../../deployments/31337" is right, the error info is as follows
Failed to compile.

./src/config/constants/contracts.ts
Module not found: You attempted to import ../../../deployments/31337/AnniversaryAchievement.json which falls outside of the project src/ directory. Relative imports outside of src/ are not supported.

Comment out the ModuleScopePlugin command in webpack.config.dev.
see 44114436
I've configure project, so you can re-download.


Change the id of the plugin in plugin.xml to appropriate namespace

Currently the id is still:
id="com.phonegap.plugins.PushPlugin"

Hey @eladmoshe thanks for the suggestion. Does the current id bother you in any particular way?

No, not really. Just seems more appropriate to me to set a unique name as it doesn't appear that the plugins will ever merge.

@EddyVerbruggen yes, because it incorrectly sets the dependency in your config and platform json files.

@EddyVerbruggen to be more clear and specific, if you install this plugin, then re-install your platform or your plugins (which happens often in cordova land), you will get the wrong plugin installed because of the ID conflict.


Disable useCacheForAllThreads for Ratis

Ratis recommend disabling org.apache.ratis.thirdparty.io.netty.allocator.useCacheForAllThreads to reduce unnecessary GC pressure. This has shown to reduce up to 10% memory overhead in some performance tests.

@LuQQiu PTAL.

alluxio-bot, merge this please.

alluxio-bot, cherry-pick this to enterprise-2.4 please.

alluxio-bot, cherry-pick this to branch-2.4 please.


Update Zelda AARemoval packs for 1.8, add WWHD ReducedBloom pack updated for 1.8

@getdls you might want to restore the following lines to the WW shader:
R2f.xyzw = (texture(textureUnitPS0, R0f.xy).xyzw);
passPixelColor0 = R2f.xyzw;

@SwooshyCueb I reverted that change. What does it change anyways? Just curious. 5e634df

https://github.com/slashiee/cemu_graphic_packs/commit/62100f8bdd17b1b83b4ffa0a295ea39aabb47cc6 adds foliage and horizon to prev commit.


help with using custom middleware + default stack to set cookies

Was exploring the middleware docs to see if I could use it to set a cookie for all requests but was running into some issues when adding a --stack.
What I have working was this:
// lws.config.js
module.exports = {

  directory: 'dist',

  spa: 'index.html',

  stack: [
    'body-parser',
    'request-monitor',
    'log',
    'cors',
    'json',
    'rewrite',
    'blacklist',
    'conditional-get',
    'mime',
    'compress',
    'mock-response',
    'spa',
    'static',
    'index'
  ],

  compress: true,

  rewrite: [{
    from: '/api/*',
    to: 'http://www.domain.com/api/$1'
  }]

};

Running it as
$ ./node_modules/.bin/ws

And everything is good ✅
When I try to add a simple middleware
// middleware.js
module.exports = MiddlewareBase => class Example extends MiddlewareBase {

  middleware (options) {
    return (ctx, next) => {
      ctx.cookies.set('MY_KEY', 'MY_VALUE');
    };
  }

};

$ ./node_modules/.bin/ws --stack middleware.js

All I get is a white page that says Not Found 🚫

If I follow the example from the docs, I can confirm that I see Hello on the page.
module.exports = MiddlewareBase => class Example extends MiddlewareBase {
  middleware (options) {
    return (ctx, next) => {
      ctx.response.body = 'Hello'
    }
  }
}

It does appear that I can see my middleware in the output from ws when using Chrome in Incognito mode to load the site
ctx { method: 'GET',
  url: '/favicon.ico',
  header:
   { host: 'localhost:4445',
     connection: 'keep-alive',
     'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36',
     accept: 'image/webp,image/apng,image/*,*/*;q=0.8',
     referer: 'http://localhost:4445/',
     'accept-encoding': 'gzip, deflate, br',
     'accept-language': 'en-US,en;q=0.9,es;q=0.8,it;q=0.7',
     cookie: 'MY_KEY=MY_VALUE' } }

Thanks for any help you may be able to lend!  Let me know if you need anymore info

Hi, this stack specifies that your middleware only is loaded (and nothing else):
$ ./node_modules/.bin/ws --stack middleware.js

Is that what you intended? Don't you at least need static file hosting downstream of your custom middleware? E.g.
$ ./node_modules/.bin/ws --stack middleware.js lws-static

Run this command to see the middleware options built into ws, you can include any of these in your stack to create a custom server:
$ ws middleware-list
[ 'lws-basic-auth',
  'lws-body-parser',
  'lws-request-monitor',
  'lws-log',
  'lws-cors',
  'lws-json',
  'lws-compress',
  'lws-rewrite',
  'lws-blacklist',
  'lws-conditional-get',
  'lws-mime',
  'lws-range',
  'lws-mock-response',
  'lws-spa',
  'lws-static',
  'lws-index' ]

Ah, I see.
So are you saying the lws.config.js file not be respected in this case?  Or do i need to "chain" stacks via the CLI instead?

lws.config.js options are respected unless overridden on the command line - CLI args take precedence..

