Azure Batch fails to pull newer Docker images

Problem Description
Hello. I'm running Docker images from ACR in Batch. The auth routine is done by managed identity. Pool is set up with user-assigned managed identity and has ACR attached.
Everything works fine for some time. But in a few hours/days tasks cannot pull newer Docker images from ACR due to unauthorized error. The way to fix it right now is to reboot the node - after node reboot, tasks can again pull images for few hours. But after some time the problem occurs again.
Steps to Reproduce

Create a pool with the following settings:

Publisher: microsoft-azure-batch
Offer: ubuntu-server-container
SKU: 20-04-lts
Version: latest
User-assigned identities: add new
Container type: dockerCompatible
Container registries:
** Server: xxxx.azurecr.io
** Identity reference: add pool identity here

Create a task which will use any container from the ACR referenced in pool.
Ensure everything works.
Wait few hours (more then 3)/day, and create a task again but with different image\tag

Obviously, user-assigned managed identity for pool needs to have AcrPull role in ACR.
Expected Results
Task works.
Actual Results
Category: UserError
Code: ContainerInvalidImage
Message: One or more container images specified are invalid
Name: ContainerImage
Value:
Get https://xxxxx.azurecr.io/v2/yyyy: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information.
Additonal Comments
I also tried to add container registry spec into task spec though it's not required per portal information. That didn't help.
Node size: standard_d4_v3
Node agent version: 1.9.22
Another thing I tried to troubleshoot is to manually install az cli and try to pull image manually from the node via
sudo az login --identity
sudo az acr login -n yyyy
docker pull ...

And that worked. But tasks cannot pull image anyway till node is rebooted.

I was able to find only one log in agent-debug.log for login into docker registry on node start.
■■20220202T110002.693Z■00000000-0000-0000-0000-000000000000■DEBUG■agent.user■user.py■_add_user_posix_async■1902■5169■MainThread■140515222252416■setting login disabled password as password not specified for user _azbatch
■■20220202T110007.557Z■ed4007be-8416-11ec-b852-000d3a47328b■INFO■agent.user■user.py■apply_pool_user_configuration_async■661■5169■MainThread■140515222252416■apply pool user configuration for username=_azbatch admin=False ssh_cidr_pattern=None uid=None gid=None windows_user_login_mode=None
■■20220202T110008.347Z■00000000-0000-0000-0000-000000000000■DEBUG■agent.container.containerutil■containerutil.py■login_container_registries_async■93■5169■MainThread■140515222252416■login registries status: Status.Ok

I don't see this log anymore. So my guess is that ACR authentication is expiring and thus tasks cannot pull images after some time.

After further investigation, I found, that according to the log auth works when registry setting is specified for the task.
■■20220202T124251.879Z■00000000-0000-0000-0000-000000000000■INFO■agent.container.container_client.docker■docker.py■_set_user_internal■1138■1076■ThreadPoolExecutor-4_0■139634512455424■Auth user 00000000-0000-0000-0000-000000000000 for registry XXXX.azurecr.io succeeded

But still, images cannot be pulled due to unauthorized error
■■20220202T125331.600Z■00000000-0000-0000-0000-000000000000■ERROR■agent.container.containermanager■containermanager.py■_process_add_image_name_request_async■154■1076■MainThread■139634623130624■pull image XXX.azurecr.io/YYY:0.1.0-5 failed.□
Traceback (most recent call last):□  File "docker/api/client.py", line 259, in _raise_for_status□  File "requests/models.py", line 943, in raise_for_status□requests.exceptions.HTTPError: 500 Server Error: Internal Server Error for url: http+docker://localhost/v1.40/images/create?tag=0.1.0-5&fromImage=XXX.azurecr.io%2FYYY□□During handling of the above exception, another exception occurred:□□
Traceback (most recent call last):□  File "agent/container/container_client/docker.py", line 1561, in prepare_image_async□  File "common/util/retry.py", line 195, in retry_helper_async□  File "common/util/retry.py", line 184, in retry_helper_async□  File "agent/container/container_client/docker.py", line 1472, in async_method□  File "concurrent/futures/thread.py", line 57, in run□  File "docker/api/image.py", line 415, in pull□  File "docker/api/client.py", line 261, in _raise_for_status□  File "docker/errors.py", line 31, in create_api_error_from_http_exception□docker.errors.APIError: 500 Server Error: Internal Server Error ("Get https://XXX.azurecr.io/v2/YYY/manifests/0.1.0-5: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information.")□□The above exception was the direct cause of the following exception:□□Traceback (most recent call last):□  File "agent/container/containermanager.py", line 144, in _process_add_image_name_request_async□  File "agent/container/container_client/docker.py", line 1574, in prepare_image_async□agent.container.container_client.errors.ContainerException: Get https://XXX.azurecr.io/v2/YYY/manifests/0.1.0-5: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information.

Thanks for the report, I will look into this. It sounds like it could be a caching issue on the identity token

@staer - Sorry to bother you, but do you have any update on this?

Not bother at all! I believe I've identified the issue and am trying to figure out a fix.  The issue seems rooted in that when we exchange a managed identity token for an ACR access token, that token has its own lifespan which needs to be managed outside of normally managed identity tokens.

@staer Hello, are there any updates on this?

This has been fixed and merged into the codebase, it will go out with the next agent release. I will update the thread when this happens.

Hello @staer, do you have an approximate ETA on when the next agent release will go out?

No ETA at the moment, we are awaiting a few other fixes before doing a release.

Is there a potential workaround for this while we wait?

@czietsman If it helps, we restart our batch nodes via a script in order to workaround this issue until the release is published. Restarting the nodes clears the cache and gets us around the issue. Flaky but works

This fix is part of the release that is going out right now, it has hit several regions and should be fully available in all of the public regions azure within the next week or so. I will close the thread when the release finishes (I will also update the release notes today).

Thanks, I've switched to password based authentication in the mean time and
will revert back to user managed identity as soon as the release is
complete.
On Fri, 16 Sep 2022, 17:53 Dan Harris, @.***> wrote:

This fix is part of the release that is going out right now, it has hit
several regions and should be fully available in all of the public regions
azure within the next week or so. I will close the thread when the release
finishes (I will also update the release notes today).
—
Reply to this email directly, view it on GitHub
https://github.com/Azure/Batch/issues/122#issuecomment-1249529657, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AADAXKT3SFTSN4NO2SOZV53V6SJZNANCNFSM5NL2ONDQ
.
You are receiving this because you were mentioned.Message ID:
@.***>

The release has been completed. The underlying issue was that managed identity tokens were being exchanged with the ACR OAuth endpoint but the tokens that endpoint returned had a limited lifespan outside the lifespan of the original MI token. This has been addressed by re-requesting the OAuth token from ACR when needed.

I am seeing this when I spin up a new pool. The nodes start successfully, one task completes and all others fail, on node restart it completes all of them successfully.

I am still facing this issue lets say my node is running and if i pushed image to ACR with the latest tag. when i run the task it is not able to fetch the latest image any solution? i tried both approach password and managed identity still same result


[Event Request] Table 5050 Contact - OnBeforeCheckDupl

Please add a new publisher event to the function CheckDupl as follows:
.
.
LOCAL CheckDupl()

//>> Start New Publisher Call
OnBeforeCheckDupl(Rec, IsHandled);

IF IsHandled THEN
  EXIT;
//<< End New Publisher Call

IF RMSetup."Maintain Dupl. Search Strings" THEN
  DuplMgt.MakeContIndex(Rec);
IF GUIALLOWED THEN
.
.

New Publisher Event:
LOCAL [IntegrationEvent] OnBeforeCheckDupl(VAR Contact : Record Contact;VAR IsHandled : Boolean)

Thanks for reporting this. We agree, and we’ll publish a fix asap, either in an update for the current version or in the next major release. We will update this issue with information about availability.


boehmgc: 7.6.4 -> 7.6.6

https://github.com/ivmai/bdwgc/releases/tag/v7.6.6

[x] Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)

[x] NixOS
[ ] macOS
[ ] other Linux distributions

[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
[x] Tested execution of all binary files (usually in ./result/bin/)
[ ] Fits CONTRIBUTING.md.

