Use messages to drive tasks

This is adapted from https://github.com/OpenDevin/OpenDevin/pull/1646. It removes the change to CodeAct's prompt, but sets us up to add the <finish> command when ready
The main change here is that instead of having a core main_goal in the State object, we let the agent parse through user messages. Most agents are now defaulting to the most recent user message as the goal.
When the agent finishes, the user can now send a new message (e.g. asking for a tweak) which will preserve session history

One comment: it might be a bit rough to summarize the entire user intent into "latest user message". The latest user message may be a clarification message or something that isn't actually the full intent. I don't think this needs to be fixed in this PR, but maybe we could open a tracking issue to discuss more about how to summarize the user's intent when they have provided multiple messages?

Yeah this is totally true. CodeAct handles it just fine--the microagents not so much.
Will definitely take another pass at this in a future PR

Re: inheritance, I added some more notes to the docstring on Plan.
Ultimately, we have a tree structure representing the agent's plan, e.g.
Do x
Do x'
Do x''
Do x''1
Do x''2
Do y
Do y'
Do y''
Do z
What's odd about this data structure is that the top-level is a list, not a single node. So to hold onto it, we need a sort of invisible root node. That's where Plan comes in.
Plan needs to be the same type as every other node, so that parent references work nicely. But it's also a special node that doesn't contain any information itself, hence the subclassing.

We need to e.g. override the __init__ so that it doesn't try and set an id etc

What about something like this?
    def __init__(
        self,
        parent: 'Task' | None,
        goal: str,
        state: str = OPEN_STATE,
        subtasks: list = [],
    ):
        """Initializes a new instance of the Task class.

        Args:
            parent: The parent task, or None if it is the root task.
            goal: The goal of the task.
            state: The initial state of the task.
            subtasks: A list of subtasks associated with this task.
        """
        if parent is None:
            self.id = ''
        elif parent.id:
            self.id = parent.id + '.' + str(len(parent.subtasks))
        else:
            self.id = str(len(parent.subtasks))
        self.parent = parent
        self.goal = goal
        self.subtasks = []
        for subtask in subtasks or []:
            if isinstance(subtask, Task):
                self.subtasks.append(subtask)
            else:
                goal = subtask.get('goal')
                state = subtask.get('state')
                subtasks = subtask.get('subtasks')
                self.subtasks.append(Task(self, goal, state, subtasks))

        self.state = OPEN_STATE

then for Plan we call Task(None, '', OPEN_STATE, subtasks)?

That works!
The bigger issue I think are the helper methods that are defined on Plan: get_task_by_id, add_subtask, and set_subtask_state. Calling these on a non-root Task would likely cause problems.
Two things I could do:

Make these normal functions, instead of class methods, which take in a task param
Put an assert at the top of the function making sure the task it's called on is a root task

The downside is we lose type safety--the code can call those functions on a non-root task, and we'd just get a runtime error.
WDYT?

Thanks @rbren , I think the "assert" thing should probably be fine for now?
And I feel that (eventually, not in this PR) we might even be able to just set this up so there's not really any distinction between a top-level plan and a task at all. After all, tasks themselves can also have subtasks. I don't think there's anything really all that special about the one at the top of the hierarchy versus the ones in the middle of the hierarchy.

I wonder if you could have a base class, e.g. TaskNode, that a Task inherits from. Then the parent node is a TaskNode, and most of the planning items are of class Task.

we might even be able to just set this up so there's not really any distinction between a top-level plan and a task at all. After all, tasks themselves can also have subtasks.

agree with @neubig on this part

Two things I could do:
Make these normal functions, instead of class methods, which take in a task param

Is it possible to maintain some sort of registry that hosts all these tasks - similar to what we are doing with Agent classes now, but not name them as Plan? Maybe like a TaskManager, and the sole purpose of that class is to manage the life-cycle of a Task.

🤔 what if we just rename Plan to RootTask?

I'd be OK with this, especially if it unblocks your work. But in principle:

I'm not super-convinced that Plan is different enough from Task that it's worth separating them in the first place
Plans are often hierarchical, such as in Step, and it's not clear that we should only allow Plan-style Tasks in the root node.

^Same here. I'd hope Task themselves do not distinguish from each other (e.g., a tree node), but I'm fine with having a separate class managing all existing tasks (e.g., renaming Plan to TaskManager).


[bug] If Bun lockfile is malformed, moon fails without a meaningful error message

Describe the bug
For some reason, my Bun lockfile was malformed. So the command bun bun.lockb was failing:
error opening lockfile: ENOENT

Because of this, when running moon ci, moon was failing without any meaningful error message. The only thing that happened was the early output showing the rest of the task pipeline as failed.
I realized this because I enabled debug and found the last command to run is the bun bun.lockb command.
Steps to reproduce

Have a malformed bun.lockb file
Do moon ci
Pipeline will fail

Expected behavior
This happens a lot in package upgrade PRs done by renovatebot or dependabot. I expected to have a more meaningful error so we could easily solve the lockfile issue.

I'm almost positive this error is actually from Bun itself and not moon, so moon is just displaying it's stdout/stderr.

But moon is not displaying this. This would be a good lead to identify the problem on the lockfile. I could only see the command on the debug logs.
For now I switched to yarn lock outputs to avoid issues so moon doesn't run this command.
Actually I'm not sure why this command is being run in the first place.

bun bun.lockb returns the lockfile in YAML format so that moon can parse it to resolve versions/hashes/etc.
Let me try and bubble the error up if it isn't in some cases.

Try 1.28.1 and see if that works.

Still didn't work. I sent you logs in DM in discord.
bun bun.lockb is working fine now. But same behaviour is still happening. B y running an individual task, I managed to identify one underlying error that is not appearing on trace logs.
The error is related to the parsing of the text file that bun outputs.

Try 1.28.2.


Implement Hyperlocal network transport switching/discovery

Instead of thinking about infrastructure only, networks, data, service, capabilities  are all hyperlocal.  Start thinking in terms of the overlapping of network transports and types of networks that are found.  You should be able to discover the network transport sources and distinguish between the hyperlocal range (1-1000+) and use this as a mechanism for filtering, and also handling context switching:
Hyperlocal context range

1 feet  (personal area network)
3 feet (personal area network)
5 feet (hyperlocal networks)
10 feet (hyperlocal networks)
30 feet (hyperlocal tidal zone to infrastructure networks)
50 feet (infrastructure networks)
100 feet (infrastructure networks)
300 feet (infrastructure networks)
1000 feet (wide area network)
1000+ feet (Metro area networks)

Scenarios

move from house to car
move from downstairs in house to upstairs
move from home to work
move from outside street to a starbucks

In every case the networks available and service will change.
So in the cases above, how would we manage : security, advertisement of services, discovery of services, utilization of services.

In the spirit of AI, AI needs contextual awareness badly.   Contextually aware devices can do a better job at not doing a bad job at asking for the right things from AI models and Agents.


🐞 [Bug]: When the account doesn't have ssh in the metadata key, it crashes while loading the micro vm component (Maximum call stack size exceeded)

Is there an existing issue for this?

[X] I have searched the existing issues

which package/s did you face the problem with?
Dashboard
What happened?
When the account doesn't have ssh in the metadata key or (doesn't have the metadata key at all), it crashes while loading the micro vm component (Maximum call stack size exceeded)
Steps To Reproduce

Remove the metadata key using client or polkadot
Login into the dashboard
Go to micro VM page

which network/s did you face the problem on?
Dev
version
76de2278f0c335891d5a08626f4b5427270665a2
Twin ID/s
No response
Node ID/s
No response
Farm ID/s
No response
Contract ID/s
No response
Relevant screenshots/screen records

dashboard.log
Relevant log output
-

That issue might be related to the reading of the SSH keys, but I believe it can be resolved at https://github.com/threefoldtech/tfgrid-sdk-ts/issues/2666.


phoneNumber.verify() doesnt set phoneNumberVerified to true ?

so iam calling the phoneNumber.verify() function in my app, and when checking the database i see that the phoneNumberVerified column is still FALSE beside the OTP code being correct
  await phoneNumber.verify({
      phoneNumber: value,
      code: data.otp
  })

OS: Arch Linux
Browser: Firefox
Version: ^0.8.2

does the API return a success message?

not currently on my device
but in my auth.ts file i made the signUpOnVerification option to be true
and on verifying the code it did create a user in the database
so i guess it did return a success message

I'm asking if error is returned here
const { data. error } = await phoneNumber.verify({
      phoneNumber: value,
      code: data.otp
  })


Expired certificate on e14n.com makes the pump.io website painful/scary to browse

Hi,
The official pump.io website has a news to a Security Alert that is hosted on e14n.com, and my browser prevents me from visiting it (easily) as the certificate is expired since 10/21/2016. For a better potential-user experience, would it be possible to get a correct certificate, or host the content on the same domain?

Thanks for pointing this out; I just sent mail to Evan letting him know.
Unfortunately there isn't much else we can do.

e14n.com has been down for a while and I believe @evanp has switched to just using identi.ca anyway. Plus the XSS thing hasn't been on the homepage for a long time. Closing.


Improve QUnit simulation / testing

The way QUnit is tested does not trigger the proper callbacks, this needs to be improved

Isolated the endpoints and did proper unit testing in version 2


[ASCII-2214] Replace GUI URL target from <IP_ADDRESS> to localhost

What does this PR do?

This PR fix some issues preventing the Agent GUI from opening on Internet Explorer:

it replaces GUI server host from hard coded value <IP_ADDRESS> to a configurable GUI_host value (default to localhost). This is made configurable in case the customer want to set it explicitly on IPv4 or IPv6.
It remove Internet Explorer unsupported characters

Motivation

Internet Explorer categorizes sites by their URLs into different security zones (Internet, Intranet, Trusted Sites, Blocked Sites). Each category is assigned a specific security level, which determines the features that are blocked or allowed.
By default, all sites fall into the Internet category, which has the highest security level. The Intranet category, with a lower security level, automatically includes URLs like http://system, http://localhost, and https://localhost.
Since the agent is opening the web browser at http://<IP_ADDRESS>, the GUI is treated as an Internet site, preventing it from setting cookies.
The simplest solution is to use http://localhost instead of http://<IP_ADDRESS> when opening the browser, allowing cookie setting through HTTP header responses by default.
Describe how to test/QA your changes

QA done manually on Windows Server 2019 using Internet Explorer.