Ah, ok I think I see what you mean now.
Is there a way to load a middleware via the stack option in lws.config.js?  e.g.
module.exports = {
  ...
  stack: [
    'body-parser',
    'request-monitor',
    'log',
    'cors',
    'json',
    'rewrite',
    'blacklist',
    'conditional-get',
    'mime',
    'compress',
    'mock-response',
    'spa',
    'static',
    'index',
    'my-middleware'  // my-middleware.js
  ],

  ...
}

Thanks, so this gets the local web server running correctly now with my app and with my middleware loading (i know I can probably prune extra stacks I don't actually need)
./node_modules/.bin/ws --stack body-parser request-monitor log cors json rewrite blacklist conditional-get mime compress mock-response spa static index ./middleware.js

However, the return function never executes?
module.exports = MiddlewareBase => class Example extends MiddlewareBase {

  middleware (options) {
    console.log('options', options);  // this executes

    return (ctx, next) => {
      console.log('ctx', ctx); // this doesn't log???
    };
  }

};

This may be more in the realm of Koa though but any thought would be much appreciated!

Thanks for your help, changing the ordering of the middleware has it running now.  Still getting Not Found but I think I can take it from there.
Thanks for all your help!


Only look at relevant log files for backup size at initialization time.

This patch can be merged into master. It lacks new test cases and therefore we should do so iff it is a stable fix and does not break existing tests.


RTSP disconnect detection

Summary of issue
Hi there,
I have connected a camera with RTSP protocol. I can open RTSP stream and detect when camera is ready but there is a problem when camera is disconnected. Instead of returning false, in case of losing connection, VideoCapture.Read function always returns true. The issue is not in the OpenCV itself because the same issue is not present when using python wrapper around opencv
Environment
Windows 10 64bit
Example code:
VideoCapture capture = new VideoCapture(0);

while (true)
{
    var frame = new Mat();
    bool hasFrame = capture.Read(frame);

    if (!hasFrame)
    {
        break;
    }

    Cv2.ImShow("Frame", frame);
    Cv2.WaitKey(5);
}

The same thing happens when VideoCapture comes to the end of a video. Read() is still returning true, while saving an empty Mat.


CIF: Contact index is not always being assigned

Describe the Bug:
Some users are having issues with adding contacts to project revisions (including new projects). Then end result of whatever is going on is that the form data does not get a contactIndex assigned, which seems to prevent them from being able to commit the revision.
One description of behaviour that resulted in this bug:
"When entering primary and secondary contacts they will flip on each other (making secondary the primary and the primary the secondary) This can righted by going back in to the drop downs and reselecting the contacts but thought I would mention it since we've had issues within this tab recently. " -LP
And another:
"when you select "Add a Secondary Contact" the fields appear and then quickly disappear...prompting you to select the secondary contact option again and when you do, two sets of secondary contact fields show up, leaving you to remove one and then you can proceed to populate them - but not always able to apply to revision." -LP
Probability (how likely the bug is to happen, scored from 1-5): 2 although it is in fact happening
(For example, probability of 5 is something like "it happens to all users every time they log in."
Probability of 1 "only happens to certain users when a really specific and unlikely path is followed.")
Effect (how bad the bug is when it does happen, scored from 1-5): 5 users cannot commit project revisions
(For example, effect of 5 is "the entire app crashes and makes it unusable for all users" or "the bug causes the wrong data to be saved, with critical information (e.g. payment) being affected."
Effect of 1 is "It makes some styling look a little bit weird.")
Steps to reproduce the behaviour:
Screenshots:
Additional information:
We've been unable to reproduce any of the behaviour locally or in dev so far. The evidence of it happening is there in prod though.

