APIM 4.0 profile doc needs to be update

Following doc is oudated [1]
Issues

api-publisher, api-devportal  profiles have been deprecated so therefore it would be best if we can mention these as well,
In the doc  i noticed the examples needed to be update
In the startup commands section gateway profile should be -Dprofile=gateway-worker and - is missing in the traffic manager profile example

Sample command
sh profileSetup.sh -Dprofile=api-publisher
Error
Profile is not specified properly, please try again
[1] - https://apim.docs.wso2.com/en/latest/install-and-setup/setup/distributed-deployment/product-profiles/#running-the-api-m-profiles

3.) This has been already fixed.


Bump version to 2.1.6

What does this PR do?
Bump version to 2.1.6 in preparation for release
What ticket does this PR close?
Resolves #73
Checklists
Change log

[X] The CHANGELOG has been updated, or
[ ] This PR does not include user-facing changes and doesn't require a CHANGELOG update

Test coverage

[ ] This PR includes new unit and integration tests to go with the code changes, or
[X] The changes in this PR do not require tests

Documentation

[ ] Docs (e.g. READMEs) were updated in this PR, and/or there is a follow-on issue to update docs, or
[X] This PR does not require updating any documentation

@izgeri Yes, the notices were updated as part of this commit:
https://github.com/cyberark/cloudfoundry-conjur-buildpack/commit/5ab18790822dd996c9ea8bdc975280c88c12436c

@izgeri Yes, the notices were updated as part of this commit:
https://github.com/cyberark/cloudfoundry-conjur-buildpack/commit/5ab18790822dd996c9ea8bdc975280c88c12436c


MOON-317: Add the ability to set a color to icons and add more icons

JIRA

https://jira.jahia.org/browse/MOON-317
Description

Added icons: Page, Archive, Unarchive, ZoomIn, ZoomOut, FilePDF, FileText, FileSound, FileVideo, FileCode, FileFont, FileDoc, FileExcel, FilePowerPoint
Updated icons: FileCompressed, FileImage, File
Removed icon Pdf
Add the ability to set a color to icons with the prop color. The accepted colors are blue, red, yellow, green, purple, and gray.

It could be interesting to have a default color in some icons (powerpoint, word, ...), so that they display in "color" when no color is specified.
Note that it will not be possible (actually, quite hard and mainly inconsistent) to set the color depending on the file type from jcontent - we can only choose an icon component based on the type.

Actually it is possible with the current code but not really scalable and consistent (current code is not even the same for grid and table view, and will need to be refactored anyway)


CAMEL-16051: Add usePublisherConnection option

Allow developers to configure usePublisherConnection property of the underlying RabbitTemplate

Please build the component and the whole camel tree, the PR is not complete

Is it better now?

Please build the component and the whole camel tree, the PR is not complete

Is it better now?


Preserve stack frames to show where event came from

The re-frame router uses an FSM to process events, and puts events in a queue to be processed. This has many advantages, but one of the disadvantages is that you lose the context for where the event was originally called from. For example:

Here we can see the stack trace that led to the error, but it stops at the onmessage trigger, and we don't know which part of our code called the dispatch that led to it. It would be great if we could keep stack frames from the dispatch call around.
https://datahero.com/blog/2014/05/22/node-js-preserving-data-across-async-callbacks/
https://bugs.chromium.org/p/chromium/issues/detail?id=332624

As a solution, I'm wondering if you could write your own function called, say, emit and use it in place of dispatch everywhere.  emit would look something like this:
(defn emit
   [event-vec]
   (when ^boolean js/goog.DEBUG console.trace((str v))
   (re-frame/dispatch event-vec))

Or go to the effort of writing emit as a macro.

Here's another example where the stack trace tells you almost nothing:

Via slack discussion, @darwin introduced me to a sneaky idea which I'll quickly note here so it doesn't get lost:

Create a macro called say dispatch2
Within this macro, create an anonymous function which wraps console.log
Attach this anonymous function to the event's metadata, perhaps using the :logger key.
When later it comes time to report what event is being processed, use this :logger obtained from the event itself.

As a result the log message produced will appear to come from the place where the anonymous function itself was defined, which will be the point of the dispatch itself.

So this ticket is about remembering where a dispatch happens.  If there are problems in the handling of that event, it is useful to know here it originally came from.  The async nature of event handling means stack traces are useless because they report that the event came from the scheduling software (and not the dispatch point).
So, my cunning plan was to capture the stack in dispatch and attach it as meta-data to the event being dispatched.  Later, if ever there was a problem, this stack could be printed, showing from wence the event came.  Easy, right?   No need for macros. Nice solution!!
Except, except ... every effort I've made has foundered on the rocks of source-maps. It is easy to capture the stack in dispatch but getting a source-mapped version of the stack for later use is ... infuriatingly unreliable.
For the record, capturing the stack in dispatch is easy:
(let [ stack (.-stack (js/Error.))]
    ....

stack ends up being s string. "Error:\n .....  ".  That first "Error" line needs to be trimmed.  And the reported stack includes dispatch as the top stackframe , so ideally we'd trim that away as well, but at that point we have the true dispatch point.  Probably Good enough.
The trimmed stack can then be added as metadata to the queued event in here: https://github.com/Day8/re-frame/blob/3246265483016b2986baa81fbfd11ef4acb8a7b9/src/re_frame/router.cljs#L208
    (enqueue event-queue (with-meta event-v  {:stack stack}))

But...
That stack has a nasty habit of not being source-mapped when later printed. And I can't for the life of me figure out why. Sometimes it works, sometimes it doesn't.  There is something really fundamental I'm missing.
Just. Can't. Get. It. To. Work. Damnit.
Does anyone else have experience with this kind of thing.
The test is to put a (.log js/console (some-> event-v meta :stack))  in here:
https://github.com/Day8/re-frame/blob/3246265483016b2986baa81fbfd11ef4acb8a7b9/src/re_frame/router.cljs#L147

I have some theory:
1, (.-stack (js/Error.)) is never source mapped
2. Chrome DevTools can sometimes translate stack traces to source mapped stack traces during console printing (probably based on some heuristics, depending on DevTools' source-maps subsystem state, on best-effort basis)
I'm pretty sure about point 1 because they cannot break ECMAScript specs and break old code.

Note to self:  https://github.com/v8/v8/wiki/Stack-Trace-API

Further note, look at what @darwin has done:
https://github.com/binaryage/cljs-devtools/commit/86dbbbbeca5725547ead2f7b852743a7176413f7

From Clojurians Slack

The trick is to replace goog.async.nextTick with a promise-based implementation. ES6 promises participate in Chrome DevTools “async” feature. it is not super useful ATM, because maxAsyncStackChainDepth is currently hard-coded in DevTools and set to only 4, which is not enough for more complex core.async code:
https://github.com/binaryage/dirac/blob/devtools/front_end/sdk/DebuggerModel.js#L200 but in Dirac I can lift that number and maybe walk the call stack in a better way, so loops won’t create long stack traces

The ball is on their side now:
https://bugs.chromium.org/p/chromium/issues/detail?id=622506

Right I have done some investigation and there seem to be a couple of things happening.

(.-stack (js/Error.)) is never source mapped
Chrome devtools does seem to translate links that are printed to console through LinkifyStackTrace
This seems to never be called when less than half of the stack does not have a source map and instead linkifyStringAsFragment is used. I can't seem to find where this decision is made however.

This bites re-frame in the ass as dispatches from view code tend to be only a couple of frames deep from react (which is not mapped). In the meantime as a stopgap I have removed the react lines from the stack trace and passed this through.

In action here: https://github.com/binaryage/cljs-oops/blob/master/src/lib/oops/core.clj#L256

Any updates or should it be closed?

Gotcha, just trying to make sure open issues are active or closed.