/merge


Fixing typos

Spam.

Or trying to help you guys correct a type.  Look at the MIT link.  Software licenses are clearly spelled license, not licence.

We're British.


Missing Alert Schema for Azure Budgets

Not sure why #33841 was closed. Other docs seem to promote and push people to use the common alert schema and yet the definition is difficult to find. It should be here with other schema definitions for alerts like this. Can you copy the schema buried deep in this doc and properly house it here as well? There would be less of a need for this if there was a way to 'test' any alert across azure to send the payload on demand.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 7e4d20cc-b693-ee2d-2694-832b455376a6
Version Independent ID: 7b929793-dba5-8f94-e44f-7dace50ee018
Content: Alert schema definitions in Azure Monitor - Azure Monitor
Content Source: articles/azure-monitor/platform/alerts-common-schema-definitions.md
Service: azure-monitor
Sub-service: alerts
GitHub Login: @ofirmanor
Microsoft Alias: robb

@JohnKeippel Thanks for the feedback.
Assigning @ofirmanor @rboucher for visibility, review and document enhancement consideration.

#label:"CreateAzMonWIFeb2021"
Still a problem.

Thank you for your contribution to the Azure Monitor documentation. We have created a workitem for this issue in our internal backlog database. We will prioritize it and make any necessary changes as we are able.
#please-close


Silent renew of tokens do not work

I am using latest version of the package @axa-fr/react-oidc.
My requirement is to refresh access and I'd tokens, before the session expires if the user is actively using the application.
So, as pert of oidc configuration I have added  refresh_time_before_tokens_expiration_in_second:300,
and token_automatic_renew_mode:TokenAutomaticRenewMode.AutomaticBeforeTokensExpiration, even then the token renew doesn't happen silently, instead after session expiry, "Session lost" component is rendered.
I tried with service worker and without service worker, either way it didn't help.
Could you please let me know how to renew tokens(with/out sevice worker) without disturbing user activity

hi @nandeeshwar-p ,
thank you for your issue. DO you have a sample of your configuration?
To refresh token, you should avec scope : access_offline or use silent signin.

hi @nandeeshwar-p you manage to make it works?

Hi @guillaume-chervet , thanks for your response...
Not yet... trying out other options
BTW, to debug the issue further, may I know how to refer to the code under "src" folder instead of "dist" folder

@guillaume-chervet thanks for the response... How do we use silent signin, could you please share the example link or a code snippet....

Hi @nandeeshwar-p , did you tried the demo?
https://github.com/AxaFrance/oidc-client/blob/main/examples%2Freact-oidc-demo%2Fsrc%2FMultiAuth.tsx
It contains many example. Which framework are you using?

Code snippet related to my implementation

With this in palce, a call is made to fetch token with the code as null,and eventually it fails


Update History structure

This causes a bug because we don't have original_requester entry in FlicketHistory - will have to update to keep history data-full
        if ticket.requester != requester:
            history = FlicketHistory(
                original_requester=ticket.requester,
                topic=ticket,
                date_modified=datetime.datetime.now(),
                user_id=history_id,
            )
            db.session.add(history)

this looks fixed (?)


fix: bail-out from async createLottie after unmount

Description
Without this we might end up with a warning in older versions of React:

Warning: Can't perform a React state update on an unmounted component. This is a no-op, but it indicates a memory leak in your application. To fix, cancel all subscriptions and asynchronous tasks in the componentWillUnmount method.

Type of change

[x]  Patch: Bug (non-breaking change which fixes an issue)

Checklist

[x] This is something we need to do.

Bump for stale bot

Bump

Bump


skeleton-typescript Visual Studio project

This allows to work, compile and execute skeleton-typescript from Visual Studio. Tested in VS2013 and VS2015.
To compile ts from VS without errors, the duplicated types in typings/main/ambient has been removed.
Currently the project build does not copy the modified html files to /dist folder. I use to work in VS in combination with "gulp watch" as the server, so it updates this modified files.

I don't think this is the right way to approach the issue because it breaks the tsconfig.json for other editors, I'd be willing to listen to why but perhaps this makes the most sense as a fork that we can reference from the docs as long as it is maintained that does some very visual studio specific things.  Thoughts?

Yes, the typescript skeleton is a platform agnostic setup. It shouldn't have a bunch of VS stuff in it. For VS, we have the asp.net skeletons for now. In the future, when we have a project wizard we can have some more variations.


Feature request: Provide an option to split the dom in a convenient way

I think it's a very good idea the usage of this library to generate a pdf file of the HTML DOM, without generate a non vector image. Because currently generate a non vector image is the only way of how we can generate a pdf of the DOM in js. Please see:
https://github.com/MrRio/jsPDF/issues/3222
So, one feature that we probably need to achieve this goal is the ability of generate an svg per PDF pages and this then will required split the svg in several svg with the corresponding size of the pdf page.
One basic and initial idea to split the svg could be just cut it where we can and another much more complex will required enumerate all possibilities and evaluate the better approach later. I think the print setting of Firefox and Chromium should provide a good idea of how to split the things.

Probably the pagination technique can be implemented in one of this ways:
https://github.com/yWorks/svg2pdf.js/issues/37


fix: Set correct peerDependency on gatsby

Hello @jariz @JoshuaWalsh, Gatsby maintainer here 👋
While looking at your plugin I noticed that the peerDependency on gatsby is set incorrectly. We're in the process of providing more helpful information on the /plugins page of our website and for that we need plugins to set their peerDependencies correctly/more specific.
At the moment you say that any version (v3, v4, v5, v6, etc.) will work with this even when in between we'd introduce breaking changes.
Making it more explicit is the safer choice (in the future you'll be able to mark breaking changes with explicit version ranges) and will allow us to display the plugin as compatible to versions X, Y, Z.
Thanks!

Hi @LekoArts ,
Thanks very much. I believe that our plugin does work on all currently released versions of Gatsby above >2.0.0-alpha, but obviously we can't guarantee that a breaking change in future won't cause issues.
We're having some issues with our automated tests at the moment, they seem to be caused by an issue with Snyk. I know that changing peerDependency shouldn't have an effect on the test results, but I'd like to fix the issue with our tests before I merge this PR.
While you're here, would you mind taking a look at gatsbyjs/gatsby#27988 for us? We need a response from the Gatsby Core team in order to proceed.
Thanks,
Josh

No problem! :)
I've resurfaced this internally and will see that you get an answer :)


Technical Deep Dive: Data Availability Sampling (DAS) in Avail

Target Audience: Developers with a strong understanding of blockchain technology and an interest in the inner workings of Avail's data availability layer.
Overview:
This deep dive will delve into the intricacies of Data Availability Sampling (DAS), a core component of Avail's data availability layer. We'll explore the theoretical foundations of DAS, its implementation details in Avail, and its advantages and limitations compared to alternative approaches.
Key Sections:
Introduction to Data Availability in Blockchains: I would briefly explain the importance of data availability in blockchains and the challenges it poses, particularly for scalability.
DAS Fundamentals: I would explain the core concepts behind DAS, including random sampling, error correction, and cryptographic verification by providing mathematical formulations and illustrative examples.
DAS in Avail: I would describe how DAS is implemented in Avail, including the specific sampling scheme, error correction mechanism, and verification process. Highlight key design choices and their implications.
Security Analysis: I would discuss the security properties of DAS in Avail, addressing potential attacks and mitigation strategies. Analyze the trade-offs between security and efficiency.
Comparison with Alternative Approaches: I would compare DAS to other data availability techniques like full data replication and erasure coding. I would also discuss their respective advantages and disadvantages in the context of Avail.
Future Directions: Briefly mention ongoing research and development efforts related to DAS, including potential optimizations and integrations with other technologies.
Introduction to Data Availability in Blockchains: The Cornerstone of Trust
Imagine a vast network of computers, each holding a copy of a digital ledger – a blockchain. This ledger records transactions and agreements, forming the backbone of revolutionary technologies like cryptocurrencies and decentralized applications (dApps). But for this system to function effectively, one crucial element is paramount: data availability.
Data availability ensures that everyone participating in the network has access to the same information, guaranteeing the integrity and trustworthiness of the blockchain. Without it, the entire system crumbles. Consider this analogy:
Imagine downloading a movie through a peer-to-peer network. If each participant doesn't have the complete file, you might end up with a corrupted or incomplete version. Similarly, in blockchains, if participants lack complete or verifiable data, the entire system becomes susceptible to manipulation and fraud.
Challenges of Data Availability:
As blockchains grow and transaction volumes increase, ensuring data availability becomes increasingly challenging. Here's why:
Storage burden: Storing the entire blockchain history on every node can be impractical, especially for resource-constrained devices.
Scalability: As the network expands, replicating data across all nodes becomes inefficient and hinders scalability.
Network disruptions: In case of network outages or malicious attacks, data availability can be compromised if nodes lose access to specific blocks.
Approaches to Data Availability:
Several techniques address these challenges, each with its own advantages and limitations:
Full data replication: Every node stores a complete copy of the blockchain, ensuring maximum data availability but at the cost of high storage requirements and limited scalability.
Erasure coding: Divides data into fragments and distributes them across nodes. While more efficient than full replication, it requires complex reconstruction mechanisms in case of missing fragments.
Data availability sampling (DAS): A technique used in Avail, DAS leverages random sampling and cryptographic verification to ensure data accessibility without storing the entire block. We'll delve deeper into DAS in the following sections.
DAS Fundamentals: Unveiling the Magic of Randomness and Code
Imagine yourself on a bustling treasure hunt, not for gold and jewels, but for the key to unlocking trust in a vast digital network. This network, like the blockchain, holds valuable information within its treasure chests – the blocks. But instead of lugging around the entire chest everywhere, DAS empowers us to use clever tricks, a dash of randomness, and a sprinkle of code to access what we need.
Think of DAS as a game of hide-and-seek with data:
The chest (block) holds a trove of information, but instead of revealing it all, we strategically hide tiny pieces – the samples.
These samples, chosen like puzzle pieces, hold fragments of the original data. But here's the twist: anyone can join the game!
To ensure everyone plays fair, we use a secret code inscribed on each piece, like a personalized fingerprint. This code, verified against a master key, guarantees its authenticity and protects against imposters trying to sneak in fake pieces.
But how do we know we have enough pieces to win?
Here's where the magic of error correction comes in. By choosing the right pieces (often using mathematical codes like polynomials), even if a few go missing, we can still reconstruct the complete picture with impressive accuracy.
Imagine a chest with 1,000 pieces:
DAS might select just 100 random pieces for each player. Even if 10% vanish due to network hiccups, the remaining 90, armed with their error-correcting abilities, can help us rebuild the entire treasure with remarkable precision.
Want to see it in action?
# Sample selection (like polynomial codes)
def find_hidden_pieces(treasure, clues):
    # Generate secret codes for each clue
    secret_codes = [random.randint(1, 100) for _ in range(clues)]
    # Use the codes to find hidden pieces from the treasure
    found_pieces = [treasure[i] * secret_codes[i] for i in range(len(treasure))]
    return found_pieces