Success on x86_64-linux (full log)
Attempted: boehmgc
Partial log (click to expand)
shrinking RPATHs of ELF executables and libraries in /nix/store/kcwkfw58qk2izjad996i3sf3zjah6cnq-boehm-gc-7.6.6-dev
patching script interpreter paths in /nix/store/kcwkfw58qk2izjad996i3sf3zjah6cnq-boehm-gc-7.6.6-dev
checking for references to /build in /nix/store/kcwkfw58qk2izjad996i3sf3zjah6cnq-boehm-gc-7.6.6-dev...
shrinking RPATHs of ELF executables and libraries in /nix/store/9jwfp43yfdjnqls26rqlr1yggnyqj4q7-boehm-gc-7.6.6-doc
patching script interpreter paths in /nix/store/9jwfp43yfdjnqls26rqlr1yggnyqj4q7-boehm-gc-7.6.6-doc
checking for references to /build in /nix/store/9jwfp43yfdjnqls26rqlr1yggnyqj4q7-boehm-gc-7.6.6-doc...
shrinking RPATHs of ELF executables and libraries in /nix/store/95a14ads6hzsd4zga8g92iw5fakyh7i3-boehm-gc-7.6.6-debug
patching script interpreter paths in /nix/store/95a14ads6hzsd4zga8g92iw5fakyh7i3-boehm-gc-7.6.6-debug
checking for references to /build in /nix/store/95a14ads6hzsd4zga8g92iw5fakyh7i3-boehm-gc-7.6.6-debug...
/nix/store/q295gikx5yl5nws2vyvzq9gl0605qvdc-boehm-gc-7.6.6

Success on x86_64-darwin (full log)
Attempted: boehmgc
Partial log (click to expand)
Patching '/nix/store/37li9h8h1sfwwwaxc7f6is0xk6zlm0wz-boehm-gc-7.6.6-dev/lib/pkgconfig/bdw-gc.pc' includedir to output /nix/store/37li9h8h1sfwwwaxc7f6is0xk6zlm0wz-boehm-gc-7.6.6-dev
strip is /nix/store/f44c6wn75kk2r4i0bvappi6yrlj2m8b9-cctools-binutils-darwin/bin/strip
stripping (with command strip and flags -S) in /nix/store/8db0pzd1wjcaqy5gx8w549xrmmk73330-boehm-gc-7.6.6/lib
patching script interpreter paths in /nix/store/8db0pzd1wjcaqy5gx8w549xrmmk73330-boehm-gc-7.6.6
strip is /nix/store/f44c6wn75kk2r4i0bvappi6yrlj2m8b9-cctools-binutils-darwin/bin/strip
stripping (with command strip and flags -S) in /nix/store/37li9h8h1sfwwwaxc7f6is0xk6zlm0wz-boehm-gc-7.6.6-dev/lib
patching script interpreter paths in /nix/store/37li9h8h1sfwwwaxc7f6is0xk6zlm0wz-boehm-gc-7.6.6-dev
strip is /nix/store/f44c6wn75kk2r4i0bvappi6yrlj2m8b9-cctools-binutils-darwin/bin/strip
patching script interpreter paths in /nix/store/wjvvzf99q5wixn3mns26d3kja8f3glv8-boehm-gc-7.6.6-doc
/nix/store/8db0pzd1wjcaqy5gx8w549xrmmk73330-boehm-gc-7.6.6

Success on aarch64-linux (full log)
Attempted: boehmgc
Partial log (click to expand)
shrinking RPATHs of ELF executables and libraries in /nix/store/sa5wcsqlhnisz3agclr19hya120215qq-boehm-gc-7.6.6-dev
patching script interpreter paths in /nix/store/sa5wcsqlhnisz3agclr19hya120215qq-boehm-gc-7.6.6-dev
checking for references to /build in /nix/store/sa5wcsqlhnisz3agclr19hya120215qq-boehm-gc-7.6.6-dev...
shrinking RPATHs of ELF executables and libraries in /nix/store/hzj3xinjn5wji2631mswrx0p0147i73f-boehm-gc-7.6.6-doc
patching script interpreter paths in /nix/store/hzj3xinjn5wji2631mswrx0p0147i73f-boehm-gc-7.6.6-doc
checking for references to /build in /nix/store/hzj3xinjn5wji2631mswrx0p0147i73f-boehm-gc-7.6.6-doc...
shrinking RPATHs of ELF executables and libraries in /nix/store/skd8rjgi8d90lcdal85f1rp6h94ssgbq-boehm-gc-7.6.6-debug
patching script interpreter paths in /nix/store/skd8rjgi8d90lcdal85f1rp6h94ssgbq-boehm-gc-7.6.6-debug
checking for references to /build in /nix/store/skd8rjgi8d90lcdal85f1rp6h94ssgbq-boehm-gc-7.6.6-debug...
/nix/store/9096i4jx4bvn9jkvdry5i0p8j4d7iby6-boehm-gc-7.6.6

@GrahamcOfBorg build nix

Success on x86_64-linux (full log)
Attempted: nix
Partial log (click to expand)
running test tests/fetchGit.sh... [SKIP]
running test tests/fetchMercurial.sh... [SKIP]
running test tests/signing.sh... [PASS]
running test tests/run.sh... [PASS]
running test tests/brotli.sh... [PASS]
running test tests/pure-eval.sh... [PASS]
running test tests/check.sh... [PASS]
running test tests/plugins.sh... [PASS]
All tests succeeded
/nix/store/79gl6wqqm01piiyhwvjxqmrisqdszs7v-nix-2.0

Success on x86_64-darwin (full log)
Attempted: nix
Partial log (click to expand)
running test tests/fetchGit.sh... [SKIP]
running test tests/fetchMercurial.sh... [SKIP]
running test tests/signing.sh... [PASS]
running test tests/run.sh... [PASS]
running test tests/brotli.sh... [PASS]
running test tests/pure-eval.sh... [PASS]
running test tests/check.sh... [PASS]
running test tests/plugins.sh... [PASS]
All tests succeeded
/nix/store/2cchykcb8rpk9p1ad1dwm6azhg5xnqww-nix-2.0

Success on aarch64-linux (full log)
Attempted: nix
Partial log (click to expand)
running test tests/fetchGit.sh... [SKIP]
running test tests/fetchMercurial.sh... [SKIP]
running test tests/signing.sh... [PASS]
running test tests/run.sh... [PASS]
running test tests/brotli.sh... [PASS]
running test tests/pure-eval.sh... [PASS]
running test tests/check.sh... [PASS]
running test tests/plugins.sh... [PASS]
All tests succeeded
/nix/store/7znczdsla4v157ia2yd37d9hl44f7vk6-nix-2.0


Add VSTS CI badge

Fixes #6

The tests appear to be failing on Windows https://xtermjs.visualstudio.com/xterm-addon-ligatures/_build/results?buildId=270&_a=summary&view=logs


How to change the buffer of any nvim-dap-ui window temporarily?

As title. I'm a plugin author and I want to change the buffer of any nvim-dap-ui window temporarily.

If I call :bn then the buffer of the window on enter will be changed to the next buffer. But instead, I want to change the buffer of the current nvim-dap-ui split.
I assume that you have used some options to prevent changing the buffer of any window of nvim-dap-ui, but I cannot confirm this myself.

Thanks.

Found #58 and ae3b003

I found another problem with deleting the DapuiWindowsSetup augroup: if I press o on the dapui_stacks split, the buffer of the window on enter will not be changed. Instead, the buffer of the current split will be changed. This is unwanted behavior for me...