So this issue has taken a few twists and turns, but it is essentially about knowing from whence an event originates - the source code coordinates.
I’ve asked around a few re-frame regulars and they don’t feel this is a strong requirement anymore. At best they say “I guess it might be nice to have, maybe”  but with no strength.
So, I’m going to close this issue.
However, before I do, I’ll note here an approach that @mike-thompson-day8 tells me he considered at one point (he is a coworker), so that this information is retained, should this issue ever come back to life and become more pressing again.
If ever this was to be done:

We’d need to change the event queue to be a vector of maps, not just a vector of events, as it is currently.
Each map in this vector would have to capture not only the event, but the source code coordinates for its dispatch
We could then change dispatch so that its argument could be either the event (as it is now) or a full map with source code coordinates, etc.  (Ie. I wouldn’t attach source code coordinates to the event as meta data, which was proposed at one point)
Then I’d add an “emit” macro as an alternative to dispatch which programmers would use when they cared to capture source code coordinates. A macro, of course, has the ability to know source code coordinates. And this “emit” could then call dispatch with a map.
Open question: what to do about effects like “:dispatch” and “:dispatch-later” etc?  They shouldn’t record source code coordinates, they should instead record the event which triggered them.
Open question: how would this information be logged and, later, shown in re-frame-10x

There was a subsequent discussion on Clojurians Slack between @p-himik @kennyjwilli and @mike-thompson-day8 of which some interesting notes are:

If there is a compelling use case for re-opening this feature, please make it on this issue. We will review. Comments are still open.

Keeping backwards compatibility of the event queue (i.e. the vectors) might be worthwhile. Although an internal impl detail, some things like re-frisk might use it. Meta vs data structure change was tabled as an open question.

Re :dispatch and :dispatch-later the proposal is that an event will now be queued as map of values. Each map in the queue could have a string :source field which EITHER indicates the source code coordinates or it could say "dispatched as an effect when processing event [:id arg1]". Because there would be no source code coordinates, no need for macro magic.  You are just getting the event which triggered the :dispatch  effect. But these are just ideas at this point.


Added self contained networks and Darknet resources

Added self contained networks and Darknet resources with domain extensions of Darknet websites.

Thank you for your work! Appreciate it 👍


[CRASH]  (Unix.Unix_error "No child processes" waitpid  "((mode (WNOHANG)) (pid 172))")

Only one occurrence of this, this is low priority compared to other crashes.
(monitor.ml.Error
  (Unix.Unix_error "No child processes" waitpid
    "((mode (WNOHANG)) (pid 172))")
  ("Raised at file \"src/core_unix.ml\", line 50, characters 4-43"
    "Called from file \"src/core_unix.ml\", line 930, characters 4-246"
    "Called from file \"src/unix_syscalls.ml\", line 596, characters 10-39"
    "Called from file \"src/unix_syscalls.ml\" (inlined), line 602, characters 21-55"
    "Called from file \"src/unix_syscalls.ml\", line 610, characters 33-48"
    "Called from file \"camlinternalLazy.ml\", line 27, characters 17-27"
    "Re-raised at file \"camlinternalLazy.ml\", line 34, characters 4-11"
    "Called from file \"src/process.ml\" (inlined), line 142, characters 13-25"
    "Called from file \"src/process.ml\", line 148, characters 25-31"
    "Called from file \"src/deferred0.ml\", line 56, characters 64-69"
    "Called from file \"src/job_queue.ml\" (inlined), line 131, characters 2-5"
    "Called from file \"src/job_queue.ml\", line 171, characters 6-47"
    "Caught by monitor coda"))

Fixed by #7611, closing.


fix(generator, builder): empty build and dist directories instead of remove

fixes #5344
Types of changes

[x] Bug fix (a non-breaking change which fixes an issue)
[ ] New feature (a non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)

Description
Instead of removing and recreating the dist and build directories they are emptied.
In case they do not exists they are still created by the emptyDir function.
Checklist:

[ ] My change requires a change to the documentation.
[ ] I have updated the documentation accordingly. (PR: #)
[x] I have added tests to cover my changes (if not applicable, please state why)
[x] All new and existing tests are passing.

Codecov Report

Merging #7361 into dev will not change coverage.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##              dev    #7361   +/-   ##
=======================================
  Coverage   70.70%   70.70%
=======================================
  Files          88       88
  Lines        3595     3595
  Branches      975      975
=======================================
  Hits         2542     2542
  Misses        854      854
  Partials      199      199

Flag
Coverage Δ

#unittests
70.70% <100.00%> (ø)

Impacted Files
Coverage Δ

packages/builder/src/builder.js
90.40% <100.00%> (ø)

packages/generator/src/generator.js
86.66% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 42406d6...f982fa1. Read the comment docs.

Thank you!

Thanks @TimvdEijnden

Nice @TimvdEijnden! Thanks


Upgrade Quarkus base version to 2.16.12.Final

Following the release of Quarkus 2.16.12.Final and Red Hat Build of Quarkus 2.13.8 on the 20th October^1, upgrade to Quarkus 2.16.12.Final.

/retest

Closed, deprecated by https://github.com/trustyai-explainability/trustyai-explainability/pull/409


add Dapp demo  doc

Could you replace xmind with other opensource formats? It's not friendly to GitHub compare and developers.

Could you replace xmind with other opensource formats? It's not friendly to GitHub compare and developers.

Let's organize it uniformly later.


[bug] Can no longer highlight and right click selection in latest beta release..

Prerequisites

[x] Put an X between the brackets on this line if you have done all of the following:

Reproduced the problem in Safe Mode: http://flight-manual.atom.io/hacking-atom/sections/debugging/#using-safe-mode
Followed all applicable steps in the debugging guide: http://flight-manual.atom.io/hacking-atom/sections/debugging/
Checked the FAQs on the message board for common solutions: https://discuss.atom.io/c/faq
Checked that your issue isn't already filed: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aatom
Checked that there is not already an Atom package that provides the described functionality: https://atom.io/packages

Description
Dunno exactly when this happened but it must of been at some point in the past 24 hours.. but the issue I am facing is this:
Whenever I highlight a section (several lines) or even just 1 line or word if I right click in the editor window to bring up the context menu it unhighlights everything that I had highlighted not allowing me to copy multiple lines or anything else that I can do in the context menu..
Steps to Reproduce

make a few lines
highlight all lines
right click
it unhighlights everything

Expected behavior: [What you expect to happen]
for everything that I highlighted to stay highlighted when right clicking in the editor window to open the context menu..
Actual behavior: [What actually happens]
unhighlights everything I had highlighted when I right click in the editor window
Reproduces how often: 100%
Versions
happens in version 1.24.0-beta1
doesn't happen in version 1.23.1
Additional Information
This happens on both a clean install, in --safe mode, uninstalling and then reinstalling, with and without extensions.

Thanks for the report!

happens in version 1.24.0-beta1
doesn't happen in version 1.23.1

I can reproduce this in 1.24.0-beta1 on macOS 10.12.6 though I also saw it in 1.24.0-beta0 before i updated.  Also confirmed not an issue in 1.23.1.
@nathansobo @as-cii?

I merged the fix for this a few hours ago and was just about to put it on the release branches.

ahhh sorry totally missed https://github.com/atom/atom/issues/16324.


announce HHVM 4.110

@fredemmott Should I mention anything about https://github.com/facebook/hhvm/commit/fd09020a0a3a4c5375fc0d1e2ee45b6ee8c590d0 in this week's release notes or is it not ready yet?


daemon.js problem

when I run  daemon.js script I keep getting this error Remote/hack-target.js omega-net<PHONE_NUMBER>768 44887 Batch 11-hack 1 0 0 or hack failed to steal money.

This is only a "warning" and is normal. Misfires happen from time to time as your hack stat grows and hack cycles (especially those planned far in advance) complete with different timings than expected.
Unless you are seeing a steady stream of these warnings (e.g. one every second for several minutes) there's nothing to worry about.
If you are seeing dozens or hundreds of these warnings, then it's a sign your game is lagging. Check out Bitburner #batching discord channel for more info on misfires and why they are a fact of life.

Finally, if you find these annoying, create a new settings files with nano daemon.js.config.txt and give it the contents { 'silent-misfires': true } - you'll never see a warning like this again.


Add Sputnik Search Engine Bots to bot lists

See github issue: https://github.com/WhichBrowser/Parser-PHP/issues/506

Coverage increased (+0.02%) to 99.97% when pulling dd132898038e5b4be83707cc63b1da5c7fe987d9 on ayumi-cloud:Sputnik into 880b9fa797401d14b28956442944c3daa70240ff on WhichBrowser:master.

Closed by afaa93a5fc36d33332b45cb2db250b6c29eb2500

Closed by afaa93a5fc36d33332b45cb2db250b6c29eb2500


add(tools): Tailwind CSS Gradient Generator

Name
Link

Tailwind CSS Gradient Generator
_https://tailwindcomponents.com/gradient-generator_

Create perfect gradients for your Tailwind CSS sites easily with zero lines of code.