# Error correction (like piecing things together)
def rebuild_treasure(found_pieces, missing_spots):
    # Use remaining pieces and their locations to guess the missing ones
    rebuilt_treasure = [0] * len(treasure)
    for i, piece in enumerate(found_pieces):
        for missing_spot in missing_spots:
            rebuilt_treasure[missing_spot] ^= piece * secret_codes[i]**(missing_spot - i)
    return rebuilt_treasure

The real code involves more complex codes and advanced security measures.
DAS Implementation in Avail
Remember the treasure chest analogy? In Avail, each block is like a treasure chest, holding valuable transaction data and state updates. But unlike traditional blockchains where every node stores the entire chest, Avail leverages DAS to achieve remarkable efficiency and scalability.
Here's how DAS unfolds in Avail:

Block Encoding and Sampling Algorithm:

Reed-Solomon Encoding: Each block undergoes encoding using a specific Reed-Solomon code (e.g., RS(2k, k)), dividing the data into k data shards and generating an additional k parity shards. These codes ensure that even with a small number of randomly chosen samples (puzzle pieces), the complete data can be reconstructed with high accuracy.
Sample Selection: Light nodes employ a pseudorandom number generator (PRNG) seeded with a block-specific value to select a predetermined number of samples (s) from each polynomial (data and parity). Light nodes rely on DAS to extract the specific information they need.
Sample Sharing: Selected samples are not only stored locally but also shared with peers through the P2P network using a gossip protocol. This ensures wider distribution and redundancy.

Data Retrieval and Verification Process:

Missing Sample Retrieval: When a light node requires missing data, it follows these steps:
Local Check: First, it attempts to locate the missing sample in its local storage.
Peer Query: If not found locally, it broadcasts a request to its peers in the P2P network, specifying the missing sample information.
Response Aggregation: The light node collates responses from multiple peers containing the requested sample.
Data Reconstruction: Having retrieved enough samples (k out of 2k for data, s out of k+s for parity), the light node uses the Reed-Solomon decoder to reconstruct the missing data efficiently.
Proof Verification: Additionally, the light node receives cryptographic proofs (e.g., Merkle proofs) from the responding peers. These proofs allow verification of the sample's authenticity and inclusion in the original block without downloading the entire block.

Network Resilience and Security Mechanisms:

Decentralized Sample Storage and Retrieval: By distributing samples across light nodes, Avail avoids dependency solely on full nodes. Even if some full nodes are unavailable, data remains accessible through samples stored and shared among light nodes.
Threshold Security: Based on the chosen Reed-Solomon code parameters and sampling rate (s), a minimum number of honest nodes (threshold) is guaranteed to reconstruct data correctly, even if some nodes are malicious or unavailable.
Challenging Mechanism: Light nodes can initiate challenges against suspicious proofs. This requires the challenged node to provide additional information justifying the validity of the proof, deterring malicious actors from creating false proofs.

Advanced Features and Optimizations:

Dynamic Sampling Rates: Based on network conditions and security requirements, the sampling rate (s) can be dynamically adjusted. Higher rates enhance security but increase bandwidth consumption.
Incentivization: Avail's token can incentivize light nodes to participate in DAS by rewarding them for providing samples and responding to queries. This encourages network participation and data accessibility.
Advanced Cryptography: Avail leverages advanced cryptographic techniques like BLS signatures and Merkle proofs for efficient and secure verification within the DAS scheme.
Fault Tolerance Mechanisms: Additional mechanisms like erasure coding and Byzantine Fault Tolerance (BFT) consensus can be integrated with DAS to further enhance data availability and resilience against malicious attacks.
Benefits of DAS in Avail:

Scalability: By eliminating the need for every node to store the entire blockchain, Avail achieves unmatched scalability, enabling faster transactions and wider participation in the network.
Efficiency: Users with limited resources can easily participate in Avail using light nodes, reducing storage requirements and bandwidth consumption.
Security: The combination of DAS and advanced cryptography ensures data integrity and protects against malicious attacks.

Security Analysis of DAS in Avail: Balancing Efficiency and Trust
While DAS empowers efficient data availability in Avail, ensuring its security is paramount. Let's talk about security considerations and mitigations within DAS:
Potential Threats:
Sybil Attacks: Malicious actors might attempt to create a large number of fake nodes to disrupt the network or manipulate data availability proofs.
Denial-of-Service (DoS) Attacks: Flooding the network with invalid requests can overwhelm nodes and hinder their ability to verify data samples.
Data Tampering: Malicious actors might try to inject false data into samples or manipulate availability proofs to compromise data integrity.
Mitigations in Avail:
Proof-of-Stake Consensus: Avail utilizes Proof-of-Stake (PoS) consensus, where node influence is linked to stake, making Sybil attacks more expensive and resource-intensive.
Rate Limiting: Limiting the number of requests a node can make helps mitigate DoS attacks.
Cryptographic Verification: Merkle trees and digital signatures ensure the authenticity and integrity of data samples and proofs, preventing tampering.
Random Sampling: The randomness inherent in sample selection makes it difficult for attackers to predict and manipulate specific pieces of data.
Error Correction: Reed-Solomon codes offer inherent resilience against missing or corrupted samples, reducing the impact of malicious attempts.
Security Trade-offs:
Balancing efficiency and security is crucial. Reducing the number of samples increases efficiency but might slightly reduce data reconstruction accuracy and vulnerability to missing samples.
Avail continuously optimizes these parameters to achieve a secure and efficient balance.
Ongoing Research:
Security in DAS is an active research area. Avail actively explores avenues like:

Advanced cryptographic techniques: Utilizing zero-knowledge proofs for more efficient verification and stronger guarantees.

Post-quantum cryptography: Ensuring security against future advancements in cryptanalysis.

Formal verification: Rigorously verifying the security properties of the DAS scheme and its implementation.

Engaging the Community:
Avail fosters a transparent and collaborative security approach. The community plays a vital role in:

Bug bounty programs: Identifying and reporting potential vulnerabilities.

Security audits: Collaborating with external security experts to ensure comprehensive analysis.

Open-source development: Encouraging open review and contribution to the codebase.

Comparing DAS to Alternative Approaches: Striking the Right Balance
Data availability is a crucial challenge in blockchains, and various techniques address it with distinct advantages and trade-offs. Let's compare DAS in Avail to two common alternatives:

Full Data Replication:

Description: Every node stores a complete copy of the blockchain, ensuring maximum data availability but requiring significant storage and bandwidth.
Comparison with DAS:
Advantages: Highest data availability guarantee, no reliance on complex verification mechanisms.
Disadvantages: Unscalable for large blockchains, high storage and bandwidth requirements, limits node participation.
Suitability: Used in small, permissioned blockchains with limited participants.

Erasure Coding:

Description: Data is divided into fragments and distributed across nodes. Lost fragments can be reconstructed using error correction codes.
Comparison with DAS:
Advantages: More efficient than full replication, offers some fault tolerance.
Disadvantages: Complex reconstruction mechanisms, potential security vulnerabilities in specific code implementations.
Suitability: Used in some public blockchains, but security concerns limit widespread adoption.
DAS in Avail:
Advantages: Achieves high data availability and scalability with efficient light nodes, provides strong security guarantees through cryptography, actively researched and constantly improved.
Disadvantages: Slightly lower data availability guarantee compared to full replication, requires more complex verification mechanisms than erasure coding.
Choosing the Right Approach:
The choice of data availability technique depends on specific blockchain use cases and priorities. Some key considerations include:

Scalability: DAS excels in scalable solutions with large participation.

Efficiency: DAS balances efficiency with strong security compared to full replication.

Security: DAS prioritizes security through cryptographic verification.

Future Directions of DAS in Avail: Charting the Course for Innovation
DAS, as a cornerstone of data availability in Avail, is constantly evolving. Let's explore some directions for its future development:

Optimizing Efficiency and Security:

Adaptive sampling: Tailoring the number of samples based on network conditions and data sensitivity, balancing efficiency and data reconstruction accuracy.
Lightweight cryptography: Implementing more efficient cryptographic primitives for verification without compromising security.
Advanced error correction codes: Utilizing newer codes with improved error correction capabilities and faster reconstruction times.

Enhanced Security:

Post-quantum cryptography: Integrating post-quantum cryptography algorithms to ensure resilience against future advancements in cryptanalysis.
Formal verification: Rigorously verifying the security properties of the DAS scheme and its implementation through formal methods.
Multi-party computation (MPC): Utilizing MPC for distributed verification and data reconstruction, potentially improving efficiency and security.

Integration with Other Techniques:

Hybrid approaches: Combining DAS with erasure coding for specific use cases, potentially offering increased fault tolerance and flexibility.
Data sharding: Integrating DAS with sharding protocols for efficient data availability in sharded blockchain environments.
Interoperability: Enabling interoperable data availability across different blockchain platforms, fostering broader collaboration and innovation.

Community-Driven Research:

Open-source development: Encouraging active community participation in research, development, and code review.
Bug bounty programs: Rewarding researchers and developers for identifying and reporting security vulnerabilities.
Collaborative research initiatives: Partnering with academic institutions and other blockchain projects to advance the state of data availability research.

Emerging Applications:

Decentralized finance (DeFi): Enabling secure and efficient DeFi applications with high data availability for financial transactions.
Decentralized identity (DID): Providing reliable and verifiable data storage for DID systems, empowering self-sovereign identity management.
Supply chain management: Ensuring transparency and traceability in supply chains through verifiable data availability.
Conclusion:
DAS in Avail offers a compelling solution for data availability, balancing efficiency, security, and scalability. While alternative approaches have their own strengths, DAS stands out for its ability to empower light nodes, provide strong security guarantees, and remain actively researched and improved upon. As blockchain technology evolves, DAS is poised to play a significant role in shaping secure and scalable solutions for the future.