I've added a force_buffers option to the setup which can disable this behaviour :smile:

@rcarriga Hi, thanks for your help with b2fdea8, it's working very well. But I encountered another problem(should I open another issue?):

If I trigger the open function of dapui_stacks, then I expect the buffer of the main window(i.e. where I called dapui.open()) to be changed.
But in the demo, it's the buffer of the split being changed.

https://user-images.githubusercontent.com/24765272/215243819-b0c31300-b1d3-4750-8305-9a993462e564.mov

I've added a window picker so users can choose which window to open a frame in

I just encountered a little trouble when trying e400a44: My cursor stuck at a strange place after I typed the letter and pressed <CR> to confirm my selection.
(Unfortunately, I don't know how to provide a minimal config for this. So I instead provide my config of NeoZoom.lua below)
{
  'nyngwang/NeoZoom.lua',
  config = function ()
    require('neo-zoom').setup()
    vim.keymap.set('n', '<CR>', function () vim.cmd('NeoZoomToggle') end, { silent = true, nowait = true })
  end
}

Here is the DEMO:
https://user-images.githubusercontent.com/24765272/217331140-20db6062-8725-4533-8794-c4b96611ddf2.mov

It looks like you're pressing shift+B in that video which wouldn't work. I've added a change to convert upper case to lower case characters to avoid that issue. The window changed after you pressed escape because of a separate bug which should now be fixed also :smile:

Sorry for my bad news: I got this error (where the window handle 1020 is indeed the main window where I started debugging) after confirming my choice.
   Error  04:10:10 msg_show.emsg E5108: Error executing lua: ...ng/.local/share/nvim/lazy/nvim-dap-ui/lua/dapui/util.lua:149: Failed to switch to window 1020
stack traceback:
	[C]: in function 'nvim_set_current_win'
	...ng/.local/share/nvim/lazy/nvim-dap-ui/lua/dapui/util.lua:149: in function 'set_win_pos'
	...ng/.local/share/nvim/lazy/nvim-dap-ui/lua/dapui/util.lua:164: in function <...ng/.local/share/nvim/lazy/nvim-dap-ui/lua/dapui/util.lua:144>
	...cal/share/nvim/lazy/nvim-dap-ui/lua/dapui/client/lib.lua:48: in function 'callback'
	.../share/nvim/lazy/nvim-dap-ui/lua/dapui/render/canvas.lua:146: in function <.../share/nvim/lazy/nvim-dap-ui/lua/dapui/render/canvas.lua:138>

I'm afraid I can't reproduce, I'll need specific instructions on how to do so

@rcarriga Here are the steps: (apologies for my forgetfulness)

With the same config in my comment above.
Remember the result of :lua print(vim.api.nvim_get_current_win()) for the main window where the debugging start.
Press <Enter> (or call :NeoZoomToggle) on the dapui_stacks split.
Call :lua vim.api.nvim_set_current_win(winid) where winid is the value at setup 2.

Basically, #239 fixes most of the bug, because I see there is no harm just ignore the error. But there is still the same issue as I have stated above. Here is the demo of the current status:
https://user-images.githubusercontent.com/24765272/218745061-1f5dbfa3-2444-49be-a1c7-7464cae58802.mov

I can't reproduce the issue where no selection hints are shown. It's likely something setting your statusline which is how nvim-dap-ui sets the hints https://github.com/rcarriga/nvim-dap-ui/blob/9adb362a74f452f3f65c1e4e076f5e18c3a3e773/lua/dapui/util.lua#L115-L124

@rcarriga In fact, I didn't get the point of window selection, as I will always select B in my use case. Is it possible to opt out of the feature? Anyway, thanks for your trying to reproduce.

The window selector is not specifically for this case, it is so users can select which window to replace in general. I've added a select_window config option to allow overriding it.

Closing as bdb94e3 has helped me a lot. I did encounter some more related issues with that evil dap-repl buffer, but I believe it can be resolved in a new thread.


Configure App Insights SDK  documentation is out of date for the current version of Visual Studio

The Configure App Insights SDK documentation (https://docs.microsoft.com/en-us/azure/azure-monitor/learn/dotnetcore-quick-start#configure-app-insights-sdk) is out of date for the current version of Visual Studio 2019.  Please update.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: a7f7156b-3478-9938-6596-3573034fd7f5
Version Independent ID: 3d3adaf0-7e39-209d-71b7-3b41bf05cb60
Content: Quickstart ASP.NET Core - Azure Monitor Application Insights - Azure Monitor
Content Source: articles/azure-monitor/learn/dotnetcore-quick-start.md
Service: azure-monitor
Sub-service: application-insights
GitHub Login: @mrbullwinkle
Microsoft Alias: mbullwin

@jimt4593 Thank you for taking time to share your feedback to improve our Azure documentation. I have assigned this issue to our document author @lgayhardt to further evaluate the feedback and have a backlog item to update the document to reflect the screen shots with latest Visual Studio version.

@jimt4593 we are going to retire the quickstart as it is redundant to one of our more detailed docs. This article: https://docs.microsoft.com/azure/azure-monitor/app/asp-net is up-to-date with the latest changes in VS2019.

The changes to retire and redirect this article have been merged internally. Those changes will go-live later today. Thanks again for bringing this to our attention.

#please-close


RBD: Format the disk while creating the volume

https://github.com/rancher/rancher/issues/8722

LGTM.


fix #91 retrieve textarea dom node

This exposes the _rootDOMNode to anyone who needs it, as explained here.
Example
import React from 'react';
import Textarea from 'react-textarea-autosize';

class Example extends React.Component {
  render() {
    <div onClick = {this._onClick}>
      <Textarea ref = 'area'/>
    </div>
  }

  _onClick(e) {
    let node = this.refs.area.getTextareaDOMNode();
    // do something special with the node here.
    // you can also use a function for the ref instead.
  }
}

String refs are deprecated, and the preferred way to achieve such functionality is by a callback ref. Recently inputRef prop was added, so the consumers of the library can use it.
Gonna close this in favor of the inputRef prop.


Enhancing the Feedback section styling and adding name and email id for the form

Related Issue
[Cite any related issue(s) this pull request addresses. If none, simply state “None”]
Fixes:  #4687
Description
Enhancing the Feedback section styling and adding name and email id for the form.
Type of PR

[ ] Bug fix
[x] Feature enhancement
[ ] Documentation update
[ ] Other (specify): _______________

Screenshots / videos (if applicable)

Checklist:

[x] I have made this change from my own.
[x] I have taken help from some online resources.
[x] My code follows the style guidelines of this project.
[x] I have performed a self-review of my own code.
[x] I have commented my code, particularly in hard-to-understand areas.
[x] I have made corresponding changes to the documentation.
[x] My changes generate no new warnings.
[x] I have tested the changes thoroughly before submitting this pull request.
[x] I have provided relevant issue numbers and screenshots after making the changes.

ur changes arent visible in the deploy preview .
https://deploy-preview-4696--swapreadsconnect.netlify.app/

@abhi03ruchi tried creating a new PR for this
https://github.com/anuragverma108/SwapReads/pull/4708/


Win: add GetHostNameW fallback method

This is a simple, unobtrusive way to improve compatibility with legacy systems where GetHostNameW is not available.
p.s. It's totally fine to officially drop support for legacy systems.
But please don't refuse fixes that are still relevant to the community.
Related:

https://github.com/libuv/libuv/issues/3260
https://github.com/libuv/libuv/pull/3636

Time moves on. We've decided to drop support for Windows 8.1 so the odds of us reconsidering Windows 7? Slim.
If Windows 7 support is important to you, carry this patch in your local fork.