[x] My item is in the right category
[x] My item is logically grouped below similar items
[x] My item's name and description respects the conventions of the list
[x] My item is awesome
[x] My item is in line with the Tailwind brand usage guidelines
[x] I have read and followed the contribution guidelines

Thank you!


Quinn Cook messing up my code?

Hi,
So what I am trying to do is create a dataset of NBA players and their stats. The code works fine until it gets to Quinn Cook.
The code returns "TypeError: 'NoneType' object is not iterable" as it runs through LAL. When I go to the Lakers sports ref page, Cook is double entered AND his page doesn't load. Is there anything I can do to fix this or do I pretty much have to wait?
Here is the code:
`from sportsreference.nba.teams import Teams
from sportsreference.nba.schedule import Schedule
from sportsreference.nba.boxscore import Boxscore
import pandas as pd
from datetime import datetime

# Function to get player info from Player class object.
def get_player_df(player):

    # helper function to get year for each row and denote
    # rows that contain career totals.
    def get_year(ix):
        if ix[0] == "Career":
            return "Career"
        elif ix[0] == "1999-00":
            return "2000"
        else:
            return ix[0][0:2] + ix[0][-2:]

    # get player df and add some extra info
    player_df = player.dataframe
    player_df['birth_date'] = player.birth_date
    player_df['player_id'] = player.player_id
    player_df['name'] = player.name
    player_df['year'] = [get_year(ix) for ix in player_df.index]
    player_df['id'] = [player_id + ' ' + year for player_id,
                       year in zip(player_df['player_id'],
                       player_df['year'])]
    player_df.set_index('id', drop = True, inplace = True)

    return player_df

# initialize a list of players that we have pulled data for
players_collected = []
season_df_init = 0
career_df_init = 0
season_df = 0
career_df = 0
# iterate through years.
for year in range(2021, 1999, -1):
    print('\n' + str(year))

    # iterate through all teams in that year.
    for team in Teams(year = str(year)).dataframes.index:
        print('\n' + team + '\n')

        # iterate through every player on a team roster.
        for player_id in Roster(team, year = year,
                         slim = True).players.keys():

            # only pull player info if that player hasn't
            # been pulled already.
            if player_id not in players_collected:

                player = Player(player_id)
                player_info = get_player_df(player)
                player_seasons = player_info[
                                 player_info['year'] != "Career"]
                player_career = player_info[
                                player_info['year'] == "Career"]

                # create season_df if not initialized
                if not season_df_init:
                    season_df = player_seasons
                    season_df_init = 1

                # else concatenate to season_df
                else:
                    season_df = pd.concat([season_df,
                                   player_seasons], axis = 0)

                if not career_df_init:
                    career_df = player_career
                    career_df_init = 1

                # else concatenate to career_df
                else:
                    career_df = pd.concat([career_df,
                                   player_career], axis = 0)

                # add player to players_collected
                players_collected.append(player_id)
                print(player.name)`

I guess really the best way to get around this is to have an exception raised and it skips that player. Is there any way to do that, where maybe it also lists out those players? I am getting a similar error trying to do this for the NHL, but that player (Daniel Vladar) does have a page.

Reached out directly to sports ref and they stated they will get Quinn Cook fixed.


[Snyk] Security upgrade @backstage/theme from 0.0.0-use.local to 0.1.1

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):

plugins/shortcuts/package.json

Note for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠ Warning
Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

Issue
Score

Cross-site Scripting (XSS) SNYK-JS-WEBPACK-7840298
  157

[!IMPORTANT]

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:
🦉 Cross-site Scripting (XSS)

🎉 Snyk hasn't found any issues so far.
✅ code/snyk check is completed. No issues were found. (View Details)


[CRITICAL] [SECURITY] Pug variables leak between different executions of rendered templates

To reproduce:
console.log(require('./views/unsupported-browser.pug')({
  baseHref: '/admin',
}));

console.log(require('./views/unsupported-browser.pug')({

}));

Expected: second rendering should not include /admin.
Actual: second rendering includes /admin.
To reproduce:
Check out https://github.com/Rush/webdiscus-repro and run npm run repro

I think this regressed since 1.4.x

I think you perhaps do Object.assign somewhere to some global variable

Hello @Rush,
thanks for the report.
How critical is it? Does it block you?
I'm just immersed in solving other issues.
In 1-2 days I can look your issue.

Thanks. Not blocked, as I reverted the upgrade already. I had some improvements dependent on 1.7.1 which can wait a few days.

In your repo are missing required files.
This makes it difficult to reproduce the problem described in the ticket.
To reproduce concrete the issue, must be removed the line include ./fonts-preload in the file sharedLayout.pug.

Sorry, I added the missing file.

It's ok :-),
I have found the problem and soon release the fix.

The issue is fixed in the version 1.7.3.

Thank you, fixed


WebAuthn works locally, but not in production

Hi there, I've setup WebAuthn and got it working great locally, so in preparation for pushing to prod, I changed the rpID and origin respectively. This works semi-okay, on production, registration of both passkeys (Macbook Touch ID in this instance) and security keys work. However, when I go to authenticate with a security key, I receive this error:
NotSupportedError: Unrecognized name.
from verifyAuthenticationResponse. If I attempt to login with a passkey, it works fine.
This is a non-issue on local, so I'm hoping you'd be able to shed some light onto what this error means?
Thank you!

I'll need to see some code. For now please show me how you're calling generateAuthenticationOptions() or startAuthentication() (it's unclear if you're using SimpleWebAuthn end-to-end, or only using one or the other.) Right now it sounds to me like this is an issue within the browser, before verifyAuthenticationResponse() ever gets called, so it's probably something about the options that are making it to the actual WebAuthn API call within startAuthentication().

Sure. Here's how I'm calling generateAuthenticationOptions():
`const user = await collection.findOne({id: req.session!.getUserId()});
const rpID =
process.env.NODE_ENV === "development"
? "localhost"
: "dashboard.file.glass";
const userAuthenticators = user?.u2f?.authenticators;
const options = generateAuthenticationOptions({
    timeout: 60000,
    userVerification: 'preferred',
    rpID,
});

const response = {
...options,
allowCredentials: userAuthenticators.map((authenticator: { credentialID: any, transports: any }) => ({
id: authenticator.credentialID,
type: 'public-key'
})),
}
res.status(200).json(response);`
You might be wondering why I'm adding the 'allowCredentials' in the response rather than the options itself - it's because for some reason if I add the exact same allowCredentials code in the options, the id value is always empty, adding it into the response itself is the only way I could get it to work. Maybe you could shed some light on that as well?
Here's how I am calling startAuthentication():
asseResp = await startAuthentication(response.data);   const verificationResponse = await axios.post("/api/user/account/u2f/authentication/verifyAuthenticationResponse", asseResp);

I'll include the code snippet to startAuthentication as well:
const response = await axios.get("/api/user/account/u2f/authentication/generateAuthenticationOptions");
        let asseResp;
        asseResp = await startAuthentication(response.data);

You might be wondering why I'm adding the 'allowCredentials' in the response rather than the options itself - it's because for some reason if I add the exact same allowCredentials code in the options, the id value is always empty, adding it into the response itself is the only way I could get it to work. Maybe you could shed some light on that as well?

Based on the fact that your allowCredentials can be returned as JSON without any extra work, I'm guessing the type of id (authenticator.credentialID) is string. Is this correct? If so that's going to be why you can't pass them in as the allowCredentials argument for generateAuthenticationOptions() - the method expects id to be a Uint8Array (or a subclass of it like Node's Buffer.)
I confirmed it just now:
console.log(generateAuthenticationOptions({
  allowCredentials: [{
    id: 'E_Pko4wN1BXE23S0ftN3eQ' as any,
    type: 'public-key',
  }],
}));
// {
//   challenge: 'si_omE1UAfeQo5OZxc60dL1PybHZ5O1HD3AFlYwLtrw',
//   allowCredentials: [ { id: '', type: 'public-key' } ], // <-- See `id` is an empty string here
//   timeout: 60000,
//   userVerification: 'preferred',
//   extensions: undefined,
//   rpId: undefined
// }

I'll include the code snippet to startAuthentication as well:

Let's see both full values of response.data, the one for localhost and the one for production.