OS: [e.g. iOS]
Browser: [e.g. chrome, safari]
Version: [e.g. 22]
Additional context

Mike and Dylan were unable to recreate this issue. Seems to be specific to Lindsay (CIF team)


Move Test to [extras]

Hi, I noticed Test is currently included in the deps block of Project.toml. This requires loading Test in order to use the package, which seems like unnecessary overhead. This little PR adds an extras section and moves Test there.
I also noticed cardinality is exported but undefined, so the PR removes this.

I think instead of removing cardinality it might be better to move the code that implements it here? I believe it’s in ContinuumArrays. We may have to add Infinities.jl as a dependency but that’s a lightweight package

I think instead of removing cardinality it might be better to move the code that implements it here? I believe it’s in ContinuumArrays. We may have to add Infinities.jl as a dependency but that’s a lightweight package

Fair enough. This was an add-on anyway, so for now I've reverted that commit. So this PR now only updates Project.toml.

Thanks @cscherrer, looks good


Invalid state_class for date and status sensors

System Health details
System Information

version
core-2024.10.0

installation_type
Home Assistant OS

dev
false

hassio
true

docker
true

user
root

virtualenv
false

python_version
3.12.4

os_name
Linux

os_version
6.6.31-haos-raspi

arch
aarch64

timezone
Europe/Amsterdam

config_dir
/config

Home Assistant Community Store

GitHub API
ok

GitHub Content
ok

GitHub Web
ok

HACS Data
ok

GitHub API Calls Remaining
4996

Installed Version
2.0.1

Stage
running

Available Repositories
1431

Downloaded Repositories
20

Home Assistant Cloud

logged_in
false

can_reach_cert_server
ok

can_reach_cloud_auth
ok

can_reach_cloud
ok

Home Assistant Supervisor

host_os
Home Assistant OS 13.1

update_channel
stable

supervisor_version
supervisor-2024.09.1

agent_version
1.6.0

docker_version
26.1.4

disk_total
219.4 GB

disk_used
37.8 GB

healthy
true

supported
true

host_connectivity
true

supervisor_connectivity
true

ntp_synchronized
true

virtualization

board
rpi4-64

supervisor_api
ok

version_api
ok

installed_addons
deCONZ (7.0.0), Studio Code Server (5.16.3), RPC Shutdown (2.5), Samba share (12.3.2), MariaDB (2.7.1), phpMyAdmin (0.10.0), Z-Wave JS (0.7.2), ESPHome (2024.9.2), AdGuard Home (5.1.4), Advanced SSH & Web Terminal (19.0.0), CUPS (1.0), chrony (4.0.1), Mosquitto broker (6.4.1), Frigate (0.14.1)

Dashboards

dashboards
6

resources
11

views
25

mode
storage

Recorder

oldest_recorder_run
September 24, 2024 at 11:13 AM

current_recorder_run
October 3, 2024 at 9:59 AM

estimated_db_size
1391.11 MiB

database_engine
mysql

database_version
10.11.6

Checklist

[ ] I have enabled debug logging for my installation.
[X] I have filled out the issue template to the best of my ability.
[X] This issue only contains 1 issue (if you have multiple issues, open one issue for each issue).
[X] This issue is not a duplicate issue of any previous issues..

Describe the issue
Found in the logs after upgrading to Home Assistant Core 2024.10.0

Entity sensor.programming_backup_status (<class 'custom_components.duplicati.sensor.DuplicatiSensor'>) is using state class 'measurement' which is impossible considering device class ('enum') it is using; expected None; Please update your configuration if your entity is manually configured, otherwise create a bug report at https://github.com/txxa/hass-duplicati/issues
Entity sensor.programming_backup_date (<class 'custom_components.duplicati.sensor.DuplicatiSensor'>) is using state class 'measurement' which is impossible considering device class ('timestamp') it is using; expected None; Please update your configuration if your entity is manually configured, otherwise create a bug report at https://github.com/txxa/hass-duplicati/issues

Reproduction steps

Upgrade to Home Assistant Core 2024.10.0
Find warnings in the logs.

Debug logs
No response
Diagnostics dump
No response

Hi @ErikvO
Thanks for the bringing this up.
It will be fixed with the next release.