Form validation errors are not announced to screen reader users when they are presented on the page

Bug Report
Description
When users are interacting with forms, we allow developers to associate error messages with the individual form fields. These are messages are not being announced on VoiceOver on iOS, possibly not being announced with other screen readers + browsers we haven't checked yet.
Steps to Reproduce

Navigate to https://engineering.cerner.com/terra-ui/components/terra-form-validation/form-validation/validation-events and interact with the validation onInput examples

Expected Behavior
Screen readers should communicate error messages that are dynamically added via onInput changes
Possible Solution
Use role="alert" on container that contains dynamic error message or aria-live?
Environment

Component Name and Version: terra-form-validations
Browser Name and Version:
Node/npm Version: [e.g. Node 8/npm 5]
Webpack Version:
Operating System and version (desktop or mobile):

@ Mentions
@mmalaker

fixed in PR


blockchain_headers S3 download progress in daemon status

@jackrobison is working on the refactor mentioned in comments earlier, it is almost done, here is the relevant issue with link to working branch: https://github.com/lbryio/lbry/issues/1324


On Vulkan, Sprite3D with ViewportTexture and SubViewport doesn't work in exported project.

Godot version
4.1.1 stable
System information
Godot v4.1.1.stable - Windows 10.0.22621 - Vulkan (Forward+) - dedicated AMD Radeon RX 6600 (Advanced Micro Devices, Inc.; 31.0.21023.2010) - AMD Ryzen 5 5600 6-Core Processor (12 Threads)
Issue description
Even though everything is fine in the editor, exporting with either the debug or release template breaks Sprite3D nodes with ViewportTexture. The problem is present in forward and mobile renderer, not on compatibility. I have an AMD GPU on Windows 11. Tests on other operating systems and GPU vendors are appreciated.
Steps to reproduce
Create a 3D scene with WorldEnvironment and Camera3D.
Add a Sprite3D node in view of the camera.
Create a SubViewport node and place something as it's child.
Create a new ViewportTexture in the sprite texture property and select the viewport.
Run the scene, it works fine.
Export the project and run it, the sprite is broken.
Minimal reproduction project
empty_project.zip

Same issue in my project (4.1.1 on Linux). Only affected template_release and template_debug builds, not editor builds. I was unable to create a working reproducer, however. The workaround posted in #80636 (VIEWPORT_UPDATE_WHEN_PARENT_VISIBLE) worked for me.

CC @Rindbee @KoBeWi

It seems that render_target_update_mode = UPDATE_WHEN_VISIBLE has no effect in 3D scenes.

https://github.com/godotengine/godot/blob/221884e6bc260c38f16422081b7d4efd49a71375/servers/rendering/renderer_viewport.cpp#L664-L666
RSG::texture_storage->render_target_was_used(vp->render_target) has different results after exporting.
This may be a regression bug from #70132. CC @clayjohn
https://github.com/godotengine/godot/blob/221884e6bc260c38f16422081b7d4efd49a71375/servers/rendering/renderer_rd/storage_rd/material_storage.cpp#L934-L937


Fix spelling mandelbrot

Unfortunately I misspelled Mandelbrot (from Benoit Mandelbrot) in my PR :man_facepalming:
This PR addresses that.

:) thanks for the update!


allow pages to stop from navigating away, e.g. if there are unsaved state changes

Hello,
I am going to start a web project with Flutter, for another project use the Fluro library, however, I could not solve the following problem:
If a user is on a page that contains a form and is making modifications is said form, I would like that if he tries to exit without having saved the modifications (either by putting another url, with the browser's backbutton, ...) it would show him an alertdialog giving him the possibility of canceling the navigation to the new url or, on the contrary, of canceling the modifications and staying on the same page where he is.
The question is, can I do this with qlevar_router?
qlevar_router has any mechanism by which this functionality can be achieved?
Please, if this functionality is possible with qlevar_router could you give me some indications.
Thank you so much for all the help.
Regards,
Jose

Hello,
You could use canPop method in the Middleware
See this example with the code


issue/5054-modulev2-invalid-version

Description
When we create a v2 module and we set the version to an invalid python version, the build command will show a error message that doesn't give much information. This commit will improve the error message.
closes #5054
Self Check:
Strike through any lines that are not applicable (~~line~~) then check the box

[x] Attached issue to pull request
[x] Changelog entry
[x] Type annotations are present
[x] Code is clear and sufficiently documented
[x] No (preventable) type errors (check using make mypy or make mypy-diff)
[x] Sufficient test cases (reproduces the bug/tests the requested feature)
[x] Correct, in line with design
[ ] End user documentation is included or an issue is created for end-user documentation (add ref to issue here: )

Processing this pull request

Merged into branches master in 6175efdd8ac6f112b3c205abed2f621d365bc610

Not closing this pull request due to previously commented issues for some of the destination branches. Please open a separate pull request for those branches by cherry-picking the relevant commit. You can safely close this pull request and delete the source branch.

This branch was not deleted as it seems to still be in use.


fix(prettier): pop the stack in should_wrap_function_for_export_default

Current dependencies on/for this PR:

main

PR #1529   👈

PR #1530

This stack of pull requests is managed by Graphite.

Merge activity

Nov 24, 1:57 AM: @Boshen merged this pull request with Graphite.


C#: Add note about the class name in instantiate error

Adds a note about the requirement that a C# class name must match the script filename in which the they are defined to the instantiate error.
This should hopefully make the error more user-friendly and avoid issues such as https://github.com/godotengine/godot/issues/66419 in the future.
Feel free to suggest a better message, the goal is to mention the common reasons why the associated class was not found:

File at the specified path does not exist.
In case the user attached a script to a Node and then deleted the script without detaching it from the Node.
The file exists but it contains no class or the class defined does not match the name of the filename.
The script filename and the class name are case-sensitive.
It seems common for users to define a class such as Player using PascalCase to follow .NET class naming conventions and then name the script player.cs because Godot uses snake_case for filenames by default.

One of the reason could be the assembly is copied in a different folder than the expected. Maybe something like: "Ensure the assembly is located in X" where X is the expected folder (csproj_folder.godot\mono\tem\bin or whatever). It could sound crazy, but It really happened to me because I had the main csproj folder in a different folder than the solution by mistake.

@avilches It's no longer possible to move the .csproj, and if the built assemblies don't end up in the right place it would be a bug and not an user error.
If you still think there's a bug, make sure to test with beta 9 that was recently released and may fix it. If you can still reproduce it feel free to open a new issue with more details.


Hover the mouse over the model and capture the pointer to the nearest edge or vertex

Pointer capture adsorption is a very important function. Can it be added to this project?
Here are some examples and references
https://xeokit.github.io/xeokit-sdk/examples/picking/#snapToEdge
https://github.com/tmarti/graphics-research/blob/main/articles/webgl2-gpu-based-snapping.md

Hi @wwjje , we will keep this suggestion in mind for the future. Currently this feature is not within our development roadmap.


chore: add MAINTAINERS.md file

What does this PR do?
took the current list of the person in the reviewers/qe-reviewers team
(some members are pending)
I sorted by first name, can sort by a different order
If someone is missing, maybe the person has not accepted the invitation yet or I just made a mistake so you can comment there
Screenshot / video of UI

What issues does this PR fix or reference?

How to test this PR?