Please don't submit AI-generated content. You will get banned.


Can't ping guest from host in OSX

with configuration
config.landrush.enable
config.vm.box = "oracleLinux64"
config.vm.box_url = "http://kickstart.boston.zipcar.com/oracle_install/oracle.box"
config.vm.hostname = "oracle.vagrant.dev"
config.landrush.host 'static1.example.com', '<IP_ADDRESS>'

dig responds by correctly identifying the ip for oracle.vagrant.dev and static1.example.com
however ping, nslookup, and host are all unable to recognize the hostname
further, resolv.conf does not reflect localhost as a used DNS
wat do?

I'm considering this resolved.
Caching in mDNSResponder is sometimes an issue still though.


feat: export constants from @vite/plugin-legacy

Description
This PR does not changed anything, it just exports some constants.
Additional context
I'm trying to integrate @vitejs/plugin-legacy into SvelteKit.
SvelteKit has an independent logic of HTML rendering. It seems that SvelteKit could not simply use @vitejs/plugin-legacy to directly modify html. With these constants, it is able to do two things:

Find with file are polyfills generated by plugin.

Generates script tags like this:

import * as constants from '@vitejs/plugin-legacy/constants';

const {
	dynamicFallbackInlineCode,
	safari10NoModuleFix,
	legacyPolyfillId,
	legacyEntryId,
	// systemJSInlineCode,
} = constants;

const systemJSInlineCode = `(function(s,i){i(s.getAttribute('data-src')).then(function(m){window._sveltekit_init(m.start,i,s.getAttribute('data-nodes'))})})(document.getElementById('${legacyEntryId}'),function(m){return System.import(m)});`;

/**
 * @param {{
 *   legacy_polyfill_asset?: string;
 *   entry_file: string;
 *   branch: any[];
 *   get_entry: (entry:string)=>string;
 * }} config
 * @return {string[]}
 */
export function render_script_tags({ legacy_polyfill_asset, get_entry, entry_file, branch }) {
	const legacyEntryFilename = get_entry(entry_file);

	const scripts = [];

	// inject dynamic import fallback entry
	if (legacy_polyfill_asset) {
		scripts.push(`<script type="module">${dynamicFallbackInlineCode}</script>`);
	}

	// inject Safari 10 nomodule fix
	if (legacyEntryFilename) {
		scripts.push(`<script nomodule>${safari10NoModuleFix}</script>`);
	}

	// inject legacy polyfills
	if (legacy_polyfill_asset) {
		scripts.push(
			`<script nomodule id="${legacyPolyfillId}" src="${legacy_polyfill_asset}"></script>`
		);
	}

	// inject legacy entry
	if (legacyEntryFilename) {
		scripts.push(
			`<script nomodule id="${legacyEntryId}" data-src="${legacyEntryFilename}" data-nodes="${(
				branch || []
			)
				.map(({ node }) => get_entry(node.entry))
				.join(',')}">${systemJSInlineCode}</script>`
		);
	}

	return scripts;
}

Related PRs from SvelteKit: https://github.com/sveltejs/kit/pull/2953 and https://github.com/sveltejs/kit/pull/2745

sveltekit needs @vite/plugin-legacy, hope this pr can be merged as soon as possible

The PR title needs to be semantic, e.g. feat: export constants from plugin-legacy. Code-wise, I'm probably not qualified to review the overall benefits of this, but if it's something the team is comfortable of exporting, I think we should export them from index.js instead? I don't see much benefits having them at constants.js

It seems this is same with #4045.

It seems this is same with #4045.

Yeah it seems like so. Let's move the discussion over to #4045 then as there's more info there. Thanks for the PR and example usecase!


Design a static maintenance page when GC Forms is down

Description
(Scaffolding - to be filled in more detail later)
Action item from our Nov 2 incident
Implementing functionality to shut down GC Forms in the event of an incident.
Need to consider the back-end process and infrastructure.

Looking for a static HTML page - design

Few general questions:

Will we be providing notice to a scheduled maintenance?
Is there a set time period (a day?)

Touch point questions

Could we have more touch points for maintenance? If so..
If there is an incident, and there is no notice, can we still send a heads up via email?
IF Contact us and Support forms be shut down as well, could we provide another way for users to send questions to support when our app is down?

Ok cool - I think I had assumed we are providing notice, but wanted to double check.
I am going to post the screens and proposed solutions for @craigzour to take a look at EOD :)

PROPOSAL - Maintenance page & notice
Notice -

End users will see a info-banner at the top of the form. This banner is styled for the app, and not using the public facing banner. I believe since this is related to the app, rather than the form itself, its best not to use the public-facing style. However I am open to feedback and changing this.
Banner is full width, indigo-50, with 140 x-margin
Notices are only related to scheduled maintenance. I believe we should provide at least a weeks notice to prepare end-users for the maintenance.

Maintenance in progress

Static page is styled, but I am unsure if this is feasible. The content is what we will have for the page even if we can't add styling when the app is down :) If the header and footer are not available, we can make the screen have both FR and EN displayed

Private Zenhub Image
Private Zenhub Image

PROPOSAL - Maintenance page & notice for Admin/system users
Notice -

Right after you accept responsibilities, you will see a page that lets users know that we are scheduling maintenance. In this case, this would only work for auth users. For unauth users - I am still thinking about what we could do. Perhaps a global banner similar to the one for end-users? cc: @srtalbot @ioanacontu for feedback/input here
Additional touchpoint: An email can be sent out to let users know about this scheduled maintenance. This email would come from Notify - so no "reply" but we can have links to support and growth forms.

Private Zenhub Image
Private Zenhub Image
Maintenance in progress - Feedback needed here

Same note about styling - this can be a static page with the bilingual content displayed, no header or footer.
From my understanding Support and Contact Us forms would be down - so any other solution we have to contact support (maybe an email address?) could be nice here.
This would be displayed when you land on our app
Content design: The content is directly related to the idea of maintenance, but we can make it more general to not gloss over the idea of an "incident". cc @srtalbot
Additional touchpoint: An email to let users know we are down for maintenance. Question If this is sent by Notify, with no way to reply and no support or contact us forms -- could we have a way to let users contact us through this touchpoint? Open to ideas here

Private Zenhub Image
Private Zenhub Image

Riffing off what's been proposed above. (Thanks Sam!) Leaving latest bilingual ideas here before vacation:
1 - Email notification (to set expectations with all users before downtime)
Private Zenhub Image
2 - Global banner (to set expectations with active users before downtime)
Private Zenhub Image
3 - Static page on GC Forms (to inform active users during downtime)
Private Zenhub Image
4 - Static page on published forms (to inform end users during downtime)
Private Zenhub Image
Other outstanding questions to ponder

How might people reach support if support form is also down?
How might content vary in specificity if it's maintenance vs. an incident?

Who is responsible for initiating this content: incident commander? ops lead? growth?

https://www.figma.com/file/M76okaTadeMaWuIPMCEw1V/ft.-Maintenance-communication?type=design&node-id=1%3A37&mode=design&t=jtLj9hjWDg54grj2-1

Forgot to add -- all the work Proposed lives under ft.Maintenance communication/Proposed

Latest proposed update:
Page will be served to clients and to end users so needs to be generic enough to fit both scenarios.

https://www.figma.com/file/M76okaTadeMaWuIPMCEw1V/ft.-Maintenance-communication?type=design&node-id=1%3A35&mode=design&t=HRoVjpq4muQdmVe7-1


Metadata for Kubernetes

Create the necessary Kubernetes metadata files for deployment (deployment.yaml, service.yaml, secrets.yaml, postgres.yaml, etc.) file so that Kubernetes will know how to deploy your application.

Already completed. Same as #86, #87, #88, and #89 put together


Switch from woff to woff2

Edge 14 and Safari 10 both support woff2. At the time of 7.x there might be newer major versions of these browsers, so that we can switch to woff2.
This will include few steps:

[x] change bundled version of Font Awesome font file
[x] switch assets processing to prefer woff2 as primary font file format

Done


JavaScript: Library Project

The original specification of the project is from The Odin Project.
We implemented a library that saves the information in the localStorage using JavaScript.
If you click the 'Add new book' button, you can create a new book with the following information:

Title
Author
Number of pages
Status: If you have read the book or not

After creating the book, you can:
Remove it from your library using the remove button.
Change the status to read or unread using the change status button.

[Optional] Currently, the books list moves to the right side when we click the new book button. We can fix that.


[NG] custom label for button group menu

[clrMenuLabel] on a <clr-button-group> sets a custom button label instead of the 'ellipsis-horizontal' icon
Partly Fixes #1347
Signed-off-by: Marvin Osswald<EMAIL_ADDRESS>

First off, I want to stress that you did good work here. This is a well-done piece of functionality. After discussing it at length with the team, however, our recommendation is not to include it in the Clarity Angular library.
The reasoning from our UX team is that it introduces an inconsistency in the interaction. Suddenly people may see some components where ellipses are used to present more options but then in other cases it will be text links… or further still, a different icon (if we were to continue this feature request to include a custom icon).
I feel really bad about this because you've done a good job. But it is not a feature that we can, at this time, push out to our users.
Please let me know if there's something I am misunderstanding about the use case here that might impact this recommendation.

@mathisscott while I understand your reasoning I want to lay down my case I've created this fix for.
Originally all I wanted was to have a dropdown included in a button group, but if I would just "put it there" in terms of code the toggle button wouldn't recognise that itself is inside a button group and would just render as a normal button. So I've found the "ellipses solution" and run with it until someone didn't understand the meaning of these three little dots... which made it a requirement for me to label it.
But if it was just was a personal limitation of myself to implement a "normal" dropdown in a button group please let me know.

@youdz and I had a discussion about this earlier today. I'll give him a chance to post his feedback. Ultimately, I think your use case is more an issue with allowing for dropdowns to be triggered inside of button groups and allowing button groups to handle that (even from the overflow).