Distorted Webview

Issue Type: Bug
I filed the issue report here https://github.com/microsoft/vscode-extension-samples/issues/547 . But the answer was to report it to VS Code therefore I'am reporting it here.
VS Code version: Code 1.63.2 (899d46d82c4c95423fb7e10e68eba52050e30ba3, 2021-12-15T09:39:46.686Z)
OS version: Linux x64 5.11.0-43-generic
Restricted Mode: No

Duplicate of #110450


Make test hangs on location handler

Was hoping make test would give me confidence in changes to fix #111, but HEAD hangs in the same place as my branch on location handler:
mat@devbox:~/dev/node-osmium$ node --version
v10.22.0
mat@devbox:~/dev/node-osmium$ make test

  apply
    ✓ should be able to call apply with a node Buffer and a handler
(node:37860) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

  reader
    ✓ should throw when BasicReader called as function
    ✓ should be able to create an osmium.BasicReader and access header
    ✓ should be able to create osmium.File with node.Buffer and read from it (44ms)
    ✓ should read a whole file with BasicReader.read_all()

  buffer
    ✓ should allow reading into buffer
    ✓ should allow reading into buffer in a loop
    ✓ should allow iterating over buffer
    ✓ should be able to stream buffer created from a file
    ✓ should complain when calling Buffer methods on something else

  changesets
    ✓ should be able to access basic attributes from closed changeset
    ✓ should be able to access basic attributes from open changeset
    ✓ should be able to access tags from changeset
    ✓ should not be able to create an osmium.Changeset from Javascript

  coordinates
    ✓ should be able to instantiate coordinates
    ✓ should use undefined defaults
    ✓ should be invalid for out of bounds
    ✓ box can be default instantiated
    ✓ box can be instantiated with coordinates

  file
    ✓ should throw when File called as function
    ✓ should create File object without parameters
    ✓ should create File object with one parameters
    ✓ should create File object with two parameters
    ✓ should create File object for stdin/stdout
    ✓ should not create File object with three parameters

  stream filters
    ✓ should work without a filter (231ms)
    ✓ should filter everything if empty
    ✓ should allow everything with a filter that allows everything (119ms)
    ✓ should allow relations with a filter that allows relations
    ✓ should work with keys
    ✓ should work with key-value combinations
    ✓ should work with anything tagged

  flex_reader
    ✓ should be able to access basic attributes from node
    ✓ should be able to access basic attributes from way
    ✓ should be able to access basic attributes from relation
    ✓ should be able to handle object without tags
    ✓ should be able access tags on object
    ✓ should be able access nodes on ways
    ✓ should be able access members on relations
    ✓ should be able to handle missing and invalid coordinates

  geojson
    ✓ should be able to create geojson from a node
    ✓ should be able to create geojson from a way

  handler
    ✓ should throw when Handler called as function
    ✓ should be able to initialize handler
    ✓ should throw when handler initializion is wrong
    ✓ should call all object callbacks of handler
    ✓ should call all before and after callbacks of handler
    ✓ should call before_changesets and after_changesets callbacks of handler
    ✓ should call node callback only for tagged nodes if tagged_nodes_only is set
    ✓ should if options() is called with wrong arguments
    ✓ should allow a callback to be redefined
    ✓ should be able to get node data from handler parameter
    ✓ should be able to call two handlers one after the other
    ✓ should catch errors in handler callbacks and rethrow from apply function

  location handler
^CTerminated
make: *** [Makefile:58: test] Interrupt

Commenting out location_handler.test.js#L20-L24 seems to fix this:
    /*it('should be able to use the sparse_mem_table location handler', function() {
        var reader = new osmium.BasicReader(__dirname + "/data/winthrop.osm", { 'node': true, 'way': true });
        osmium.apply(reader, new osmium.LocationHandler("sparse_mem_table"), get_handler());
    });*/

Maybe my VM's just damn slow?

Okay, so it turns out it's timing out and does eventually work.
Makefile#L57-L58:
test:
	@PATH="./node_modules/mocha/bin:${PATH}" && NODE_PATH="./lib:$(NODE_PATH)" mocha -R spec --timeout 10s

Removing the timeout wasn't enough - it defaulted to 20s and failed there. Increasing to 60s was enough. Reducing to 30s was still enough. Reducing further still, 20s, then 10s and again it worked! Does Mocha store state anywhere? make rebuild && make test now runs no problem, no hanging.
I'm putting this down to some odd configuration on my machine; but please it means #112 now passes all tests.


BCP 14 boilerplate detection

 7  Error
 └- Code - MISSING_REQLEVEL_REF
 └- Desc - An RFC2119 boilerplate is present but no reference to the RFC2119 was found.
 └- Ref  - https://www.rfc-editor.org/rfc/rfc7322.html#section-4.8.2

That's a an understandable error, but one that could be fixed.
I'm using kramdown-rfc's {::boilerplate bcp14-tagged-bcp}.