[ ] Tests are covering the bug fix or the new feature

LGTM


[5.7] Fix preview box getting cut off for Tutorial pages

Rationale: Fixes an issue where tutorial previews display incorrectly after second click
Risk: Low
Risk Detail: minor refactor
Reward: High
Reward Details: Users will no longer see obvious UI issue when previewing a tutorial
Original PR: https://github.com/apple/swift-docc-render/pull/338
Issue: rdar://93843834
Code Reviewed By: @marinaaisa @dobromir-hristov
Testing Details: Tested manually in the browser

@swift-ci test


Amazon ECR reports loads of vulnerabilities

Hello, I firstly want to thank you for your hard work on this solution. I've managed to deploy a working container on Amazon ECR and running via ECS and EC2!
However I am getting a lot of vulnerabilities whenever the docker image is scanned by AWS's vulnerability checker:
Critical: 0
High: 8
Medium: 27
Low: 20
Informational: 54
Undefined: 5
Total: 114
The Dockerfile being used is configured as such:
FROM dart:stable

# Resolve app dependencies.
WORKDIR /app
COPY pubspec.* ./
RUN dart pub get

# Copy app source code and update packages
COPY . .
RUN dart pub get --offline
RUN dart run build_runner build --delete-conflicting-outputs

# Start server.
EXPOSE 12021
CMD ["dart", "bin/server.dart"]

Would really appreciate some help on how to resolve this issue. Thanks so much in advance :)
These vulnerabilities are as follows:

Name
Package
Severity
Description

CVE-2022-22823
expat:2.2.6-2+deb10u1
HIGH
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2022-22824
expat:2.2.6-2+deb10u1
HIGH
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2022-22822
expat:2.2.6-2+deb10u1
HIGH
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2022-23852
expat:2.2.6-2+deb10u1
HIGH
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

CVE-2022-23219
glibc:2.28-10
HIGH
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

CVE-2019-25013
glibc:2.28-10
HIGH
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

CVE-2022-23218
glibc:2.28-10
HIGH
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

CVE-2021-33574
glibc:2.28-10
HIGH
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

CVE-2021-22947
curl:7.64.0-4+deb10u2
MEDIUM
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got before the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

CVE-2021-22946
curl:7.64.0-4+deb10u2
MEDIUM
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (--ssl-reqd on the command line orCURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

CVE-2021-22924
curl:7.64.0-4+deb10u2
MEDIUM
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

CVE-2022-22827
expat:2.2.6-2+deb10u1
MEDIUM
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2021-45960
expat:2.2.6-2+deb10u1
MEDIUM
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

CVE-2022-22826
expat:2.2.6-2+deb10u1
MEDIUM
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2022-22825
expat:2.2.6-2+deb10u1
MEDIUM
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2021-46143
expat:2.2.6-2+deb10u1
MEDIUM
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

CVE-2018-12886
gcc-8:8.3.0-6
MEDIUM
stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

CVE-2021-40330
git:1:2.20.1-2+deb10u3
MEDIUM
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.

CVE-2021-21300
git:1:2.20.1-2+deb10u3
MEDIUM
Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via git config --global core.symlinks false), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. before cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, <IP_ADDRESS>.6.

CVE-2021-35942
glibc:2.28-10
MEDIUM
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

CVE-2020-1751
glibc:2.28-10
MEDIUM
An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.

CVE-2021-3326
glibc:2.28-10
MEDIUM
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

CVE-2021-43618
gmp:2:6.1.2+dfsg-4
MEDIUM
GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

CVE-2021-33560
libgcrypt20:1.8.4-5+deb10u1
MEDIUM
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

CVE-2019-12290
libidn2:2.0.5-1+deb10u1
MEDIUM
GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.

CVE-2019-13115
libssh2:1.8.0-2.1
MEDIUM
In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

CVE-2017-16932
libxml2:2.9.4+dfsg1-7+deb10u2
MEDIUM
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

CVE-2016-9318
libxml2:2.9.4+dfsg1-7+deb10u2
MEDIUM
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

CVE-2020-11080
nghttp2:1.36.0-2+deb10u1
MEDIUM
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

CVE-2021-41617
openssh:1:7.9p1-10+deb10u2
MEDIUM
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

CVE-2019-20454
pcre2:10.32-5
MEDIUM
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

CVE-2020-14155
pcre3:2:8.39-12
MEDIUM
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

CVE-2020-16156
perl:5.28.1-6+deb10u1
MEDIUM
CPAN 2.28 allows Signature Verification Bypass.

CVE-2019-3844
systemd:241-7~deb10u8
MEDIUM
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

CVE-2019-3843
systemd:241-7~deb10u8
MEDIUM
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

CVE-2016-2781
coreutils:8.30-3
LOW
chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

CVE-2021-22898
curl:7.64.0-4+deb10u2
LOW
curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

CVE-2019-15847
gcc-8:8.3.0-6
LOW
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

CVE-2020-6096
glibc:2.28-10
LOW
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

CVE-2021-27645
glibc:2.28-10
LOW
The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.

CVE-2019-19126
glibc:2.28-10
LOW
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

CVE-2020-27618
glibc:2.28-10
LOW
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

CVE-2020-10029
glibc:2.28-10
LOW
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

CVE-2020-1752
glibc:2.28-10
LOW
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

CVE-2016-10228
glibc:2.28-10
LOW
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

CVE-2019-14855
gnupg2:2.2.12-1+deb10u1
LOW
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

CVE-2019-13627
libgcrypt20:1.8.4-5+deb10u1
LOW
It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

CVE-2021-36086
libsepol:2.8-1
LOW
The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).

CVE-2021-36087
libsepol:2.8-1
LOW
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

CVE-2021-36084
libsepol:2.8-1
LOW
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).

CVE-2021-36085
libsepol:2.8-1
LOW
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).

CVE-2019-17498
libssh2:1.8.0-2.1
LOW
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

CVE-2019-17543
lz4:1.8.3-1+deb10u1
LOW
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

CVE-2018-7169
shadow:1:4.5-1.1
LOW
An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

CVE-2021-37600
util-linux:2.33.1-0.1
LOW
** DISPUTED ** An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

CVE-2011-3374
apt:<IP_ADDRESS>
INFORMATIONAL
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

CVE-2019-18276
bash:5.0-4
INFORMATIONAL
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

CVE-2017-18018
coreutils:8.30-3
INFORMATIONAL
In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

CVE-2021-22922
curl:7.64.0-4+deb10u2
INFORMATIONAL
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

CVE-2021-22923
curl:7.64.0-4+deb10u2
INFORMATIONAL
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

CVE-2013-0340
expat:2.2.6-2+deb10u1
INFORMATIONAL
expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

CVE-2018-1000021
git:1:2.20.1-2+deb10u3
INFORMATIONAL
GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).

CVE-2019-1010025
glibc:2.28-10
INFORMATIONAL
** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."

CVE-2019-1010023
glibc:2.28-10
INFORMATIONAL
** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."

CVE-2019-1010024
glibc:2.28-10
INFORMATIONAL
** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."

CVE-2010-4756
glibc:2.28-10
INFORMATIONAL
The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

CVE-2019-9192
glibc:2.28-10
INFORMATIONAL
** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.

CVE-2019-1010022
glibc:2.28-10
INFORMATIONAL
** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."

CVE-2018-20796
glibc:2.28-10
INFORMATIONAL
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

CVE-2011-3389
gnutls28:3.6.7-4+deb10u7
INFORMATIONAL
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

CVE-2004-0971
krb5:1.17-3+deb10u3
INFORMATIONAL
The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.

CVE-2018-5709
krb5:1.17-3+deb10u3
INFORMATIONAL
An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

CVE-2018-6829
libgcrypt20:1.8.4-5+deb10u1
INFORMATIONAL
cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

CVE-2019-9893
libseccomp:2.3.3-4
INFORMATIONAL
libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.

CVE-2018-1000654
libtasn1-6:4.13-3
INFORMATIONAL
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.

CVE-2021-39537
ncurses:6.1+20181013-2+deb10u2
INFORMATIONAL
An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

CVE-2020-15719
openldap:2.4.47+dfsg-3+deb10u6
INFORMATIONAL
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

CVE-2017-14159
openldap:2.4.47+dfsg-3+deb10u6
INFORMATIONAL
slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

CVE-2015-3276
openldap:2.4.47+dfsg-3+deb10u6
INFORMATIONAL
The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

CVE-2017-17740
openldap:2.4.47+dfsg-3+deb10u6
INFORMATIONAL
contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

CVE-2016-20012
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session.

CVE-2007-2243
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.

CVE-2020-14145
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

CVE-2020-12062
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
** DISPUTED ** The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances."

CVE-2018-15919
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'

CVE-2008-3234
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by appending a :/ (colon slash) sequence, followed by the role name, to the username.