As @mathisscott said, I didn't realize your use case was using actual dropdowns inside a button group.
This is a perfectly valid feature request that we have been planning for from the first version of button groups. At the time, we did not have "nested menus" yet, so we could not do it as part of the MVP. Now that we have these nested menus, we can start allowing dropdowns in button groups, and any dropdown that ends up in the "overflow" (the ellipsis dropdown) will become a nested dropdown itself. So in your case, you would just add a dropdown directly in the button group, with your own text or icon for the button, and you would just have to not put it in the overflow. 😉
I will update your original issue to reflect this, and we will add it to our backlog. Thanks! 😄


Assume that if ac.ServerAddress is empty, there's nothing to complain about.

Fixes #1308

Thanks, but please sign the commit for DCO
https://github.com/apps/dco
(run git commit -a -s --amend, and make sure that the Signed-off-by: NAME <EMAIL> line with your real name is included in the commit message)

Going to take an alternative approach.


I cannot run this image successfully

When i run akash node on akash, there is nothing log and maybe crashed.
When i run on my machine, it always exit with code 7 or 35, and sometimes, it doesn't do anything, and it doesn't show up.
Only once, it seems to have run successfully.

I read the tutorials in the documentation that the first startup in the document seems to have failed. Is it starting repeatedly to expect a normal run?

Strange - I've not seen anything like that before. I'm not sure what changes you've made to the docker-compose/Dockerfile so could you try a docker-compose.yml like this?
version: '3.4'

services:
  node_1:
    image: ghcr.io/ovrclk/cosmos-omnibus:v0.0.17-akash-v0.12.1
    environment:
      - MONIKER=node_1
      - CHAIN_JSON=https://raw.githubusercontent.com/ovrclk/net/master/mainnet/meta.json
    volumes:
      - ./node-data:/root/.akash

➜  akashnode docker-compose up --force-recreate
Pulling node_1 (ghcr.io/ovrclk/cosmos-omnibus:v0.0.17-akash-v0.12.1)...
v0.0.17-akash-v0.12.1: Pulling from ovrclk/cosmos-omnibus
004f1eed87df: Already exists
3637e3316c04: Already exists
a2fa0fc5e617: Pull complete
bcaedcb50aa5: Pull complete
4dbdf3f0fe81: Pull complete
Digest: sha256:c2f84d797c89626cfee53f5d8197cdaa3853b863ce5e9dcc78289541c45f7e11
Status: Downloaded newer image for ghcr.io/ovrclk/cosmos-omnibus:v0.0.17-akash-v0.12.1
Creating akashnode_node_1_1 ... done
Attaching to akashnode_node_1_1
akashnode_node_1_1 exited with code 35
➜  akashnode cat docker-compose.yml
version: '3.4'

services:
  node_1:
    image: ghcr.io/ovrclk/cosmos-omnibus:v0.0.17-akash-v0.12.1
    environment:
      - MONIKER=node_1
      - CHAIN_JSON=https://raw.githubusercontent.com/ovrclk/net/master/mainnet/meta.json
    volumes:
      - ./node-data:/root/.akash

But the test in severa hours ago, it runs successfully.Sometims maybe it is ok.

I don't know why, may be a problem about network?But yesterday i tried to deploy it on akash, It also failed.

Ah you have no disk space left - that's why the containers are failing in both examples. The Snapshot restore for Akash involves downloading and extracting about 300GB of data so I would make sure you have enough disk space to do that. Let me know if that solves it for you and I'll close this issue.

Yes, i know that, but only when it runs successful, it would be no disk space.In most cases, it just exits.

I'm also trying to deploy it to akash, but it's just like that.

---
version: '2.0'

services:
  node:
    image: ghcr.io/ovrclk/cosmos-omnibus:v0.0.17-akash-v0.12.1
    env:
      - MONIKER=GlacierLuo
      - CHAIN_JSON=https://raw.githubusercontent.com/ovrclk/net/master/mainnet/meta.json
      - SNAPSHOT_JSON=https://cosmos-snapshots.s3.filebase.com/akash/snapshot.json
      - MINIMUM_GAS_PRICES=0.025uakt
      - FASTSYNC_VERSION=v2
    expose:
      - port: 26657
        as: 80
        accept:
          - rpc.supernaut.ddns.net
          - rpc.akash.glacierluo.com
        to:
          - global: true
      - port: 26656
        to:
          - global: true
      - port: 1317
        as: 80
        accept:
          - api.supernaut.ddns.net
          - api.akash.glacierluo.com
        to:
          - global: true
      - port: 9090
        to:
          - global: true

profiles:
  compute:
    node:
      resources:
        cpu:
          units: 4
        memory:
          size: 8Gi
        storage:
          size: 350Gi
  placement:
    dcloud:
      pricing:
        node:
          denom: uakt
          amount: 1000

deployment:
  node:
    dcloud:
      profile: node
      count: 1

We download and extract the snapshot at the same time so it will start to use a lot of disk space as soon as it starts downloading the snapshot.
The SDL you gave has two different ports exposed as 80, which I would expect to cause some issues. Otherwise I don't actually see any errors there and the deployment is active? Did you submit your manifest to the provider?

---
version: "2.0"

services:
  node:
    image: ghcr.io/ovrclk/cosmos-omnibus:v0.0.17-akash-v0.12.1
    env:
      - MONIKER=my-moniker-1
      - CHAIN_JSON=https://raw.githubusercontent.com/ovrclk/net/master/mainnet/meta.json
      - SNAPSHOT_JSON=https://cosmos-snapshots.s3.filebase.com/akash/snapshot.json
      - MINIMUM_GAS_PRICES=0.025uakt
      - FASTSYNC_VERSION=v2
    expose:
      - port: 26657
        as: 80
        to:
          - global: true
      - port: 26656
        to:
          - global: true

profiles:
  compute:
    node:
      resources:
        cpu:
          units: 2
        memory:
          size: 2Gi
        storage:
          size: 350Gi
  placement:
    dcloud:
      pricing:
        node:
          denom: uakt
          amount: 1000

deployment:
  node:
    dcloud:
      profile: node
      count: 1

I am trying to deploy like this, but it still crashes and restarts.
Expose a port to 80 only means that's a http service, i am sure that the deployment is active, and the provider has got the manifest, otherwise it cannot expose the port and bind the domain.

OK, I already know why, this should be the problem of provider network. When I deployed to the official server provided by akash, it was able to run successfully and output log.

Ah fantastic, I was running out of ideas 😂
I'll close this but feel free to open a new one if you have any problems. You can also find me on the Akash discord :)

Ok, thank you very much!


Server

fixes: https://github.com/komuw/goweb/issues/14

Codecov Report

:exclamation: No coverage uploaded for pull request base (master@35fe492). Click here to learn what that means.
The diff coverage is n/a.

@@           Coverage Diff            @@
##             master     #19   +/-   ##
========================================
  Coverage          ?   0.00%
========================================
  Files             ?       2
  Lines             ?      81
  Branches          ?       0
========================================
  Hits              ?       0
  Misses            ?      81
  Partials          ?       0

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 35fe492...9d4a2bb. Read the comment docs.


feat(dream/server): add CORS headers

I have been building a alternative webui that polls the dream server API as I wanted to save generation history and quickly work with seeds/variants (demo).
It requires a CORS header to properly work when started (development mode) on another port.

@bakkot You identified a cross-site scripting vulnerability in a previous PR that attempted to add CORS headers. Could you check this one out as well? It just a one line fix.

Hum, did not see the other PR, indeed I think this is something that we may want to have behind a flag. Will look into it.

This has the same probably as the previous one. cf https://github.com/lstein/stable-diffusion/pull/371.

Definitely must be non-default opt-in with a warning. Browsers don't even allow this behavior for 'localhost' any more.

Instead of adding CORS support, maybe we should separate out the API and frontend components of the WebUI (this should be helpful for other use cases-like a UI redesign in the future). Right now the POST /, and GET /cancel endpoints are the API surface, and server.py should be reduced to handling those. Separately, frontends can be created which interface with those endpoints.

@TesseractCat; That work is actually ongoing in this repo (i.e. redesign). I guess the question is; how much effort do we want to put into the existing web ui?

@TesseractCat; That work is actually ongoing in this repo (i.e. redesign). I guess the question is; how much effort do we want to put into the existing web ui?

Well, when I made the original UI, my goal was to make something simple without any dependencies. I guess as we start thinking about more complex frontends, we should improve the modularity. I think we should separate the API layer and the frontend, and then move the frontends to separate repositories. Then either the existing web UI could be moved to it's own repository, or could be kept as a simple default.

What do you say we anounce a freeze to major changes to the WebUI until @psychedelicious has completed their redesign?
They seem to be moving along quite rapidly and I don't want contributors to spend a lot of time working on what was initially a quick-and-dirty implementation (with much gratitude to @TesseractCat )

I have been building a alternative webui that polls the dream server API as I wanted to save generation history and quickly work with seeds/variants (demo).
It requires a CORS header to properly work when started (development mode) on another port.

The demo's quite nice, BTW. I like the style of building the query up bit by bit.

What do you say we anounce a freeze to major changes to the WebUI until @psychedelicious has completed their redesign?

Agreed

I'm trying to finish the core features for the redesign today, as I may be busy for the next couple days - have had nothing else to work on the past couple days so I've been cranking it out.
Regarding CORS, agree we should have a switch on server-y scripts to allow all origins.
@TesseractCat , thanks for making the web UI, I've used it as a jumping off point for a more involved UI made in React.

@lstein @bakkot just updated the PR adding a couple of flags to properly enable CORS mode:
Defaults to Access-Control-Allow-Origin: * when enabled:
scripts/dream.py --web --cors

Can be narrowed using --cors_origin, eg:
scripts/dream.py --web --cors --cors_origin https://mgcrea.github.io

I think having —cors simply take an optional arg is a better pattern, i.e.

—cors  # i.e. '*'
—cors https://mgcrea.github.io

I think having —cors simply take an optional arg is a better pattern, i.e.

—cors  # i.e. '*'
—cors https://mgcrea.github.io

Yep, I agree, not fluent in Python so I initially took the easy road, but just updated the PR to do just that.

I don't think * is a good default - it's fundamentally not safe. The easiest thing should not be the unsafe thing. And I would worry that some UIs would suggest people start with --cors instead of --cors this_specific_origin, because it's easier, and thus leave their users vulnerable.
That is, I would make the argument mandatory, and reject * as an option even if it's explicitly specified.