Sure.
Localhost:
{
"challenge": "2XMfA-ExsMCdUTaQBhp6NObQLqyTLJwFU43cbQFo3vM",
"allowCredentials": [
   {
     "id": "obwcOYa/mAykrxchp4vS/gM0DGEANmRiDQUdAJN+0Xzbn2BjcZJ+ECPMHug1Inp1",
     "type": "public-key"
   }
],
"timeout": 60000,
"userVerification": "preferred",
"rpId": "localhost"
}

And production:
{
"challenge": "CKUSx8nD06FtXg2q_T3yZYpbYs85ydorE2MUxs5TuHg",
"allowCredentials": [
   {
     "id": "zByoK93+eosQIwnR77pX69x6G9ggiXYlmKrawIK704nw4+gOHveabtuBxkx3g0zh",
     "type": "public-key"
   }
],
"timeout": 60000,
"userVerification": "preferred",
"rpId": "dashboard.file.glass"
}

I've also implemented a fix for the allowCredentials, it is now working as expected when included in 'options', however the "Unrecognized name." error still presents.

Bizarre, nothing appears to be wrong with how you're invoking WebAuthn. And if you're able to use a passkey with this same setup then I'm wondering if it's an authenticator issue.

However, when I go to authenticate with a security key, I receive this error:

What security key are you using for this?

It's quite odd, really. I'm using a Yubico 5 NFC & 5C NFC - same issue with both.

What's the RP ID you set during registration? Is it the same as the one you specify during authentication?
And this is interesting, when I searched for "unrecognized name" I found a lot of hits related to SSL issues...I wonder if this is somehow related. All I have left at this point is straws to grasp at.
https://duckduckgo.com/?q=webauthn+"Unrecognized+name"&t=iphone&ia=qa

What's the RP ID you set during registration? Is it the same as the one you specify during authentication?

Yeah, "rp":{"name":"Fileglass","id":"dashboard.file.glass"}is retrieved from generateRegistrationOptions, and rpId":"dashboard.file.glass". is retrieved from generateAuthenticationOptions. However I assume they're the same.
An SSL issue could be it, since it works on localhost - but my SSL configuration is handled by Vercel so I'm not sure how I'd go from there in the event that's what the issue is.
For now I've just enforced "internal" transports only, until I can figure out how to get security keys to work on prod, such a random issue!

Well, might as well ask, what browser are you testing in? Is that security key error consistently coming up in other browsers you've tried too?

I've tried in Arc (Chromium) & Safari on macOS + Firefox on Windows. Same issue unfortunately. 🙁

For want of an answer, I posted your problem to the fido-dev mailing list. Let's see if anyone has any insights: https://groups.google.com/a/fidoalliance.org/g/fido-dev/c/fQTxWcAU20Y

You can activate some debug logs on Windows (to get the CTAP message exchanged) and Chrome (to get the API call to WebAuthn and the detailed errors).
Yubico made a FAQ on this! https://support.yubico.com/hc/en-us/articles/4404763857042-How-to-collect-FIDO-WebAuthn-logs
Had I known this, I wouldn't have invested so much in my own debug tools. :D

Additionally, if you need to go deeper, you can install Wireshark and sniff USB HID or USB CCID coms.

You can activate some debug logs on Windows (to get the CTAP message exchanged) and Chrome (to get the API call to WebAuthn and the detailed errors).
Yubico made a FAQ on this! https://support.yubico.com/hc/en-us/articles/4404763857042-How-to-collect-FIDO-WebAuthn-logs
Had I known this, I wouldn't have invested so much in my own debug tools. :D

Thank you for this, I grabbed the logs during authentication with my Yubico security key(s) and it does look like an error occurs, however I was unable to find any information relating to this error.
[2023/02/09 09:42:37.841791] ctap2_device_operation.h:185 -> {1: {"id": h'138B4110FFD32D8D4840A2D83B57D3E2F5ACD84EB751161D519D8292733A9147CC979A786A76AACA7CFF430CB1C2C755', "type": "public-key"}, 2: h'BC692D97B40940EFC7065D9AA654E9B64CF3296A95B3680A4A8860E4CB7DA8A70500000004', 3: h'4DCC473DACDDF8FB558AE7C2BDE367DCE475BAC73616A7F4FF5ADC1BB6305231DD95325205F3711B48893C206A7C913183DAE860C43C3D7CE4162BEC10862E03', 4: {"id": h'34363231366131372D616561372D343837612D393836382D376635313066633237303966'}}

FIDODebug[2023/02/09 09:42:37.209295] ctap2_device_operation.h:87 <- 2 {1: "dashboard.file.glass", 2: h'98602BC3AB8B2670939D939ED12F2EDE63F2191C4664968E9743D0112BB507E5', 3: [{"id": h'138B4110FFD32D8D4840A2D83B57D3E2F5ACD84EB751161D519D8292733A9147CC979A786A76AACA7CFF430CB1C2C755', "type": "public-key"}, {"id": h'42ADC516DF93095AFC4B9BB0565D6BCF20E2277C8B66665D1524F0C585AC15EA', "type": "public-key"}], 6: h'09BEF9C8ABB34CEF831ECA3D4018CE854E5A0373035667C009869650C9338EF8', 7: 2}

FIDODebug[2023/02/09 09:42:37.194000] ctap2_device_operation.h:185 -> {2: h'24CA67621399E96375B643FA759C2797FD5C04AF8596BBE9359D61BB5ACACCEB143662C295F46F748265FECE9ABCCB99'}

FIDODebug[2023/02/09 09:42:37.108173] ctap2_device_operation.h:87 <- 6 {1: 2, 2: 5, 3: {1: 2, 3: -25, -1: 1, -2: h'D33A15D9C6A1965B1013611F5685226993A3CA0BE5E71841BA42941A59A35D1C', -3: h'2F4D302648760B05508FC3B43FA34BDE62164174A2BB067DDD20AA974F989C5E'}, 6: h'1C2DCC775070C3D5972055AEBB809E0CB23E99AAFD5DCA091CF54EB64E53CD9B'}

FIDODebug[2023/02/09 09:42:37.107831] ctap2_device_operation.h:185 -> {1: {1: 2, 3: -25, -1: 1, -2: h'56241A3C2A00A55D8053EFE29A6E933A21C2188D70FEC9EC756E9FDA24762661', -3: h'31A5D438E84D36E3B35A4F1808935FFD55A38F3BFE8B581AF027025B1DCD2789'}}

FIDODebug[2023/02/09 09:42:37.101218] ctap2_device_operation.h:87 <- 6 {1: 2, 2: 2}

FIDODebug[2023/02/09 09:42:35.523877] ctap2_device_operation.h:185 -> {3: 8}

FIDODebug[2023/02/09 09:42:35.519256] ctap2_device_operation.h:87 <- 6 {1: 2, 2: 1}

FIDODebug[2023/02/09 09:42:35.518022] ctap2_device_operation.h:136 -> (CTAP2 error code 49)

FIDODebug[2023/02/09 09:42:34.750293] ctap2_device_operation.h:87 <- 1 {1: h'E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855', 2: {"id": ".dummy"}, 3: {"id": h'01', "name": "dummy"}, 4: [{"alg": -7, "type": "public-key"}], 8: h'', 9: 1}

FIDODebug[2023/02/09 09:42:34.750249] fido_device.cc:80 The device supports the CTAP2 protocol.

FIDODebug[2023/02/09 09:42:34.750234] device_response_converter.cc:288 Unexpected protocol version received.

FIDODebug[2023/02/09 09:42:34.750228] device_response_converter.cc:265 -> {1: ["U2F_V2", "FIDO_2_0", "FIDO_2_1_PRE"], 2: ["credProtect", "hmac-secret"], 3: h'2FC0579F811347EAB116BB5A8DB9202A', 4: {"rk": true, "up": true, "plat": false, "clientPin": true, "credentialMgmtPreview": true}, 5: 1200, 6: [2, 1], 7: 8, 8: 128, 9: ["nfc", "usb"], 10: [{"alg": -7, "type": "public-key"}, {"alg": -8, "type": "public-key"}], 13: 4, 14: 328707}

FIDODebug[2023/02/09 09:42:34.719872] fido_device.cc:49 Sending CTAP2 AuthenticatorGetInfo request to authenticator.