CVE-2020-15778
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

CVE-2019-16905
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

CVE-2007-2768
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.

CVE-2019-6110
openssh:1:7.9p1-10+deb10u2
INFORMATIONAL
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

CVE-2007-6755
openssl:1.1.1d-0+deb10u7
INFORMATIONAL
The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.

CVE-2010-0928
openssl:1.1.1d-0+deb10u7
INFORMATIONAL
OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

CVE-2019-20838
pcre3:2:8.39-12
INFORMATIONAL
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

CVE-2017-16231
pcre3:2:8.39-12
INFORMATIONAL
** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.

CVE-2017-11164
pcre3:2:8.39-12
INFORMATIONAL
In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

CVE-2017-7246
pcre3:2:8.39-12
INFORMATIONAL
Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.

CVE-2017-7245
pcre3:2:8.39-12
INFORMATIONAL
Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.

CVE-2011-4116
perl:5.28.1-6+deb10u1
INFORMATIONAL
_is_safe in the File::Temp module for Perl does not properly handle symlinks.

CVE-2019-19882
shadow:1:4.5-1.1
INFORMATIONAL
shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).

CVE-2007-5686
shadow:1:4.5-1.1
INFORMATIONAL
initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

Hi @graphicbeacon have you tried to build a serving image rather than using the development image for serving?
Here's the suggested Dockerfile from dart create -t server-shelf serverapp:
# Use latest stable channel SDK.
FROM dart:stable AS build

# Resolve app dependencies.
WORKDIR /app
COPY pubspec.* ./
RUN dart pub get

# Copy app source code (except anything in .dockerignore) and AOT compile app.
COPY . .
RUN dart compile exe bin/server.dart -o bin/server

# Build minimal serving image from AOT-compiled `/server`
# and the pre-built AOT-runtime in the `/runtime/` directory of the base image.
FROM scratch
COPY --from=build /runtime/ /
COPY --from=build /app/bin/server /app/bin/

# Start server.
EXPOSE 8080
CMD ["/app/bin/server"]

I didn't go through all of the results, but mostly this is just a scan of what's in Debian buster right now:
buster (misc): 2.28-10
Binary packages: [show 29 binary packages]
bullseye (misc): 2.31-13+deb11u2
Binary packages: [show 28 binary packages]

Per https://dart.dev/get-dart#linux we should upgrade to bullseye anyway, so I created https://github.com/dart-lang/dart-docker/pull/77.

@mit-mit Thanks for getting back to me Michael. I have tried the AOT compilation route but ECR throws the following exception when scanning the docker image:
UnsupportedImageError: The operating system and/or package manager are not supported.

@athomas Thanks for creating the PR. I can try this out once merged

After further investigation the exception appears to be caused by the scratch image
FROM scratch
COPY --from=build /runtime/ /
COPY --from=build /app/bin/server /app/bin/

Works when I disable those lines (still including the vulnerabilities)

ECR just doesn't support scanning FROM scratch images:
https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-troubleshooting.html

@graphicbeacon Without FROM scratch images can be huge. If you use a full dart image you get about ~750MB. Whether the ECR image scanning is worth the size hit is up to you. You could also use another base image instead of scratch (and similarly the size will be that image + the dart files copied over from the build image). See https://medium.com/google-cloud/build-slim-docker-images-for-dart-apps-ee98ea1d1cf7 for additional context (this is an older version of what we did here, but it informed our decisions for the official image).
Dart provides a full featured development image and instructions to create a minimal production image.

@graphicbeacon So used the alpine base image which gave me 6MB with just 1 vulnerability(low)!
FROM dart:stable
RUN apt -y update && apt -y upgrade

WORKDIR /app
COPY pubspec.* .
RUN dart pub get
COPY . .
RUN dart pub get --offline
RUN dart compile exe bin/server.dart -o bin/server

FROM alpine
COPY --from=0 /app/bin/server /app/bin/server
# COPY any other directories or files you may require at runtime, ex:
COPY --from=0 /app/public/ /app/public/
EXPOSE 12021
ENTRYPOINT ["/app/bin/server"]

Only problem is that now I have issue connecting to MongoDB database from the running binary.
MongoDart Error: No master connection

Might be unrelated but, is there anything I need to be aware about outgoing connections from the compiled binary?

@graphicbeacon 1 is more than 0 :)
Even with base alpine you still get more of an OS (and therefore a bigger attack surface) than you'll get with a scratch image. But it's a good compromise and there's nothing wrong with going that way. Alpine's also a minimal image and it will grow if you add more packages to it (and it will bring the vulnerabilities of those packages with it). So using alpine for the dart development image isn't a silver bullet. For a minimal production image, it's probably a pretty good choice but not necessarily superior to scratch.
I'm not an "alpine networking" expert, so I'm afraid I don't know the answer to the outgoing connection. I'd try to open a connection to MongoDB with some standard MongoDB client to see if this is a general issue with your setup or a Dart specific issue. If that doesn't help, stack overflow is probably a better place to ask.

@athomas 1 low vulnerability is less than 114 :)
The Mongo issue is not happening when the Dart server is running in JIT mode. It just might be an edge case with the AOT binary. This ain't your problem however so will go to StackOverflow

The vulnerability report was created using the dart development image (by removing the FROM scratch). This isn't the recommended setup for production where these vulnerabilities don't apply (because they largely refer to code that isn't in the production image, only in the development image).
The development image was upgraded to the latest stable Debian in #77 which addresses some of them (it is still a fully featured image with a lot of dependencies and there are no plans to change that).


Add time out error code.

Is it necessary to re-generate thrift files for clients?

Is it necessary to re-generate thrift files for clients?

Don't force.


Automatic conveyor zoom similar to osu! taiko

In apex it's possible to change conveyor zoom, but in osu! taiko it's automatically calculated based on the aspect ration of the screen. Right now our zoom value defaults to 16:9 (at least it should), yet for other aspect rations it might cause unexpected behavior like SV being too fast or too slow.
We should provide a default-enabled option (later a "mod"), which automatically calculates it according to how the osu! client does that. As for implementation, look at lazer and completely ignore the legacy client.

Apparently it does not change with resolution..? Just kept the hardcoded taiko default. It's a mess and osu! devs don't know what to do themselves :\


feat: add testcase for channel execute entry point

Description:
Added test case for channel entry points
Commit Message
add testcase for channel entry point

see the guidelines for commit messages.
Changelog Entry
Checklist:

[x] I have performed a self-review of my own code
[x] I have documented my code in accordance with the documentation guidelines
[x] My changes generate no new warnings
[x] I have added tests that prove my fix is effective or that my feature works
[x] I have run the unit tests
[ ] I only have one commit (if not, squash them into one commit).
[x] I have a descriptive commit message that adheres to the commit message guidelines

Please review the CONTRIBUTING.md file for detailed contributing guidelines.

Codecov Report

Merging #332 (d0f154c) into main (2b3667d) will increase coverage by 32.89%.
The diff coverage is n/a.

@@              Coverage Diff              @@
##               main     #332       +/-   ##
=============================================
+ Coverage     47.12%   80.01%   +32.89%
- Complexity        0      421      +421
=============================================
  Files            95       27       -68
  Lines         16073     2037    -14036
  Branches          0      284      +284
=============================================
- Hits           7574     1630     -5944
+ Misses         8499      266     -8233
- Partials          0      141      +141

see 122 files with indirect coverage changes


Use quoted struct tags for golang configuration

Summary
This adds quotes to the Golang struct tags.
Reason
The current Golang config struct has a minor error in that the struct tags are missing. This would cause an issue when encoding/decoding the json configs. Example: https://go.dev/play/p/2hCSyXzXWgR
Testing
Here is an example of it in action

I am unable to add labels, but I'd assume this would be a technical review :).


What is the idiomatic approach to composing custom hooks with queries performantly?