Hi Martin - please clarify what change you're looking for?

Sure, I was a bit terse...
The boilerplate in question looks like this:
      <t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
described in BCP¤14 <xref target="BCP14"/> when, and only when, they
appear in all capitals, as shown here.</t>

Presumably, this should be detected as acceptable.
There are a few interesting quirks to this:

The string "BCP 14" uses a non-breaking space.  (The topic of a <nobr> element is ongoing, so I anticipate this sticking around for a while to avoid a very awkward wrap in the text output.)

This uses a reference to BCP 14 rather than RFCs 2119 and 8174.

This uses <bcp14> elements.  Some documents will not.

These are all variations that should be tolerated.


Please provide a manpage for spyder

Hello the current Debian package contain a manpage for spyder, whcih was added.
It would be great if you could provide an official manpage for spyder and spyder3.
thanks for considering
new file   doc/manpage.rst
@@ -0,0 +1,64 @@
+:orphan:
+
+spyder manual
+=============
+
+
+Synopsis
+--------
+
+**spyder** [*options*] [*filenames*]
+
+
+Description
+-----------
+
+Spyder provides:
+
+* a powerful interactive development environment for the Python language with
+  advanced editing, interactive testing, debugging and introspection features,
+
+* and a numerical computing environment thanks to the support of `IPython`
+  (enhanced interactive Python interpreter) and popular Python libraries such
+  as `NumPy` (linear algebra), `SciPy` (signal and image processing) or
+  `matplotlib` (interactive 2D/3D plotting).
+
+
+Options
+-------
+
+-h, --help              show this help message and exit
+
+--new-instance          run a new instance of Spyder, even if the single
+                        instance mode has been turned on (default)
+
+--defaults              reset configuration settings to defaults
+
+--reset                 remove all configuration files
+
+--optimize              optimize the Spyder bytecode (may require
+                        administrative privileges)
+
+-w WORKING_DIRECTORY, --workdir=WORKING_DIRECTORY
+                        set the default working directory
+
+--show-console          do not hide parent console window (Windows)
+
+--multithread           execute the internal console in a separate thread
+                        (from the main application thread)
+
+--profile               run spyder in profile mode (for internal testing, not
+                        related with Python profiling)
+
+--window-title=WINDOW_TITLE
+                        show this string in the main window title
+
+-p OPEN_PROJECT, --project=OPEN_PROJECT
+                        open a Spyder project (directory with a .spyproject
+                        folder)
+
+Bugs
+----
+
+If you find a bug, please consider reporting it to the Spyder issue tracker at
+<https://github.com/spyder-ide/spyder/issues>.

Hey @picca, long time no see! Thanks for this!
We'll add it in our next release.

Thanks a lot,In fact ghislain was doing the job, I just step in , but we have a problem with pylint3 and the python3.7 transition...
so for now I can not compile spyder due to the python-astroid package...

@ccordoba12 In case you don't recall, we had one (only in master for some reason), but it was removed along with the rest of the docs. We could just pull that as a source and use Sphinx to build it; there might have been code in master's setup,py to do that (if so, you could check your doc remove PR which should include it).

Yes, we have to include it differently this time.

Hello the current Debian package contain a manpage for spyder

Since you're the only project requiring it, I think it's fine that you provide a manpage instead of us. So, sorry but after a second thought, I don't think we're going to solve this issue. It's just more work for us for no gain at all.


[turbopack] The socket.io not working with turbo + next@latest

What version of Next.js are you using Turbopack in?
canary
What package manager are you using / does the bug impact?
npm
What operating system are you using?
Windows
Describe the Bug

Created the nextjs project with npx create-next-app@latest app_name
Added socket.io & socket.io-client package and wrote socket code in server and client.
Changed the package.json to use ---turbo command
"dev": "next dev --turbo"
Now, if run the app with "npm run dev", socket is not working throwing 404 polling error in chrome console and network tab.
If i remove "--turbo", from dev script, everthing works fine.