FIDODebug[2023/02/09 09:42:34.719531] android_accessory_discovery.cc:81 Android accessory discovery started

FIDOEvent[2023/02/09 09:42:34.719419] get_assertion_request_handler.cc:326 Starting GetAssertion flow

FIDODebug[2023/02/09 09:42:34.719218] chrome_authenticator_request_delegate.cc:726 Found 0 caBLEv2 devices

CTAP2 error code 49
This looks like CTAP2_ERR_PIN_INVALID.

Interesting. I've tried resetting the PIN a couple of times and it seems to do the same - any ideas?

@joshtblack If you're interested in continuing this along, can you download and install the YubiKey Manager application, run it, and then report the Firmware versions for your two keys? It should look something like this:

I can pass this info along to someone else who might be able to shed some light on what's going on.

@joshtblack If you're interested in continuing this along, can you download and install the YubiKey Manager application, run it, and then report the Firmware versions for your two keys? It should look something like this:

I can pass this info along to someone else who might be able to shed some light on what's going on.

Sure, both keys are on Firmware 5.4.3.

@joshtblack Regarding the "unrecognized name" error message, that sounds like a problem with TLS Server Name Indication (SNI).
Does you code perform backend calls to dashboard.file.glass? That seems to be a vercel.com site requiring SNI as it is hosting different sites on the same IP:
$ echo HEAD / | openssl s_client -connect dashboard.file.glass:443  | openssl x509 -noout -subject
...
subject= /CN=zeit.co
$ echo HEAD / | openssl s_client -connect dashboard.file.glass:443 -servername dashboard.file.glass | openssl x509 -noout -subject
...subject= /CN=dashboard.file.glass

Now SNI is well-supported by browsers so this should not be an issue, unless perhaps there is some old proxy in between that terminates the TLS connection?
To rule out SNI issues: can you try running your backend code on a different server that does not require SNI? Perhaps running your localhost instance through ngrok or something similar?
Just a hunch - but probably easy to test.

@joostd Well, interestingly enough - when my localhost environment via ngrok, everything works perfectly with no error. Does this boil down to some kind of Vercel issue?

@joshtblack hard to tell without knowing more details on your setup. But this seems to support my theory of SNI being the issue.
If I understand correctly, a Vercel-hosted server is used in a backend-call from JavaScript in the browser, failing with a DOMException (the NotSupportedError). The embedded error message is "Unrecognized name", indicating the HTTPS request is done using a client not supporting SNI.
Can you tell us more about that client? Is it using a framework of some sort? Or is it going through a proxy that does not support SNI?
You can verify if the client (the component initiating the backend call) is using SNI to connect to the correct virtual host?
This can be done using Wireshark (using a GUI) or with tshark (using a CLI) as follows:
# tshark -i1 -Y 'tls.handshake.extensions_server_name contains "dashboard.file.glass"'

(you may need to use a different interface number)
If the client uses SNI, tshark will output something like:
12614  27.955638 <IP_ADDRESS> ? <IP_ADDRESS> TLSv1 382 Client Hello

If there is no output when you get the UnsupportedError, the client is not using SNI and you will need to find something that does.

I'll look into SNI more tomorrow - though I'll provide some info;
It's Next.js with API routes for the WebAuthn. So on the same server essentially.

+1 to @joostd's comment. I think ngrok serves the right cert (wildcard SAN) even without SNI, which may also support that. And yes, Vercel can't support non-SNI clients.
But I would be surprised if that's actually the case, because then this client must be having a hard time in TLS with a lot of websites as well 🤔
FYI, our supported TLS versions and ciphers are mentioned here:
https://vercel.com/docs/concepts/edge-network/encryption#supported-tls-versions

(you may need to use a different interface number) If the client uses SNI, tshark will output something like:
12614  27.955638 <IP_ADDRESS> ? <IP_ADDRESS> TLSv1 382 Client Hello

If there is no output when you get the UnsupportedError, the client is not using SNI and you will need to find something that does.

 Do you get any TLS errors? Could you please share the full output?

Sure, here's the full output:
*   Trying <IP_ADDRESS>:443...
* Connected to dashboard.file.glass (<IP_ADDRESS>) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
} [325 bytes data]
* (304) (IN), TLS handshake, Server hello (2):
{ [122 bytes data]
* (304) (IN), TLS handshake, Unknown (8):
{ [15 bytes data]
* (304) (IN), TLS handshake, Certificate (11):
{ [4039 bytes data]
* (304) (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* (304) (IN), TLS handshake, Finished (20):
{ [36 bytes data]
* (304) (OUT), TLS handshake, Finished (20):
} [36 bytes data]
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=dashboard.file.glass
*  start date: Jan 10 05:17:21 2023 GMT
*  expire date: Apr 10 05:17:20 2023 GMT
*  subjectAltName: host "dashboard.file.glass" matched cert's "dashboard.file.glass"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* h2h3 [:method: GET]
* h2h3 [:path: /]
* h2h3 [:scheme: https]
* h2h3 [:authority: dashboard.file.glass]
* h2h3 [user-agent: curl/7.86.0]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x13a813400)
> GET / HTTP/2
> Host: dashboard.file.glass
> user-agent: curl/7.86.0
> accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 200
< accept-ranges: bytes
< access-control-allow-origin: *
< age: 0
< cache-control: public, max-age=0, must-revalidate
< content-disposition: inline
< content-type: text/html; charset=utf-8
< date: Fri, 10 Feb 2023 11:30:19 GMT
< etag: "cf8c5348289a4b7f6a290563a563fdee"
< server: Vercel
< strict-transport-security: max-age=63072000
< x-matched-path: /
< x-vercel-cache: HIT
< x-vercel-id: syd1:syd1::dwn42-1676028619104-5fb6dd075d13
< content-length: 3476
<
{ [3476 bytes data]
* Connection #0 to host dashboard.file.glass left intact

@joshtblack Can you share the full JSON options you pass to startRegistration() for a given registration? I'm particularly curious what you specified for user.name and user.displayName, and if you experience this no matter which user you attempt registration and authentication with in production.
It's been suggested there might be some kind of overflow issue going on within the security key if either of those are too big. It's worth a look while you're getting help about the vercel part of your setup.

The curl output from @joshtblack above suggests that there seems to be no issue with the client's SNI support, as it's getting the right cert.
* Server certificate:
*  subject: CN=dashboard.file.glass
*  start date: Jan 10 05:17:21 2023 GMT
*  expire date: Apr 10 05:17:20 2023 GMT
*  subjectAltName: host "dashboard.file.glass" matched cert's "dashboard.file.glass"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.

https://www.ssllabs.com/ssltest/analyze.html?d=dashboard.file.glass&s=<IP_ADDRESS>&latest
Although someone asked us on Twitter to look into this, I don't see anything wrong with Vercel so far. I'll leave this thread for now, but please ping me if you believe there's an issue on Vercel's side.

Thank you for taking a look, @smaeda-ks (that was me who @'d vercel on Twitter). We appreciate you taking the time to try and shed light on this mystery 🙇

@smaeda-ks if there is a problem with SNI, it would be a problem with the TLS client. Vercel supports SNI just fine. As @joshtblack is hitting the exception even when SNI is being sent (as tshark shows), it may be caused by something different entirely.
Still strange that the issue doesn't occur when using other backends (only confirmed over ngrok so far).

Also @joshtblack, make sure you're not getting any runtime errors when testing this flow on your production Vercel app:
https://vercel.com/docs/concepts/deployments/logs#function-logs

@joshtblack Can you share the full JSON options you pass to startRegistration() for a given registration? I'm particularly curious what you specified for user.name and user.displayName, and if you experience this no matter which user you attempt registration and authentication with in production.
It's been suggested there might be some kind of overflow issue going on within the security key if either of those are too big. It's worth a look while you're getting help about the vercel part of your setup.