I'm currently using react-query to move away from using React Redux and Redux Saga to handle data fetching. An example of this is fetching a list of products from an API, and then displaying them in a list:
function useProducts() {
	const {data, status, error} = useProducts('products', fetchProductEntities)
	return {productEntities: data, productList: Object.values(data), status, error}
}

My goal is to compose a new custom hook using useProducts() to obtain the data of a single product. This is necessary as products are children of other entities, and we optimize the number of HTTP requests required by fetching all products in one request:
function useProduct(id) {
	const {productEntities} = useProducts()
	return productEntities[id]
}

The problem with this approach is that any component that calls useProduct(id) will re-render when the 'products' query refetches. Ideally I'd like to optimize this by not re-rendering a component if the product ID doesn't change.
What is the best way to solve this problem using react-query? Or is this a consumer facing problem and isn't a part of react-query's use case?

The result will be memoized to the granularity of your refetch rate. Refetching happens due to:

Window refocus (on by default, you can disable this)
New instances of a query mounting (on by default, you can disable this)
Refetch Intervals (optional)
Manual calls to queryCache.refetchQueries()

Incremental Steps you can take to make an asset refetch less:

Increase the staleTime from 0 (the default). This will make it so automatic attempts to refetch are suppressed until the query is marked as stale from the last successful update
Turn off refetching on mount with refetchOnMount: false either globally or per-query
Turn of window refocusing

Each of these operates at different levels within React Query but with all of them together you should be able to find a good balance for how often to refetch your assets.
Further advice, if you still can't find a decent balance, then it's likely time to consider adding an endpoint to your api for individual resources so you can consume and cache them with better granularity.

Thank you so much for the in depth explanation. I'll take all your points into consideration while I try and find a middle ground. I believe this answers the question so I'll be closing the issue.


nixos/getty: mkdefault for etc/issue

Description of changes
You don't have to use mkForce to configure /etc/issue with environment.etc.issue.
Related to #194098
Things done
All I did was add mkDefault to the configuration for environment.etc.issue.

Built on platform(s)

[x] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

[ ] For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[ ] Tested basic functionality of all binary files (usually in ./result/bin/)
22.11 Release Notes (or backporting 22.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module
[ ] (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes

[ ] Fits CONTRIBUTING.md.

:+1: but you don't need to target staging for this. See the instructions in CONTRIBUTING.md on how to rebase.

Switched the target branch. Not sure why I did that originally.


Refresh Documentation to Use Spark 2.X concepts

Russ I pushed another commit with first-pass of some text edits. Next I'll go through and check the examples.

Build against Scala 2.11 finished with failure

Build against Scala 2.10 finished with failure

Build against Scala 2.11 finished with success

Build against Scala 2.10 finished with success


comment liking should be through Facebook?

I think endorsing each other comments is a very important component of the website but it shouldn't be done with FB Likes because it adds complexity and slows things down.

I agree, what do we gain from those FS likes?
@asaf-kali what do you think?

We intended on intergrating facebook because of other future planning, so if we already have it why not using it.
If we wont integrate facebook, we can remove this.


drag and drop in the right panel blocks copy-pasting error log

When I try to copy-paste errors from the log on right sidebar it tries to drag and drop elements there instead that is very annoying

how about using your brower console for now?
Chrome (cmd+alt+i) has filters by error/warning etc.
this sidebar needs to be rebuilt from scratch sime day...


[Grid] Automatic height adjustment (Responsive Layout)

Problem description
Hello,
I work on a dashboard and actually, it's look like this:

I do not know if it is wanted, but grid could automatically push the music card against that from above ! It's could be a great feature !
Thank,
Material UI: next

I have the feeling that what you are trying to accomplish can be implemented on userland and focus a niche, for those reasons, I'm closing the issue. Let's keep the code base simple.

I fully understand the fact that the basis of the code has remained simple, but the material specification declares: "Elements from a single-column format may reflow to fill the content area in various combinations."

But currently the best I can do with Grid is this:

Then I seriously think that a code can remain simple while having funtionalities

Maybe you are looking for a masonry library: https://masonry.desandro.com/layout.html.

Yeah, This is a good idea while awaiting native integration in Material UI If it comes one day :)
PS: Can you consider the reopening of the issue ?
Thank,

If you need help for integrate this feature, I think you can take support on the CSS code of the material  framework of Google here
Material ui is certainly the best set of React components !

I dont think that getmdl could do it, I havent checked but I am pretty sure that the link you provided is a static example. For dynamic content, I have seen it working only in  angular material 2 grid list or angular material 1 grid list. But they use a complex algorithm ...

Yep, you are right, but I never specified that the contents of the dashboard should not be static 😄
Apparently, material angular does very well what grid does not do... But with too complex logic !

Actually, from what I understand, that something you can already implement with the responsive break points of the Grid xs, sm, md, etc.
If you need something "100%" automatic then a masonry library will be better suited for you need but it is outside of the scope of the project.

But Material specifications for the grid ? As I explained in my previous comment ?
I do not understand how I could implement it with the breakpoints, the grid does not allow a modification of its size ! The problem is here !

Why the second music card can not go sticking to the "aperçu" card ? This is contrary to the material specification.
More generally, why grid does not leave the choice to the user to place his cards as he wishes ?
I hope you will understand my request, and that you will reopen the issue
And sincerely, I do not think this is outside the project, material.angular integrated it.

You can use the withWidth() higher order component to change the grid structure for the different breakpoints. The grid is a slim wrapper over the flexbox model, anything that this layout model is allowing to do can be achieved with the Grid component. Also, you can change the direction from row to column to have the wanted behavior.

Hum, I think I'll be able to cope, but if it is possible to add this example in the documentation for beginners asking the same question ?
I need to think about how I will implement my dashboard ... thanks for your help

I agree with @HelloEdit . This is a big problem to not be included in the grid. I feel kinda lame for ever using the Material-UI grid in the first place, because why would I want to use a grid that looks bad with ugly gaps most of the time and doesn't follow the Material-UI specifications?
I don't have a single grid in my app where I would want it to work like the Material-UI grid does and your grid documentation page was too simplistic, so I didn't realize this was a "feature" of your grid before discovering it in my app.
I did the same thing as @marco-silva0000 did in one instance, but it's an obvious hack and unless your items are all about the same size it's likely to look ugly at the bottom too.

w

Please reopen @HelloEdit I agree this is a huge problem, the provided "solution" is not satisfactory.
Moreover, as stated before, it does not follow material guidelines.
I understand you have a lot of work and your library is amazing, but this specific point is really problematic if you want to implement a fully responsive layout.

@oliviertassinari Potential here for an example layout...

Any progress on this?

Grid rowHeight property can be set manually or by default assumes to be 1:1. If we display a card inside which dynamic data are looped, then height is not adjusted.

Case 1, if card can hold 5 data and only two data are present the th card height is adjusted but grid remains to be 1:1.
Case 2, If the card can hold 5 values but 7 are present then the data is cut and never displayed on the screen.

Would something like this be what you want: https://codesandbox.io/s/p5v42zrrzm

@joshwooding Based on what I can see on my iPad, looks very good! Will check tomorrow on desktop.

It's powered by CSS grid so it can't be used everywhere

"Everywhere" currently being 88% (prefixed). Depending on your target market, be careful excluding the other 12%.

Masonry layout support in Grid would be awesome, in theory in theory using JS could work but not ideal  👍
css grid layout is not intended for this, see: https://github.com/w3c/csswg-drafts/issues/945

A temporary solution will be creating columns as you want and spreading them
for example
here i have two columns and divide them if their key is odd
and 1 main grid with all in one column for mobile
i hide the first one on smDown
and hide the main in mdUp

Some news about this?

When it's easier to just use flexbox surely there must be a problem.

@CloudNineK Flexbox doesn't solve this problem (Grid is flexbox based). You need to use a masonary library if you wish to distribute content evenly between a varying number of columns.