GitHub repo - https://github.com/avinashcodelabs/nextjs-turbo-socketio-reproduce-issue.git
Codesanbox link - https://codesandbox.io/p/github/avinashcodelabs/nextjs-turbo-socketio-reproduce-issue/main?workspaceId=f5e62c11-e518-4676-ae49-f9fdcb9090e2
Terminal output:
ready - started server on [::]:3000, url: http://localhost:3000
[404] /api/socket_io (3189ms)
[404] /api/socket_io (3765ms)
[404] /api/socket_io (3905ms)
error - [resolve] ... [1 paths] are hidden, run with --show-all to show them
warning -
[parse]
... [2 paths] are hidden, run with --show-all to show them
[resolve]
... [3 paths] are hidden, run with --show-all to show them
event - 13 requests (GET /, ...), and side effects of 7 requests (GET /, ...) 9559ms
event - 10 requests (GET /_next/static/chunks/_env_b53fce.js.map, ...), and side effects of 9 requests (GET /_next/static/chunks/_env_b53fce.js.map, ...) 325ms
event - side effects of 4 requests (GET<EMAIL_ADDRESS>...), and 7 requests (GET /next/static/chunks/node_modules_next_2d9381..js.map, ...) 132ms
event - side effects of 26 requests (GET /_next/static/chunks/[next]dev_2185c6..js, ...), and 25 requests (GET /turbopack-hmr, ...) 1537ms
[404] /api/socket_io (53ms)
[404] /api/socket_io (49ms)
event - side effects of 15 requests (GET /_next/static/chunks/app_page_b53fce.js, ...), and 17 requests (GET /api/socket_io, ...) 722ms
event - 13 requests (GET /api/socket, ...), and side effects of 13 requests (GET /_next/static/chunks/app_page_5771e1.js, ...) 380ms
Socket is initializing
warning - [parse] ... [1 paths] are hidden, run with --show-all to show them
[404] /api/socket_io (54ms)
[404] /api/socket_io (60ms)
event - 4 requests (GET /api/socket_io, ...) 1365ms
[404] /api/socket_io (21ms)
[404] /api/socket_io (23ms)
event - 4 requests (GET /api/socket_io, ...) 34ms
[404] /api/socket_io (23ms)
event - 2 requests (GET /api/socket_io, ...) 32ms
[404] /api/socket_io (22ms)
[404] /api/socket_io (27ms)
[404] /api/socket_io (44ms)
event - 6 requests (GET /api/socket_io, ...) 65ms
Expected Behavior
Socket connection should work with in latest Next.js app with "dev": "next dev --turbo" script in package.json
To Reproduce
git clone https://github.com/avinashcodelabs/nextjs-turbo-socketio-reproduce-issue.git
cd nextjs-turbo-socketio-reproduce-issue
npm i
npm run dev

Note: I have  "dev": "next dev --turbo" in package.json file
Now, go to http://localhost:3000/ and open chrome's Console or Network tab. here we will see the socket connections are failing.
Screenshot attched.

Reproduction Repo
https://github.com/avinashcodelabs/nextjs-turbo-socketio-reproduce-issue

Somehow socket.io-client version 3.1.2 works and every other version gives this error.

Verified this has been fixed 💯
Here's the sandbox with the latest canary: https://codesandbox.io/p/github/avinashcodelabs/nextjs-turbo-socketio-reproduce-issue/csb-dy6z6n/draft/silly-volhard?file=%2Fapp%2Fpage.tsx%3A16%2C8
Network tab:


Update ModelAnimationCollection

For #3177
Updated ModelAnimationCollection from 3d-tiles and added a simple test for coverage.

Looks good.


Github CI test pipeline sporadically fails for macos and python 3.11

Error:
run_tests.sh: line 8:  1871 Illegal instruction: 4  python -m unittest discover -v -p "test_*.py" Error: Process completed with exit code 132.
However, rerunning the pipeline resolves the problem.

If the workflow is adjusted to use run_tests_osx.sh, the same problem occurs with python 3.11
run_tests_osx.sh: line 8:  1959 Illegal instruction: 4  python3 -m unittest discover -v -p "test_*.py"

After some logging with the existing test pipeline and different Mac OS versions, the problem seems to be the CPU's FMA feature's availability.
If we compare the two workflow runs for the same macOS image and Python version (3.10):
ProductVersion:	12.7.4
BuildVersion:	21H1123
i386

Run1 (failed)

FMA not available (CPU: Intel(R) Xeon(R) CPU E5-1650 v2 @ 3.50GHz)

Run 2 (succeeded)

FMA available (CPU: Intel(R) Core(TM) i7-8700B CPU @ 3.20GHz)

As we use SIMD instructions via Numba, this presumably causes the problem.