Sure;
{
  challenge: 'vyN0fQR4v7220jEkBmU7BDeKTUTqIyYhcWqxStYAXS4',
  rp: { name: 'Fileglass', id: 'dashboard.file.glass' },
  user: {
    id: '46216a17-aea7-487a-9868-7f510fc2709f',
    name: 'noodles',
    displayName: 'noodles'
  },
  pubKeyCredParams: [
    { alg: -8, type: 'public-key' },
    { alg: -7, type: 'public-key' },
    { alg: -36, type: 'public-key' },
    { alg: -37, type: 'public-key' },
    { alg: -38, type: 'public-key' },
    { alg: -39, type: 'public-key' },
    { alg: -257, type: 'public-key' },
    { alg: -258, type: 'public-key' },
    { alg: -259, type: 'public-key' }
  ],
  timeout: 60000,
  attestation: 'none',
  excludeCredentials: [],
  authenticatorSelection: {
    residentKey: 'required',
    userVerification: 'preferred',
    requireResidentKey: true
  },
  extensions: { credProps: true }
}

Also @joshtblack, make sure you're not getting any runtime errors when testing this flow on your production Vercel app: https://vercel.com/docs/concepts/deployments/logs#function-logs

POST request to the verifyAuthenticationOptions endpoint isn't even showing up in Vercel function logs which is weird.

@MasterKale We recently updated to the latest version and began seeing this error (security key worked for registration, but failed with Unrecognized name for authentication). I went back to the previous version we were on 5.4.5 and authentication works fine.

@hwhmeikle Well that's a turn of events. Can you share the JSON authentication options you passed into startAuthentication(), one for each version you tested?

Sure thing:
5.4.5
{
  "challenge": "sBSPxrjxpVlRnvmZs0vGe2neHh545wofxYeGI-bFMPo",
  "allowCredentials": [
    {
      "id": "lmlJQE3DJ4LmBnqaHNrOaU_zvbFcsIbxI-8-Crw_YOe87TYeNGQaI8HRSbkTj1I4L5JTtxU5-TzlstUmQdjpzw",
      "type": "public-key"
    },
    {
      "id": "_P8foni6vdB4NksXXPzrLQ23tLj2KCdokzo0rZWwAbA",
      "type": "public-key"
    }
  ],
  "timeout": 60000
}

7.1.0
{
  "challenge": "IfWtZbNk8JnX3D6wYEtAGkh30ocdO9gvRB11-ufRFyU",
  "allowCredentials": [
    {
      "id": "8ZDbNy_6MWnxDfx7xTmwq_hyKIV11hl7nrEDmwe7MSI",
      "type": "public-key",
      "transports": [
        "internal"
      ]
    },
    {
      "id": "VRPpslZw0dq7diKOQup6RMZo6GVx7Rt7DdmkPQZJEczv9SqI0upR1HQYPHM4eXj15c5OXqPGiiKzshvhC3bfQcWd84DTMgFbFkf7wiIMYTeiwzjU2fjFzgcfaL-UG-lwWExlo1YEyidYtiPYuqnnpBTA-QPVXbwtLSCxpB_grPs",
      "type": "public-key",
      "transports": [
        "nfc",
        "usb"
      ]
    }
  ],
  "timeout": 60000,
  "userVerification": "preferred"
}

@hwhmeikle huh, the only difference is the transports. What happens if you remove those with 7.1.0?

@MasterKale Removed transports and the error still occurs:

@hwhmeikle What OS + version, and browser + version are you experiencing this with?

@MasterKale
OS: macOS Ventura 13.2
Browser: Version 1.48.158 Chromium: 110.0.5481.77 (Official Build) (arm64)](https://brave.com/latest/)

Can you follow the instructions mentioned earlier to capture FIDO logs from Chrom(ium-based Brave)?
https://github.com/MasterKale/SimpleWebAuthn/issues/345#issuecomment-1423113767

Sure thing
FIDODebug[15:58:07] -> {1: {"id": h'694D6C2FB4914FAF69CB73742812A743559C6B6AA89B41670024C138CCFB62B329BF5126FE2A98F0092091EF23DE9665', "type": "public-key"}, 2: h'49960DE5880E8C687434170F6476605B8FE4AEB9A28632C7995CF3BA831D9763050000001F', 3: h'E54EF6EDE345DF4803E55AA43D43080C036BB810604F82F9BD8F65CDFE11572D176745CB0F191E5872CB31EF370A17958A626E8700AD77BBAB43DAAEFD9BB400', 4: {"id": h'7573725F3132313232313234323332333435657733343132'}}

FIDODebug[15:58:05] <- 2 {1: "localhost", 2: h'1F84D4F88D0D6DEC6045EAEDDCAEB7E5185ABEF037EF5EC2178456CA69D3014D', 3: [{"id": h'694D6C2FB4914FAF69CB73742812A743559C6B6AA89B41670024C138CCFB62B329BF5126FE2A98F0092091EF23DE9665', "type": "public-key"}, {"id": h'F190DB372FFA3169F10DFC7BC539B0ABF872288575D6197B9EB1039B07BB3122', "type": "public-key"}], 6: h'52230892E24DF6D9C21F5068C91AB732B654A4D24A0CD2293F3C154203DCB2C7', 7: 2}

FIDODebug[15:58:05] -> {2: h'D55253BBAA1BA58558BC208F36BF08730D4C9D2D302C02D9C6AD2FCC5BBAD20437719278B61E548C83AB8B14B21F6300'}

FIDODebug[15:58:05] <- 6 {1: 2, 2: 5, 3: {1: 2, 3: -25, -1: 1, -2: h'AF4624EEBE5A2F07237B5D96C580DCBBF23C1199F9A5D5A83F2624AC90A7F18F', -3: h'5708F017153733353A876EA4CB5EDC66073141CE62228CC5654D6EC57FA0EED8'}, 6: h'BCD81629EE0F27FD7F8F251221C5E23A7282A36360CD32C7F120A75591F4D7FD'}

FIDODebug[15:58:05] -> {1: {1: 2, 3: -25, -1: 1, -2: h'AD7BC855A994672EF03312195D7D09035632651F04EB2D22A70505828A9A3FE7', -3: h'6B4BC2FD4334AF7A3D34867066CD394D8139F77E44110FAF615BC80353F43EF1'}}

FIDODebug[15:58:05] <- 6 {1: 2, 2: 2}

FIDODebug[15:58:02] -> {3: 8}

FIDODebug[15:58:02] <- 6 {1: 2, 2: 1}

FIDODebug[15:58:02] -> (CTAP2 error code 49)

That's the same error code as @joshtblack... 🤔

One possibility is that the security key is full of discoverable credentials, since "residentKey": "required" was being passed into registration. I filled up a security key with discoverable credentials...

But authentication still worked fine with this key. So that rules that out...

I experimented with setting the registration/authentication options to the same defaults as 5.4.5 and still got the same error.

I can't recreate this at all. I tried Brave, I tried Safari, I tried filling up a security key, I tried resetting my key to have no PIN but require UV during auth, nothing I can think of recreates this issue.
@hwhmeikle Is your site hosted on vercel too?

@MasterKale Yeah darn, this is gnarly. I'll do some more playing around. We are hosted on Vercel but I'm observing this on localhost.

@MasterKale Yeah darn, this is gnarly. I'll do some more playing around. We are hosted on Vercel but I'm observing this on localhost.

The fact that you're using localhost is interesting to me, but now there are too many variables to consider and so I must ask you to prepare a reproduction. If you can create a basic reproduction with a barebones version of whatever your set up is, that strips out everything to just the minimum code that can cause this, then I can try to run it on my end and see if it recreates the problem.

The fact that you're using localhost is interesting to me, but now there are too many variables to consider and so I must ask you to prepare a reproduction. If you can create a basic reproduction with a barebones version of whatever your set up is, that strips out everything to just the minimum code that can cause this, then I can try to run it on my end and see if it recreates the problem.

That's completely understandable. I'll see what I can do.

Are you saying you're getting the error with v5.4.5 now too?

No sorry, that was misleading. Just that I'm using the same registration options that I was using on 5.4.5 e.g. residentKey: 'preferred' rather then residentKey: 'required'.

Well how do you like that? 🫠
Can you try again with supportedAlgorithmIDs: [-8, -7, -257] and see if it causes the error?

Can confirm adding -8 causes the error 🤔

Alright, then in that case I'd like to request the JSON output from startRegistration(). I want to drop it into https://debugger.simplewebauthn.dev and see what public key algorithm gets used by those keys. When I tried [-8, -7, -257] with my Security Key on Firmware 5.1.2 I got back a public key that used -7, and authentication worked fine:

Well how do you like that? 🫠
Can you try again with supportedAlgorithmIDs: [-8, -7, -257] and see if it causes the error?