@bakkot In my opinion it's good enough for now, as we are still in the early stages, the risk profile is in my opinion relatively low and acceptable behind a flag. It will still be possible to revisit at a later date.
Forbidding '*' do seem a bit extreme to me. Every development framework out there does allow the use of a wildcard so I'm not sure why this stable-diffusion backend should be treated differently. At the end of the day you are running untrusted server code on your computer and that can already be considered to be a pretty big risk.
Also it would require more complex code to handle multiple allowed origins.
But I'm willing to change the PR if there is a consensus to do so.

I am strongly opposed to making * the default and mostly opposed to allowing it at all. The benefits are not commensurate with the risks. allow-origin * is something you'd use for public-facing servers which have been duly hardened against untrusted visitors, not for internal services.

At the end of the day you are running untrusted server code on your computer and that can already be considered to be a pretty big risk.

There is a very large difference between running untrusted code you downloaded from a specific, active GitHub repository and running untrusted code from every single website you visit.

Every server development framework out there does allow the use of a wildcard so I'm not sure why this stable-diffusion backend should be treated differently.

Difference being this project is not a server development framework (clearly targeted at developers), but a user-facing application. If somebody knows enough to edit the scripts themselves, then they can set CORS to "*", fine.
An unsuspecting user may have trouble accessing the SD service due to a CORS issue and set CORS to "*" without understanding anything more than it fixed the problem. Instead, they should come to this repo and ask for help so they can get things set up securely.

Why not just have a flag that the user can set at launch time and a little
warning message that alerts the user to the risks of this and directs them
to appropriate background reading material?
Lincoln
On Wed, Sep 7, 2022 at 11:30 AM psychedelicious @.***>
wrote:

Every server development framework out there does allow the use of a
wildcard so I'm not sure why this stable-diffusion backend should be
treated differently.
Difference being this project is not a server development framework
(clearly targeted at developers), but a user-facing application. If
somebody knows enough to edit the scripts themselves, then they can set
CORS to "*", fine.
An unsuspecting user may have trouble accessing the SD service due to a
CORS issue and set CORS to "*" without understanding anything more than it
fixed the problem. Instead, they should come to this repo and ask for help
so they can get things set up securely.
—
Reply to this email directly, view it on GitHub
https://github.com/lstein/stable-diffusion/pull/408#issuecomment-1239544410,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAA3EVKPMPUAZKTYRDKBWOTV5CYJRANCNFSM6AAAAAAQGFW3YQ
.
You are receiving this because you were mentioned.Message ID:
@.***>

--
Lincoln Stein
Head, Adaptive Oncology, OICR
Senior Principal Investigator, OICR
Professor, Department of Molecular Genetics, University of Toronto
Tel:<PHONE_NUMBER>
Cell:<PHONE_NUMBER>
@.***
E**xecutive Assistant
Michelle Xin
Tel:<PHONE_NUMBER>
@.*** @.**>
Ontario Institute for Cancer Research
MaRS Centre, 661 University Avenue, Suite 510, Toronto, Ontario, Canada M5G
0A3
@OICR_news
https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Foicr_news&data=04|01|Michelle.Xin%40oicr.on.ca|9fa8636ff38b4a60ff5a08d926dd2113|9df949f8a6eb419d9caa1f8c83db674f|0|0|637583553462287559|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|1000&sdata=PS9KzggzFoecbbt%2BZQyhkWkQo9D0hHiiujsbP7Idv4s%3D&reserved=0
| www.oicr.on.ca
Collaborate. Translate. Change lives.
This message and any attachments may contain confidential and/or privileged
information for the sole use of the intended recipient. Any review or
distribution by anyone other than the person for whom it was originally
intended is strictly prohibited. If you have received this message in
error, please contact the sender and delete all copies. Opinions,
conclusions or other information contained in this message may not be that
of the organization.

There's not really much reason to allow *. The motivation for this, as I understand it, is that you're trying to allow a specific site to make requests to your local server so that it can be an alternative UI. For that you only need the ability to let that specific site make requests to the server. There's no particular need to also allow every other site you visit to make requests.

@lstein quite like the warning idea (could be something big in caps) to educate end-users about the risks.
@bakkot you might want to test several alternative frontends + a local dev version, etc, in that case '*' can be quite useful.
I do really think that we should let users decide what they want to do, and pass some flags. And don't like blacklisting features for the perceived users's own good. Cases could be made against NSFW-generated materials, it's pretty much endless. etc.
I think a good middle ground would be to remove the wildcard default, and require something to be specified, and add a big warning message (with maybe a link with more details) if you try to pass a wildcard. But still allow people to do what they want.

It's open source. Someone who actually knows what they're doing can trivially set it to *. Someone who doesn't know what they're doing shouldn't be setting it to *.

mcgrea: I agree with

I do really think that we should let users decide what they want to do, and allow any value

when the thing is question has a low risk of immediate harm
OTOH, bakkot's

Someone who actually knows what they're doing can trivially set it to *. Someone who doesn't know what they're doing shouldn't be setting it to *

is the right way to think about it IMO
ALL web browsers disallow connections to localhost by default. There are JILLIONS of questions on SO, Reddit, etc. from brand-new web devs who don't understand why they can't just "load the thing". I don't believe I've ever seen a consensus of "yeah, here's how to turn that off but be careful ' (though there's always at least one person...) - it's always "here's how you set up a local dev server, and here's why".
TL;DR - taking away users' choice is bad. Handing a complete noob a loaded firearm with no safety (and a round in the chamber) is utterly irresponsible (just to strain that metaphor - we're not a firing range, so I don't think that education is our job in this instance).

There is absolutely no good reason to allow * in the CORS field unless you're running a public service for anyone to use (which this project isn't currently equipped for)

you might want to test several alternative frontends + a local dev version, etc, in that case '*' can be quite useful.

@mgcrea it's not needed for local development at all
Every modern dev server (webpack, vite, etc) can be configured to proxy requests in order to get around this.
Here's an example with vite.

Well, looks like you all have strong opinions on this and I don't, not sure we really need the same security as a public browser but let's not diverge any further!
I'll remove the default to * for now and force users to set a value + add a big warning if you pass the wildcard.
If you want to forbid the wildcard altogether, feel free to push an extra commit on top of this. I'll be fine with it.

This has been superseded by subsequent changes to the WebGUI. The new GUI does allow CORS permissions to be set on the command line at launch time.


WIP: GitHub actions integration tests

Ⅰ. Describe what this PR does
Ⅱ. Does this pull request fix one issue?

fixes #XXXX
Ⅲ. List the added test cases (unit test/integration test) if any, please explain if no tests are needed.
Ⅳ. Describe how to verify it
Ⅴ. Special notes for reviews

:warning: Please install the  to ensure uploads and comments are reliably processed by Codecov.
Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 64.17%. Comparing base (569dd49) to head (717aef2).
Report is 292 commits behind head on master.

:exclamation: Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files
@@            Coverage Diff             @@
##           master      #17      +/-   ##
==========================================
- Coverage   64.28%   64.17%   -0.11%
==========================================
  Files         476      467       -9
  Lines       28312    28198     -114
==========================================
- Hits        18199    18096     -103
+ Misses       7947     7901      -46
- Partials     2166     2201      +35

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


Android 4.0.3, appcompat-v7:22.1.1 and calligraphy 2.1.0

I managed to get snagged on a rather specific problem, but could be indicative of other issues. On Android 4.0.3 (and not on 4.0.4, which is also API level 15), when app is compiled with appcompat-v7 22.1.1 and calligraphy 2.1.0, onOptionsItemSelected() doesn't get called on child fragmetns (so app ends up without any icons in action bar (which is android.support.v7.widget.Toolbar set with setSupportActionBar()). I'll post more info as I gather it.
I rolled back to appcompat 22.0.0. and calligraphy 2.0.2 which works fine (but prevents me from enjoying the goodies in 22.1.1).

That is very interesting. I'm guessing that 22.1.1 and no Calligraphy works as intended?

 But you are inflating the child Fragments using the getChildFragmentManager()?
I have never tried Calligraphy with Child fragments.

Nope, regular support fragment manager. Here's one example:
        FragmentTransaction ft = getSupportFragmentManager().beginTransaction();
        ft.add(R.id.desnaLadica, new RightDrawerFragment(), RightDrawerFragment.TAG);
        ft.commit();

Where RightDrawerFragment extends android.support.v4.app.Fragment, desnaLadica is LinearLayout as a drawer in v4 DrawerLayout. But it behaves similarly in other configurations too.
I don't have the device handy right now (home for the weekend), I'll test without calligraphy on Monday. Honestly, didn't occur to me to try, I came to consider calligraphy as an essential part of the platform. :-)

Ha, yeah. I should add a troubleshooting guide. "Try without calligraphy
before posting an issue"
On Fri, 22 May 2015 17:44 Jovica Popovic<EMAIL_ADDRESS>wrote:

Nope, regular support fragment manager. Here's one example:
    FragmentTransaction ft = getSupportFragmentManager().beginTransaction();
    ft.add(R.id.desnaLadica, new RightDrawerFragment(), RightDrawerFragment.TAG);
    ft.commit();

Where RightDrawerFragment extends android.support.v4.app.Fragment,
desnaLadica is LinearLayout as a drawer in v4 DrawerLayout. But it behaves
similarly in other configurations too.
I don't have the device handy right now (home for the weekend), I'll test
without calligraphy on Monday. Honestly, didn't occur to me to try, I came
to consider calligraphy as an essential part of the platform. :-)
—
Reply to this email directly or view it on GitHub
https://github.com/chrisjenx/Calligraphy/issues/172#issuecomment-104710336
.

Well, turns out you're right. After commenting out attachBaseContext override (so calligraphy doesn't get to do its magic) and using appcompat v22.1.1 the error is still there - no onOptionsItemSelected() call on 4.0.3.
Ok, I'm off to bother guys at Google, excuse my intrustion. :-)

Heh, no worries. Thanks!
On Mon, 25 May 2015 10:51 Jovica Popovic<EMAIL_ADDRESS>wrote:

Closed #172 https://github.com/chrisjenx/Calligraphy/issues/172.
—
Reply to this email directly or view it on GitHub
https://github.com/chrisjenx/Calligraphy/issues/172#event-312888084.


feat: add mit guide and props

Description

Adds guide for 3DS MIT
Adds missing decoupled challenge props and event

Testing required outside of automated testing?