Numba does autodetect (?) the CPU features, see here, so I have some doubts that it is to blame

The choice of hardware for macos-latest is nondeterministic (see here ) and the problem may go away eventually, when macos-latetest refers not to macos-12, but macos-14 .  In the meantime, it says here that pytables may the problem. However, the workaround seems to be a bit too expensive for us.
How about explicitly requesting macos-13 or macos-14 instead of macos -latest which gives us 12.7 ?

I already had the same idea. I tested different Mac OS versions, and Mac OS-13 seems to be stable in terms of hardware (see https://github.com/adku1173/acoular/actions/runs/8736200670). Requesting only macos-13 could be a good temporary option. I will prepare a PR for that.


intellisense does not work in the new update

Type: Bug

Behaviour
Expected vs. Actual
Steps to reproduce:
After the new update, intellisense does not work for any python environment.
I have tried enabling linting, tried a few different linters as well. Nothing seems to work.
I have also made sure, I am in the correct venv, even that does not help.

Am I missing something over here?

Diagnostic data

Python version (& distribution if applicable, e.g. Anaconda): 3.8.10
Type of virtual environment used (e.g. conda, venv, virtualenv, etc.): Venv
Value of the python.languageServer setting: None

Output for Python in the Output panel (View→Output, change the drop-down the upper-right of the Output panel to Python)

XXX

User Settings

languageServer: "None"

linting
• enabled: false
• flake8Args: "<placeholder>"
• flake8Enabled: true

formatting
• provider: "yapf"
• yapfArgs: "<placeholder>"

Extension version: 2022.16.1
VS Code version: Code 1.72.2 (d045a5eda657f4d7b676dedbfa7aab8207f8a075, 2022-10-12T22:15:18.074Z)
OS version: Windows_NT x64 10.0.22621
Modes:
Sandboxed: No

System Info

Item
Value

CPUs
11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz (8 x 2803)

GPU Status
2d_canvas: enabledcanvas_oop_rasterization: disabled_offdirect_rendering_display_compositor: disabled_off_okgpu_compositing: enabledmultiple_raster_threads: enabled_onopengl: enabled_onrasterization: enabledraw_draw: disabled_off_okskia_renderer: enabled_onvideo_decode: enabledvideo_encode: enabledvulkan: disabled_offwebgl: enabledwebgl2: enabledwebgpu: disabled_off

Load (avg)
undefined

Memory (System)
15.68GB (6.32GB free)

Process Argv
C:\git\gqc\ai\dnv_streamlit --crash-reporter-id 0b9e5ec3-1789-4db5-89d7-22f18ba2c021

Screen Reader
no

VM
0%

A/B Experiments
vsliv368:30146709
vsreu685:30147344
python383cf:30185419
vspor879:30202332
vspor708:30202333
vspor363:30204092
vstes627cf:30244335
vslsvsres303:30308271
pythonvspyl392:30443607
vserr242cf:30382550
pythontb:30283811
vsjup518:30340749
pythonptprofiler:30281270
vshan820:30294714
vstes263:30335439
pythondataviewer:30285071
vscod805cf:30301675
binariesv615:30325510
bridge0708:30335490
bridge0723:30353136
cmake_vspar411:30581797
vsaa593:30376534
pythonvs932:30410667
cppdebug:30492333
vsclangdf:30486550
c4g48928:30535728
dsvsc012:30540252
azure-dev_surveyone:30548225
pyindex848cf:30577861
nodejswelcome1:30587005
fc301958:30595537
2e4cg342:30596373

@deven-gqc, I see something similar. Intellisense works for a bit, then after some editing/time it stops working and my CPUs start churning as the CPU fan turns on.
Extension Version: v2022.16.1
OS Version: Mac OS X 13.0 (though I saw the same behavior a few days ago on 12.x)
VS Code Version: Version: 1.72.2 (d045a5eda657f4d7b676dedbfa7aab8207f8a075)

@deven-gqc From the settings for python.languageServer it looks like you have set it to None. Setting it to None turns off intellisense. Set it to Default.

That fixed the issue. Thanks a lot @karthiknadig!


Vickers QF Gun does not appear

Ordinance has been removed, so it does not appear.

Fixed with Update 9.1.1 for Destructive Devices


Feature request to enable deletion of Blobchangefeed.

Deleting blob change feed logs and the container $blobchangefeed results in the below. Enabling that would be of big help.

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-change-feed?tabs=azure-portal

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 98acfeaa-38a5-dbb6-c717-4fcefe854ffb
Version Independent ID: 3efdd861-cb2a-3733-35df-65e0473dcde4
Content: Change feed in Azure Blob Storage
Content Source: articles/storage/blobs/storage-blob-change-feed.md
Service: storage
Sub-service: blobs
GitHub Login: @normesta
Microsoft Alias: normesta

@vick-git Thank you for your feedback . We will investigate and update the thread.