@MasterKale Interestingly enough, I added supportedAlgorithmIDs: [-7, -257] (without the -8) to my registration options and now the problem has disappeared, everything is working on production now. Hmm...

registration options using [-8, -7, -257]
{
  "challenge": "T3VdNSRSnPo5nOJOEbv05vbabkMhYdA9m-0Ahq6VS1Q",
  "rp": {
    "name": "SimpleWebAuthn Example",
    "id": "localhost"
  },
  "user": {
    "id": "internalUserId",
    "name": "user@localhost",
    "displayName": "user@localhost"
  },
  "pubKeyCredParams": [
    {
      "alg": -8,
      "type": "public-key"
    },
    {
      "alg": -7,
      "type": "public-key"
    },
    {
      "alg": -257,
      "type": "public-key"
    }
  ],
  "timeout": 60000,
  "attestation": "none",
  "excludeCredentials": [],
  "authenticatorSelection": {
    "residentKey": "discouraged",
    "requireResidentKey": false
  },
  "extensions": {
    "credProps": true
  }
}

Request gets made to /verify-authentication:

@joshtblack Mine works too if -8 is the last element in the array. But breaks if it's the first.
I can confirm the same happens to me!

Can also confirm that if you don't explicitly set supportedAlgorithmIDs it seems to use the -8 algorithm on registration:
// Registration Response
{
  "id": "nUQ9tOiBku8IoXEhz3A3PJtICjjT1Q_zEzyHQXgFHbZZWwXRQzQ0uqm4dGUmKxHPqkWxi9sQpkI9lv0qw2UwcT9ymSl1NPOoJIFHqkdKFkutvNym61pI8EW6Eld6AJAxdx-mLQft3eRr2YIv7-yFToxCQ3P2eK44SAU8zhZhprw",
  "rawId": "nUQ9tOiBku8IoXEhz3A3PJtICjjT1Q_zEzyHQXgFHbZZWwXRQzQ0uqm4dGUmKxHPqkWxi9sQpkI9lv0qw2UwcT9ymSl1NPOoJIFHqkdKFkutvNym61pI8EW6Eld6AJAxdx-mLQft3eRr2YIv7-yFToxCQ3P2eK44SAU8zhZhprw",
  "response": {
    "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjhSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NFAAAAAwAAAAAAAAAAAAAAAAAAAAAAgJ1EPbTogZLvCKFxIc9wNzybSAo409UP8xM8h0F4BR22WVsF0UM0NLqpuHRlJisRz6pFsYvbEKZCPZb9KsNlMHE_cpkpdTTzqCSBR6pHShZLrbzcputaSPBFuhJXegCQMXcfpi0H7d3ka9mCL-_shU6MQkNz9niuOEgFPM4WYaa8pAEBAycgBiFYIEA4ntYurWZvIqKCxx35m75YgYELyZQAlBDDaGdy9RDE",
    "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiWTIwUjV1UEttUlhOZWJGT25EclcyMU5OMHpQc1kxVGNyMXFHOTBTRWxBUSIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMCIsImNyb3NzT3JpZ2luIjpmYWxzZX0",
    "transports": [
      "nfc",
      "usb"
    ]
  },
  "type": "public-key",
  "clientExtensionResults": {
    "credProps": {}
  },
  "authenticatorAttachment": "cross-platform"
}

Nevermind - I only added [-7, -257] with the assumption that -8 wouldn't work, but I just tried it now, and [-7, -257, -8] is working for me too.

Moving -8 to the end means the YubiKey will use -7 to create the keypair because it's the first one in the list it recognizes.

Request gets made to /verify-authentication:

So maybe it's a bug in @simplewebauthn/server, related to the use of the Ed25519 public key credential algorithm? But then why could I authenticate just fine? 😩
Okay, can you please provide me with the following:

A registration response with [-8, -7, -257]
A corresponding authentication response that errors out with that just-registered security key
Confirm the version of @simplewebauthn/server you're using (if you pulled the latest master it should be v7.0.1, but just to confirm)

A registration response with [-8, -7, -257]

{
  "id": "-4jucLrt2DtIdG8CDwNMkggNKZdvfHC0GjeZNyrqkWGX4obksWt40f64G9hKyOYOyu1woTbxmOQuq4VGdWK8UIJO1uv8VdMe4LRyiiOawX9cDom6RUYz74M7pmLNnO3fLWFbDgkZZbH3cWj6b1TBcOual0-lv4TOFiI4ooMURqk",
  "rawId": "-4jucLrt2DtIdG8CDwNMkggNKZdvfHC0GjeZNyrqkWGX4obksWt40f64G9hKyOYOyu1woTbxmOQuq4VGdWK8UIJO1uv8VdMe4LRyiiOawX9cDom6RUYz74M7pmLNnO3fLWFbDgkZZbH3cWj6b1TBcOual0-lv4TOFiI4ooMURqk",
  "response": {
    "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjhSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NFAAAAAwAAAAAAAAAAAAAAAAAAAAAAgPuI7nC67dg7SHRvAg8DTJIIDSmXb3xwtBo3mTcq6pFhl-KG5LFreNH-uBvYSsjmDsrtcKE28ZjkLquFRnVivFCCTtbr_FXTHuC0coojmsF_XA6JukVGM--DO6ZizZzt3y1hWw4JGWWx93Fo-m9UwXDrmpdPpb-EzhYiOKKDFEappAEBAycgBiFYIJ0W19F-gdpeguMkUj7LvI1vgzyRMpoVxAy3g-nASbiT",
    "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoid3ptdXBMZlhVUWhpa0Jva1hUT1U4QVBGLXFQNTZyZ3loSElta3JMdXNHbyIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMCIsImNyb3NzT3JpZ2luIjpmYWxzZSwib3RoZXJfa2V5c19jYW5fYmVfYWRkZWRfaGVyZSI6ImRvIG5vdCBjb21wYXJlIGNsaWVudERhdGFKU09OIGFnYWluc3QgYSB0ZW1wbGF0ZS4gU2VlIGh0dHBzOi8vZ29vLmdsL3lhYlBleCJ9",
    "transports": [
      "nfc",
      "usb"
    ]
  },
  "type": "public-key",
  "clientExtensionResults": {
    "credProps": {}
  },
  "authenticatorAttachment": "cross-platform"
}

A corresponding authentication response that errors out with that just-registered security key (confirm the credential ID matches the credential received from registration)

{
  "id": "-4jucLrt2DtIdG8CDwNMkggNKZdvfHC0GjeZNyrqkWGX4obksWt40f64G9hKyOYOyu1woTbxmOQuq4VGdWK8UIJO1uv8VdMe4LRyiiOawX9cDom6RUYz74M7pmLNnO3fLWFbDgkZZbH3cWj6b1TBcOual0-lv4TOFiI4ooMURqk",
  "rawId": "-4jucLrt2DtIdG8CDwNMkggNKZdvfHC0GjeZNyrqkWGX4obksWt40f64G9hKyOYOyu1woTbxmOQuq4VGdWK8UIJO1uv8VdMe4LRyiiOawX9cDom6RUYz74M7pmLNnO3fLWFbDgkZZbH3cWj6b1TBcOual0-lv4TOFiI4ooMURqk",
  "response": {
    "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MFAAAABQ",
    "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoidGVoM29PWVR6cmp2QlgxNmdfUEJkVWpzRmlmYVpoUS1TTy10X3Zia0FXUSIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMCIsImNyb3NzT3JpZ2luIjpmYWxzZX0",
    "signature": "bWzilg1FvlcGiITfLnNKC1sBvO9Mjzy_ROahFeGsuaPtXjCkiKKKC-KLs3RCBZoOy55ARr7uJPb9m_oBoAHUAA"
  },
  "type": "public-key",
  "clientExtensionResults": {},
  "authenticatorAttachment": "cross-platform"
}

Confirm the version of @simplewebauthn/server you're using (if you pulled the latest master it should be v7.0.1, but just to confirm)

7.0.0

@simplewebauthn/server verifies everything... 😵💫
import { verifyAuthenticationResponse, verifyRegistrationResponse } from './src';