[x] Not Applicable

Screenshots (if appropriate):

[x] Not Applicable

Rollback / Rollforward Procedure

[x] Roll Forward
[ ] Roll Back

Reviewer Checklist

[ ] Description of Change
[ ] Description of outside testing if applicable.
[ ] Description of Roll Forward / Backward Procedure
[ ] Documentation updated for Change

:tada: This PR is included in version 1.197.0 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:


Surrealist has trouble handling a Polygon

Describe the bug
"Received invalid binary data" when trying to use a Polygon.
To Reproduce
Use a query that uses a Polygon, such as:
RETURN {
  type: "Polygon",
  coordinates: [[
    [-0.03921743611083, 51.88106875736589],
    [30.48112752349519, 50.68377089794912],
    [23.66174524001544, 42.94500782833793],
    [ 1.92481534361859, 41.69698118125476]
  ]]
};

Or a MultiPolygon:
UPDATE university:oxford SET locations = {
	type: "MultiPolygon",
	coordinates: [
		[
			[ [10.0, 11.2], [10.5, 11.9], [10.8, 12.0], [10.0, 11.2] ]
		],
		[
			[ [9.0, 11.2], [10.5, 11.9], [10.3, 13.0], [9.0, 11.2] ]
		]
	]
};

Interesting behaviour:

The CLI works fine
No crash if you put the Polygon into a function

RETURN geo::centroid( {
  type: "Polygon",
  coordinates: [[
    [-0.03921743611083, 51.88106875736589],
    [30.48112752349519, 50.68377089794912],
    [23.66174524001544, 42.94500782833793],
    [ 1.92481534361859, 41.69698118125476]
  ]]
});

Expected behavior
Should return what the CLI does
Environment:
1.4.0 for windows on x86_64
And on the web version:
Platform: Web Navigator: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<IP_ADDRESS> Safari/537.36 Edg/<IP_ADDRESS> Version: 2.0.5 Flags: featureFlags: false, models_view: true, apidocs_view: true, themes: false, newsfeed: true

Fixed in https://github.com/surrealdb/surrealist/commit/23f520f60a0db8e9febad49577bbec018d6e2860


elasticsearch phrase EXCEPTIONS

Package version (if known):
invenio-app-rdm v0.20.1
Describe the bug
A clear and concise description of what the bug is.
searching for some phrases that are not allowed by elasticsearch the UI throws unknown error.
Steps to Reproduce

Go to './search'
Type in the search bar "Open Science
Click on 'search button'
See error

Stacktrace
  File "/home/unix/projects/latest_base/lib/python3.8/site-packages/elasticsearch/transport.py", line 381, in perform_request
    status, headers_response, data = connection.perform_request(
  File "/home/unix/projects/latest_base/lib/python3.8/site-packages/elasticsearch/connection/http_urllib3.py", line 273, in perform_request
    self._raise_error(response.status, raw_data)
  File "/home/unix/projects/latest_base/lib/python3.8/site-packages/elasticsearch/connection/base.py", line 322, in _raise_error
    raise HTTP_EXCEPTIONS.get(status_code, TransportError)(
elasticsearch.exceptions.RequestError: RequestError(400, 'search_phase_execution_exception', 'Failed to parse query ["Open Science]')

UI

Expected behavior

@mb-wali do you think that my search of an urn urn:nbn:de:bvb:473-opus-1130 has the same error-reason, or would I need to open a new issue:

this is the current demo-version (https://inveniordm.web.cern.ch/search?q=urn%3Anbn%3Ade%3Abvb%3A473-opus-1130&p=1&s=10&sort=bestmatch) - I guess it is invenioRDM-v4

@mb-wali do you think that my search of an urn urn:nbn:de:bvb:473-opus-1130 has the same error-reason, or would I need to open a new issue:

this is the current demo-version (https://inveniordm.web.cern.ch/search?q=urn%3Anbn%3Ade%3Abvb%3A473-opus-1130&p=1&s=10&sort=bestmatch) - I guess it is invenioRDM-v4

Yes, it is the same error: the elasticsearch is throwing an exception error which explains that the giving query cannot be executed for this and that reason. we should catch these exceptions and give a user a nice response to the actual error.

The REST API side of things have been fixed, but the frontend part is missing to report 400 errors properly:

closed via https://github.com/inveniosoftware/invenio-app-rdm/pull/1074 (well when merged into master)


Sanback example is not working locally, but works perfectly view in "Open in Codesanbox"

Bug report
Packages affected

[ ] sandpack-client
[X] sandpack-react

Description of the problem
I have a <Sandpack> component example running in my browser, however the behavior does not match with what the "Open in Codesanbox" preview displays.
Steps to reproduce

I created a <Sandpack> component in my app
The Sandpack preview doesn't reflect what is in the code, despite it partially working.

Codesanbox: https://codesandbox.io/s/react-reconciler-bug-forked-nkimm0
Github Repo: https://github.com/cliffordfajardo/sandpack-bug/tree/main
Video Demo:

The background text of Edit App.tsx and save to reload. inside the preview pane should be changing to red, green, blue every 1 second, per the code I have loaded in the <Sandpack/> component
The alert(..) call inside my preview is not working, but it works when I view the code in the "Open in Codesandbox" environement in a new tab

https://user-images.githubusercontent.com/6743796/162626618-f878257a-46ac-40d9-97b8-7e548f47c2b3.mp4
Challenges
It appears the sandpack code I have passed into my <Sandpack> component is not executing the code content I jhave passed into it. As a user this can be confusing because its not using the code I passed into it?
The thing I find especially perplexing is that the index.tsx file I am passing to <Sandpack /> isn't being used/called.
In the video below, I demonstrate that inside the index.tsx file I am using ReactDOMMini.render to render my app
/****************index.tsx file inside Sandpack**********/
ReactDOMMini.render(
  // ReactDOM.render(
  // <React.StrictMode>
  // </React.StrictMode>,
  <App />,
  document.getElementById('root') as HTMLElement
)

/**************ReactDOMMini.ts******************/
const ReactDOMMini = {
  render(whatToRender: any, div: HTMLElement) {
    // ❌ This alert is not being called inside the sandpack preview, which means that the "ReactDOMMini.render"  inside
    //  of "index.tsx" not being used; then how is content being rendered in the screen preview if my `ReactDOMMini.render`
    // is not being called at all? Outside of sandpack environment, if  `ReactDOMMini.render` were not to be called that
   // would mean the app would be blank since no `render` method is used, but not in the sandpack preview🤔

    setTimeout(() => {
      alert('ReactDOMMini.render called!')
    },4000)
    const shouldHydrate = false
    const hydrationCallback = null // we are not doing server side hydration.
    const container = reconciler.createContainer(div, 0, shouldHydrate, hydrationCallback) // TODO: update @types package return

    reconciler.updateContainer(whatToRender, container, null, null)
  },
}

https://user-images.githubusercontent.com/6743796/162627106-738996a0-3f13-4ba4-bfce-402f0fca9178.mp4
Your Environment

@codesandbox/sandpack-react version: 0.18.0
Chrome version: 100.0.4896.60
Operating System: MacOS

Additional References
Building a Custom React Renderer | Sophie Alpert

I am trying to implement this small example inside sandpack preview ^. I'm creating a tutorial series on the react-reconciler-api
Codesanbox: https://codesandbox.io/s/react-reconciler-bug-forked-nkimm0
Github Repo: https://github.com/cliffordfajardo/sandpack-bug/tree/main

Turned out, that it was a typo in the path of the file, which ended up using the index.tsx from the original template.
files={{
  "/App.tsx": AppCode,
  "/ReactDOMMini.ts": ReactDOMMiniCode,
  "/logo.svg": LogoCode,
  "/App.css": AppCSSCode,
-  "index.tsx": IndexCode,
-  "index.css": IndexCSS
+  "/index.tsx": IndexCode,
+  "/index.css": IndexCSS
}}

Ahhhh thank goodness it was just that - wow this is funny 😆
@danilowoz - besides prefixing the file with a forward slash, are there other variations of  paths you can pass as keys to files object?
What are invalid inputs and what are valid inputs?
Valid: [./, ...anymore?]
Invalid: [/ ..]
I'm thinking ahead of ways maybe I can write a unit test for this scenario so we can give users error warnings in the console when they pass something invalid & hopefully save them time


Fix import path from MakeNowJust/memefish to cloudspannerecosystem/memefish

Close #51
Replaced MakeNowJust/memefish with cloudspannerecosystem/memefish. In addition, we notice the migration information to README.md.
At least, the test is passed on my laptop, however, I don't know that it works correctly.

@nktks @tyamagu2 I haven't been using Go much lately and would like you to review this PR.

Codecov was disabled because I have no idea how to use codecov and similar services under this org.
Another, the workflow to deploy to GH pages does not work for now. I will fix it in another PR.

I'm not sure about import path, but it seems to work in the case go get to new module.
go get github.com/cloudspannerecosystem/memefish@59e4bb21f177ae7789a7b72435b50bd77e23fd96
go: added github.com/cloudspannerecosystem/memefish v0.0.0-20230401063640-59e4bb21f177

cat go.mod
module github.com/nktks/test

go 1.18

require github.com/cloudspannerecosystem/memefish v0.0.0-20230401063640-59e4bb21f177 // indirect

package main

import (
	"fmt"
	"log"

	"github.com/cloudspannerecosystem/memefish/pkg/parser"
	"github.com/cloudspannerecosystem/memefish/pkg/token"
)

func main() {
	p := &parser.Parser{
		Lexer: &parser.Lexer{
			File: &token.File{FilePath: "", Buffer: "SELECT 1"},
		},
	}
	s, err := p.ParseStatement()
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(s.SQL())

}

go run main.go
SELECT 1

Codecov was disabled because I have no idea how to use codecov and similar services under this org.

Maybe we need to request cloudspannerechosystem org admin to use Codecov.
@kazegusuri , @ansh0l  Can we use Codecov in cloudspannerechosystem org?


[SECURITY] Use HTTPS to resolve dependencies in Maven Build

Want to take over the Java ecosystem? All you need is a MITM!
Update: Want to take over the Java ecosystem? All you need is a MITM!