@vick-git Thank you for your feedback . We will investigate and update the thread.

@vick-git I'd recommend posting your question in https://azure.microsoft.com/en-us/support/community/ since it's not directly related to the documentation. We'll follow up there. We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

@vick-git I'd recommend posting your question in https://azure.microsoft.com/en-us/support/community/ since it's not directly related to the documentation. We'll follow up there. We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

Hi @SumanthMarigowda-MSFT , thank you. I thought git would be the best for feature request.
Which one would be better among these 4 for feature requests?

Hi @SumanthMarigowda-MSFT , thank you. I thought git would be the best for feature request.
Which one would be better among these 4 for feature requests?


⚠ Turnos 24x7 has degraded performance

In 0dc2b64, Turnos 24x7 (https://reservas-dev.alternativasinteligentes.com/) experienced degraded performance:

HTTP code: 200
Response time: 2978 ms

Resolved: Turnos 24x7 performance has improved in 0d18562.


REI Compat update + Recipe Fix

● Reworked Black Cod recipe to accept Cooked Rice instead of Raw Rice
● Added hover tooltips to the Brewing's REI GUI water indicator

It uses the language file in favor of translators
● Updated language file

Ported https://github.com/Chefs-Delight/Farmersrespite-Fabric/pull/4/commits/ecbe3fd8cabbaf2d37c26082d4304b7e6aaa6c56 to 1.19
Added entries for REI Compat stuffs

Thank you for all your help!


Configurable networkmanager

Fixes https://github.com/OpenConext/Stepup-Deploy/issues/63

Hi dnmvisser,
Thanks for your contribution!
First a remark over form: could you please only add the commit(s) that contributes to the feature (i.e. https://github.com/OpenConext/Stepup-Deploy/pull/64/commits/09fc9a3678722c9feababfaa9042cd93235e7d01) to this PR, and not include the other, unrelated, commits? This way it is unclear what will be merged. You could remake your PR and force push the new one (unlike what https://help.github.com/articles/about-pull-requests/ says, doing a force push will work fine in my experience). You could also start a new PR, and close this one.
Regarding the implementation:

Adding the option to NOT disable the NetworkManager is fine. I think disable_networkmanager would better describe what it does.
You specify the variable as a boolean, which makes sense IMO. In that case the default() filter is a better fit (i.e. when: disable_networkmanager | default(true)) because then defining the variable with either true or false works as expected.


Authentication: Create Account-UI

Develop the create account UI appropriately
Ensure they are responsive and follow the responsive design on the figma
Implement images properly
Follow the color guide and the appropriate colors

Hello, I would like to also work on the Create Account UI, can you please assign me?

@Mudi-Igbinoba are you working on this?

@Mudi-Igbinoba are you working on this?

Yes @dprincecoder I'll make my pull request before the end of today


Auto-generated. Updating Vectara public protos. (9b6e311afa1adf5d9f9e…

…50144e2b3ab71ec186a2).
Heads up!
These protobufs in this repository are automatically generated from Vectara and
the repository is read-only for the general public.  As a result, we do not
accept pull requests to this GitHub repository.
If you have feedback on Vectara or its APIs, please let us know in our
forums: https://discuss.vectara.com/

@pwoznic can you review from a verbiage perspective?


adding albuquerque neighborhoods

Greetings from Sandy F. & Elaine T. who worked on this project together at the National Day of Civic Hacking - Code for America held at Fat Pipe ABQ in Albuquerque, NM, USA.

Greetings from Sandy F. & Elaine T. who worked on this project together at the National Day of Civic Hacking - Code for America held at Fat Pipe ABQ in Albuquerque, NM, USA.

Greetings from Sandy F. & Elaine T. who worked on this project together at the National Day of Civic Hacking - Code for America held at Fat Pipe ABQ in Albuquerque, NM, USA.

@mwichary, could you please review this?

@ethomas12, thank you so much for your contribution to this project. I looked over your work and I cherry picked just the data for Albuqueue for inclusion.
The project is alive again, so please don't hesitate to contribute.
Merged commit: 7a2c358424ce7fdaf22ff4862c6fab492c4a07b8


Changed outdated link with current link.

Changed the former python-social-auth link to the latest one.

Thans