I would just like to chime in saying that I would like to have see some sort of masonry functionality from MUI as well. Maybe not change MuiGrid to support the functionality, but maybe add a new component that supports it instead. As such, I drew up a crude component to wrap MuiGrid for a Masonry effect. I hope that this can maybe be a start to creating a component?
Here it is for those interested: https://codesandbox.io/s/masonryplusmui-xk8rr?fontsize=14
Of course there's problems though. The way it works currently works is that it takes predefined breakpoints (I pull that from theme.breakpoints.values) and it calculates how many columns to make based on that. I know that's not how any of MUI's components behave, but at this point, I could really only set the width of an entire column with this method.

@weiluntong That also is a possible solution however I don't think it's elegant
maybe someone should fork the lab and make a pr or a proposal for this as a new component

@nikandlv I completely agree with you. Currently the thing is in a sort of limbo where it's not quite MUI nor is quite a Masonry layout. I'd be more than happy to create a component and make a PR. In fact, that's what I was hoping would be my end goal here, but I created the sandbox because I wasn't sure where I'd start. Again, I was hoping it might be a start? Or am I completely left field as to the base structure of the component? I'd love input to get me going.

@weiluntong I think you are on the right track with the component, it probably needs a bit more work. however, you should ask the maintainers if they want this as a part of MUI or just as a library you can publish
and as https://github.com/mui-org/material-ui/blob/master/CONTRIBUTING.md says

When submitting a new component, please add it to the lab.

https://github.com/mui-org/material-ui/tree/master/packages/material-ui-lab

We would need more upvotes on the issue to consider solving the problem.

If @weiluntong you still feel you got the time to prepare a proposal, I might cast my vote towards a separate dedicated masonry component. Might be the easiest option for maintenance, and use.

I was using the react-virtualized Masonry component. However, react-virtualized is not working with the latest babel and core-js. It appears its successor react-window is also unlikely to include a Masonry component. Perhaps the react-virtualized Masonry component could be updated and adopted into material-ui?

I wouldn't mind putting together a proposal where we can consolidate upvotes. Is there a proposal template I should use?

@weiluntong i guess as https://github.com/mui-org/material-ui/blob/master/CONTRIBUTING.md you should submit an issue and describe the component request there and ask for upvotes

@weiluntong There is a template when you create a new issue.

Correct me if I am missing something, but I was able to solve what appears to be this exact problem by applying this solution from stack overflow.
Simply apply height: 100% to the children of Grid items.
https://stackoverflow.com/questions/50743402/material-ui-grid-item-height

Thats not the case @dylanmartin we don't want it to stretch out we want the next row fill that gap!

Closing for #17000


Implement access to neuron global variables.

What's meant is things like celsius.

Codecov Report
Attention: Patch coverage is 40.00000% with 6 lines in your changes are missing coverage. Please review.

Project coverage is 86.57%. Comparing base (b99ad62) to head (4b22a65).
Report is 1 commits behind head on master.

Files
Patch %
Lines

src/codegen/codegen_neuron_cpp_visitor.cpp
40.00%
6 Missing :warning:

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1192      +/-   ##
==========================================
- Coverage   86.60%   86.57%   -0.03%
==========================================
  Files         175      175
  Lines       13009    13017       +8
==========================================
+ Hits        11266    11270       +4
- Misses       1743     1747       +4

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


rotaryencoder: Improve rotary encoder behaviour.

Increase the priority of the foreground task so that
when interrupts fire, we handle them quickly enough to
mostly never miss the values.
Catch rising edges as well as falling, so we don't miss
code values.
Ignore spurious wakeups where the pins haven't changed,
since reading the ADC fires our GPIO interrupt for some
reason not yet understood.
Reverse the direction of the rotary encoder - clockwise is
increment, and anti-clockwise is decrement.

I'd like to move the rotary encoder state machine into the interrupt handler itself - that'll reduce overall burden. The spurious interrupt wakeups are curious. I think I need to put the IoTuz on a scope and check whether the ADC reads for the joystick are actually affecting the GPIO pins somehow - otherwise it seems like it might be a silicon bug.


[Launcher] Context menus need to be in same spot

Copy path and open file location buttons are in different spots for files vs apps. They need to be in the same spot for all results.

@ryanbodrug-microsoft is this fixed?

yes it feels like it is


Issue in the ex3.1 with types

Hi all,
after I've added the code snipet for the Dynamic Page in the ex.3.1, I receive the following error in the main.controller.ts file:
Conversion of type 'UI5Element | undefined' to type 'FilterBar' may be a mistake because neither type sufficiently overlaps with the other. If this was intentional, convert the expression to 'unknown' first.
Type 'UI5Element' is missing the following properties from type 'FilterBar': getActiveFiltersText, getCurrentVariantKey, getFilterFieldEnabled, getFilterFieldVisible, and 9 more.ts(2352)
Could you advise what's missing? While creating managetravles app, the latest version of TypeScript was chosen.
Regards,
Ivan

solved it myself. FilterBar was allready declared in previous ex2 and now, in ex3, its definition is different. I missed the piece of code for main.view.xml in ex3 with the new FilterBar definition and after I copied it, replacing the previous content for DynamicPage in main.view.xml, everything worked.

ady declared in previous ex2 and now, in ex3, its definition is different. I missed the piece of code for main.view.xml in ex3 with the new FilterBar definition and after I copied it, replacing the previous content for DynamicPage in main.view.xml, everything worked.


[WIP] option to disable union_helper

imo we should be able to explicitly call try to not use a union helper for say, performance.
original motivation: i dont want to rewrite test/missing_unionfs_mergerfs.sh to handle removing it in nix

[X] disable union_helper option in try

Recording our conversation from yesterday: I think disabling this isn't so helpful if we don't have a workaround. It's more useful right now to try to figure out why we need the fallback---especially for the performance-degrading cases with /etc and /usr---and to dig in to alternative support options for, e.g., bind mounts.
Also... there's already a way to disable the union helper: by taking it off your path.


Fix CDN in flight request header name config

Changes

[!WARNING]
This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

Current dependencies on/for this PR:

main

PR #433

PR #434

PR #435   👈

This stack of pull requests is managed by Graphite.


Page Layouts Pane Karma Tests

Summary

Adds basic karma tests to page layouts pane for the standard flows to apply and confirm page layouts.
Relevant Technical Choices

To-do

[ ] attempt removing fixture timeout by making sure page layouts don't load until tab becomes active

User-facing changes

Testing Instructions

Karma tests only

Fixes #5987

🎉

🎉

Current status: This PR passed with a 5000ms timeout on the media elements fixture expectation. I discovered on friday though that page layouts are loading before the pane is clicked on which is likely contributing to slowness that requires tests to have an increased timeout. I spent some time trying to use isActive to get page layouts pane to defer loading page layouts until it’s active which was straight forward, but something weird was going on with styles or something because I could see everything in the DOM but not visually.
I think making the upgrade to defer loading until active and creating a consistent plan for deferred loading between page layouts pane pane, text pane (that defers with {paneRef.current && <TextSets paneRef={paneRef} />}), and media3p pane that uses isActive.

Current status: This PR passed with a 5000ms timeout on the media elements fixture expectation. I discovered on friday though that page layouts are loading before the pane is clicked on which is likely contributing to slowness that requires tests to have an increased timeout. I spent some time trying to use isActive to get page layouts pane to defer loading page layouts until it’s active which was straight forward, but something weird was going on with styles or something because I could see everything in the DOM but not visually.
I think making the upgrade to defer loading until active and creating a consistent plan for deferred loading between page layouts pane pane, text pane (that defers with {paneRef.current && <TextSets paneRef={paneRef} />}), and media3p pane that uses isActive.

@zachhale Thanks a lot for your investigation here!
Totally agree that  loading should be deferred there. I flagged this back in September already (#4634), now with text sets and page layouts it becomes more important.
#4433 showed that it's also of relevance for the individual media tabs within the media pane.