This is a security fix for a  vulnerability in your Apache Maven pom.xml file(s).
The build files indicate that this project is resolving dependencies over HTTP instead of HTTPS.
This leaves your build vulnerable to allowing a Man in the Middle (MITM) attackers to execute arbitrary code on your or your computer or CI/CD system.
This vulnerability has a CVSS v3.0 Base Score of 8.1/10.
POC code has existed since 2014 to maliciously compromise a JAR file in-flight.
MITM attacks against HTTP are increasingly common, for example Comcast is known to have done it to their own users.
This contribution is a part of a submission to the GitHub Security Lab Bug Bounty program.
Detecting this and Future Vulnerabilities
This vulnerability was automatically detected by LGTM.com using this CodeQL Query.
As of September 2019 LGTM.com and Semmle are officially a part of GitHub.
You can automatically detect future vulnerabilities like this by enabling the free (for open-source) LGTM App.
I'm not an employee of GitHub nor of Semmle, I'm simply a user of LGTM.com and an open-source security researcher.
Source
Yes, this contribution was automatically generated, however, the code to generate this PR was lovingly hand crafted to bring this security fix to your repository.
The source code that generated and submitted this PR can be found here:
JLLeitschuh/bulk-security-pr-generator
Opting-Out
If you'd like to opt-out of future automated security vulnerability fixes like this, please consider adding a file called
.github/GH-ROBOTS.txt to your repository with the line:
User-agent: JLLeitschuh/bulk-security-pr-generator
Disallow: *

This bot will respect the ROBOTS.txt format for future contributions.
Alternatively, if this project is no longer actively maintained, consider archiving the repository.
CLA Requirements
This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.
It is unlikely that I'll be able to directly sign CLAs. However, all contributed commits are already automatically signed-off.

The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin
(see https://developercertificate.org/ for more information).
- Git Commit Signoff documentation

If signing your organization's CLA is a strict-requirement for merging this contribution, please feel free to close this PR.
Tracking
All PR's generated as part of this fix are tracked here:
https://github.com/JLLeitschuh/bulk-security-pr-generator/issues/2

Why just close this?

Why just close this?

To be honest, I thought these PR's were submitted by a bot and nobody was really watching.
I decided to fork this repository so I could have more control of it. The fork uses https:
    <distributionManagement>
        <snapshotRepository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
        </snapshotRepository>
        <repository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
        </repository>
    </distributionManagement>
    ```

To be honest, I thought these PR's were submitted by a bot and nobody was really watching.
I decided to fork this repository so I could have more control of it. The fork uses https:
    <distributionManagement>
        <snapshotRepository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
        </snapshotRepository>
        <repository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
        </repository>
    </distributionManagement>
    ```


Added automatic push of maven artifacts on master and develop

What's in the PR

extension of the ci workflow for signing and deploying the maven artifact

You can view the automatically created artifacts at oss.sonatype.org.
Currently the files are signed with my account. I would try to create a bot account at sonatype for samply.
** Please Note **

changes to the pom.xml should be pushed to samply parent. I will create a PR and link it.

Created the PR for samply.parent: https://github.com/samply/maven-parent/pull/5


Copy State and Diff?

I noticed Cortex can tell you what changed since the last update cycle.  This is cool and all, but what I really want to do is find out what changed since the last time I saved data to the server.
Here's how it'd work.  When you start editing a record in your browser, I'd like to copy the relevant cortex subtree to remember what it used to look like.  Then, when you hit Save, I'd like to diff the current state of the subtree with the saved copy, getting something much like the result of getChanges().  Now I know what to send to the server to get things in sync!

Btw I want to say I just started using Cortex and I love it!  Calling mutators on Cortex is way less work than writing a bunch of action handlers for a Flux app.  It even fixes "the dot rule" problem in Angular apps where you can only really mutate a value if you have access to its parent object.  Working with Cortex actually feels a lot like working with FireBase.  In fact, I think Cortex's API is better than FireBase's, and it'd be cool if there was a cortex-firebase library that let you use FireBase via Cortex.  But that's for a different issue, and may be a silly idea.  Cortex also feels kind of like using mutable "reference" values in oCaml, since you can assign them in place without knowing about other places they are referenced.  And it seems very similar to Functional Reactive Programming stuff like ELM, only you don't have to write any actions.

Thanks for the idea. You can already do clone and diff using __clone and __diff at any data level. I can refactor them into utility methods when I have time

I just realized I could cheese this like so:
function copyState(cortex) {
	return JSON.parse(JSON.stringify(cortex.getValue()))
}

function getChanges(cortex, initial_value) {
	new_value = cortex.getValue()
	cortex.set(initial_value)
	setTimeout(function(){
		cortex.set(new_value)
		changes = cortex.getChanges();
		console.log(changes)
	})
}

// save state
var saved_state = copyState(cortex)
// ... change things
var changes = getChanges(cortex, saved_state)

you can now call Cortex.deepClone and Cortex.deepDiff. Please refer to readme doc for more info. Thanks

Thanks!

@nickretallack I'd really like to implement something like what you're describing. Do you have any code you can share demonstrating how you negotiate what needs to be sent to the server based on the diff?


Prevent evaluation of subworkflow DAG

I have a workflow whose subworkflow's DAG takes a long time to evaluate.
I would like a command-line argument to prevent reevaluation of subworkflow DAGs--Snakemake would just assume the subworkflows are up-to-date.

Originally asked about on Stack Overflow:
https://stackoverflow.com/questions/61824769/snakemake-prevent-rerun-of-subworkflow/61843755#61843755


[TS migration] Migrate useLocalize

Details

Fixed Issues

$ https://github.com/Expensify/App/issues/24940
PROPOSAL:
Tests

Click and interact with the whole app - useLocalize is used everywhere so any regression will be immediately visible
Verify that no errors appear in the JS console

Offline tests

Same as Tests

QA Steps

Click and interact with the whole app - useLocalize is used everywhere so any regression will be immediately visible

Use the date picker to set the date of brith in personal details, verify it works as expected and selected values are correct.
PR Author Checklist

[x] I linked the correct issue in the ### Fixed Issues section above
[x] I wrote clear testing steps that cover the changes made in this PR

[x] I added steps for local testing in the Tests section
[x] I added steps for the expected offline behavior in the Offline steps section
[x] I added steps for Staging and/or Production testing in the QA steps section
[x] I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
[x] I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
[x] I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).

[x] I included screenshots or videos for tests on all platforms
[x] I ran the tests on all platforms & verified they passed on:

[x] Android: Native
[x] Android: mWeb Chrome
[x] iOS: Native
[x] iOS: mWeb Safari
[x] MacOS: Chrome / Safari
[x] MacOS: Desktop

[x] I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
[x] I followed proper code patterns (see Reviewing the code)

[x] I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick)
[x] I verified that the left part of a conditional rendering a React component is a boolean and NOT a string, e.g. myBool && <MyComponent />.
[x] I verified that comments were added to code that is not self explanatory
[x] I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
[x] I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method

[x] If any non-english text was added/modified, I verified the translation was requested/reviewed in #expensify-open-source and it was approved by an internal Expensify engineer. Link to Slack message:

[x] I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
[x] I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is approved by marketing by adding the Waiting for Copy label for a copy review on the original GH to get the correct copy.
[x] I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
[x] I verified the JSDocs style guidelines (in STYLE.md) were followed

[x] If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
[x] I followed the guidelines as stated in the Review Guidelines
[x] I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
[x] I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
[x] I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
[x] I verified that if a function's arguments changed that all usages have also been updated correctly
[x] If a new component is created I verified that:

[x] A similar component doesn't exist in the codebase
[x] All props are defined accurately and each prop has a /** comment above it */
[x] The file is named correctly
[x] The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
[x] The only data being stored in the state is data necessary for rendering and nothing else
[x] If we are not using the full Onyx data that we loaded, I've added the proper selector in order to ensure the component only re-renders when the data it is using changes
[x] For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
[x] Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
[x] All JSX used for rendering exists in the render method
[x] The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions

[x] If any new file was added I verified that:

[x] The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory

[x] If a new CSS style is added I verified that:

[x] A similar style doesn't already exist
[x] The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(themeColors.componentBG))

[x] If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
[x] If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
[x] If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
[x] If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
[x] If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
[x] If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
[x] I have checked off every checkbox in the PR author checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: Native
https://github.com/Expensify/App/assets/85628901/387146f5-b392-4ab8-822b-1e33385ce9bd

Android: mWeb Chrome
https://github.com/Expensify/App/assets/85628901/01143a2f-71a1-4303-81d6-8ae43eb28cf3

iOS: Native
https://github.com/Expensify/App/assets/85628901/bf9039ec-231a-4e6b-b934-8f14c6f3af56

iOS: mWeb Safari
https://github.com/Expensify/App/assets/85628901/558f55a3-0e21-48d7-bb89-ba2b2f5e429f

MacOS: Chrome / Safari
https://github.com/Expensify/App/assets/85628901/98d3a1fc-2f20-4004-8769-dbcb5532e576

MacOS: Desktop
https://github.com/Expensify/App/assets/85628901/26cfc282-81af-49a4-a2d4-0a5b4ffa5f71

Thanks @fabioh8010 ! I implemented your suggestions and it's ready for re-review

TS failing. I'm looking for a fix

Tests are failing 😢

@blazejkustra @MaciejSWM please let me know when this one is ready to review! Until there, I will uncheck this one from the spreadsheet.

@thesahindia We would appreciate if you could work on the reviewer checklist this week as this PR is blocking other migration PRs, thanks!

Friendly buump @allroundexperts

@allroundexperts kind bump 😄

🚀 Deployed to staging by https://github.com/mountiny in version: 1.3.99-0 🚀

platform
result

🤖 android 🤖
success ✅

🖥 desktop 🖥
success ✅

🍎 iOS 🍎
success ✅

🕸 web 🕸
success ✅

🚀 Deployed to production by https://github.com/roryabraham in version: 1.3.99-0 🚀

platform
result

🤖 android 🤖
success ✅

🖥 desktop 🖥
success ✅

🍎 iOS 🍎
success ✅

🕸 web 🕸
success ✅

🚀 Deployed to staging by https://github.com/mountiny in version: 1.4.0-0 🚀

platform
result

🤖 android 🤖
success ✅

🖥 desktop 🖥
success ✅

🍎 iOS 🍎
success ✅

🕸 web 🕸
success ✅


Labels/Arrow not showing properly

I have to use the hint for the introduce some of the features of my website, But there is some issues in showing labels and arrows.
Would you please let us know how can I fix it?

Even I have same kind of problem on my mobile site!