(async () => {
  const verifiedReg = await verifyRegistrationResponse({
    response: {
      "id": "-4jucLrt2DtIdG8CDwNMkggNKZdvfHC0GjeZNyrqkWGX4obksWt40f64G9hKyOYOyu1woTbxmOQuq4VGdWK8UIJO1uv8VdMe4LRyiiOawX9cDom6RUYz74M7pmLNnO3fLWFbDgkZZbH3cWj6b1TBcOual0-lv4TOFiI4ooMURqk",
      "rawId": "-4jucLrt2DtIdG8CDwNMkggNKZdvfHC0GjeZNyrqkWGX4obksWt40f64G9hKyOYOyu1woTbxmOQuq4VGdWK8UIJO1uv8VdMe4LRyiiOawX9cDom6RUYz74M7pmLNnO3fLWFbDgkZZbH3cWj6b1TBcOual0-lv4TOFiI4ooMURqk",
      "response": {
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjhSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NFAAAAAwAAAAAAAAAAAAAAAAAAAAAAgPuI7nC67dg7SHRvAg8DTJIIDSmXb3xwtBo3mTcq6pFhl-KG5LFreNH-uBvYSsjmDsrtcKE28ZjkLquFRnVivFCCTtbr_FXTHuC0coojmsF_XA6JukVGM--DO6ZizZzt3y1hWw4JGWWx93Fo-m9UwXDrmpdPpb-EzhYiOKKDFEappAEBAycgBiFYIJ0W19F-gdpeguMkUj7LvI1vgzyRMpoVxAy3g-nASbiT",
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoid3ptdXBMZlhVUWhpa0Jva1hUT1U4QVBGLXFQNTZyZ3loSElta3JMdXNHbyIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMCIsImNyb3NzT3JpZ2luIjpmYWxzZSwib3RoZXJfa2V5c19jYW5fYmVfYWRkZWRfaGVyZSI6ImRvIG5vdCBjb21wYXJlIGNsaWVudERhdGFKU09OIGFnYWluc3QgYSB0ZW1wbGF0ZS4gU2VlIGh0dHBzOi8vZ29vLmdsL3lhYlBleCJ9",
        "transports": [
          "nfc",
          "usb"
        ]
      },
      "type": "public-key",
      "clientExtensionResults": {
        "credProps": {}
      },
      "authenticatorAttachment": "cross-platform"
    },
    expectedChallenge: 'wzmupLfXUQhikBokXTOU8APF-qP56rgyhHImkrLusGo',
    expectedOrigin: 'http://localhost:8000',
  });

  const verifiedAuth = await verifyAuthenticationResponse({
    authenticator: {
      credentialID: verifiedReg.registrationInfo!.credentialID,
      credentialPublicKey: verifiedReg.registrationInfo!.credentialPublicKey,
      counter: 0,
    },
    expectedChallenge: 'teh3oOYTzrjvBX16g_PBdUjsFifaZhQ-SO-t_vbkAWQ',
    expectedOrigin: 'http://localhost:8000',
    expectedRPID: 'localhost',
    response: {
      "id": "-4jucLrt2DtIdG8CDwNMkggNKZdvfHC0GjeZNyrqkWGX4obksWt40f64G9hKyOYOyu1woTbxmOQuq4VGdWK8UIJO1uv8VdMe4LRyiiOawX9cDom6RUYz74M7pmLNnO3fLWFbDgkZZbH3cWj6b1TBcOual0-lv4TOFiI4ooMURqk",
      "rawId": "-4jucLrt2DtIdG8CDwNMkggNKZdvfHC0GjeZNyrqkWGX4obksWt40f64G9hKyOYOyu1woTbxmOQuq4VGdWK8UIJO1uv8VdMe4LRyiiOawX9cDom6RUYz74M7pmLNnO3fLWFbDgkZZbH3cWj6b1TBcOual0-lv4TOFiI4ooMURqk",
      "response": {
        "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MFAAAABQ",
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoidGVoM29PWVR6cmp2QlgxNmdfUEJkVWpzRmlmYVpoUS1TTy10X3Zia0FXUSIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMCIsImNyb3NzT3JpZ2luIjpmYWxzZX0",
        "signature": "bWzilg1FvlcGiITfLnNKC1sBvO9Mjzy_ROahFeGsuaPtXjCkiKKKC-KLs3RCBZoOy55ARr7uJPb9m_oBoAHUAA"
      },
      "type": "public-key",
      "clientExtensionResults": {},
      "authenticatorAttachment": "cross-platform"
    },
  });

  console.log('auth verified:', verifiedAuth.verified);
  // auth verified: true
})();

@hwhmeikle Since a request is being made to the back end, and it's the back end returning the error, have you looked at console output from the Node side of things to see what's being thrown?

@MasterKale here's the node logs:
DOMException [NotSupportedError]: Unrecognized name.
    at new DOMException (node:internal/per_context/domexception:70:5)
    at __node_internal_ (node:internal/util:477:10)
    at normalizeAlgorithm (node:internal/crypto/util:221:15)
    at SubtleCrypto.importKey (node:internal/crypto/webcrypto:471:15)
    at importKey (/Users/hamish/Projects/Personal/SimpleWebAuthn/example/node_modules/@simplewebauthn/server/src/helpers/iso/isoCrypto/importKey.ts:9:27)
    at verifyOKP (/Users/hamish/Projects/Personal/SimpleWebAuthn/example/node_modules/@simplewebauthn/server/src/helpers/iso/isoCrypto/verifyOKP.ts:57:30)
    at Object.verify (/Users/hamish/Projects/Personal/SimpleWebAuthn/example/node_modules/@simplewebauthn/server/src/helpers/iso/isoCrypto/verify.ts:31:21)
    at verifySignature (/Users/hamish/Projects/Personal/SimpleWebAuthn/example/node_modules/@simplewebauthn/server/src/helpers/verifySignature.ts:34:20)
    at verifyAuthenticationResponse (/Users/hamish/Projects/Personal/SimpleWebAuthn/example/node_modules/@simplewebauthn/server/src/authentication/verifyAuthenticationResponse.ts:206:36)
    at async /Users/hamish/Projects/Personal/SimpleWebAuthn/example/index.ts:273:20

So it's an issue with Node's SubtleCrypto.importKey().
@hwhmeikle: What version of Node are you using locally?
@joshtblack: What version of Node are you using locally, and what version is your production vercel instance using?

@MasterKale I was running it on 17.6.0, but changed to 18.8.0 and now it works 😮💨

The minimum Node support is supposed to be Node v16. Strangely enough, Node v16.18.0 ran that same code above no problem. Node v17.9.1, though, errored out with a familiar-looking error:
DOMException [NotSupportedError]: Unrecognized name.
    at new DOMException (node:internal/per_context/domexception:70:5)
    at __node_internal_ (node:internal/util:477:10)
    at normalizeAlgorithm (node:internal/crypto/util:220:15)
    at SubtleCrypto.importKey (node:internal/crypto/webcrypto:503:15)
    at importKey (/Users/matt/Developer/simplewebauthn/packages/server/src/helpers/iso/isoCrypto/importKey.ts:9:27)
    at verifyOKP (/Users/matt/Developer/simplewebauthn/packages/server/src/helpers/iso/isoCrypto/verifyOKP.ts:57:30)
    at Object.verify (/Users/matt/Developer/simplewebauthn/packages/server/src/helpers/iso/isoCrypto/verify.ts:31:21)
    at verifySignature (/Users/matt/Developer/simplewebauthn/packages/server/src/helpers/verifySignature.ts:34:20)
    at verifyAuthenticationResponse (/Users/matt/Developer/simplewebauthn/packages/server/src/authentication/verifyAuthenticationResponse.ts:206:36)
    at async /Users/matt/Developer/simplewebauthn/packages/server/345.ts:26:24

I only run CI tests on LTS releases, so perhaps I need to include in-between versions too.

So it's an issue with Node's SubtleCrypto.importKey().
@hwhmeikle: What version of Node are you using locally? @joshtblack: What version of Node are you using locally, and what version is your production vercel instance using?
For comparison's sake I'm using Node 18.13.0 locally.

v18.12.1 locally and 16x on Vercel. I might try 18x and see how it goes.

I just tested Node v16.18.1 locally and it verified without issue 😬
So I've been thinking about what to do here. A couple of ideas come to mind:

Only include -8 in the default value of generateRegistrationOptions()'s supportedAlgorithmIDs argument when Node version is at least v18
Add a new Troubleshooting section to the @simplewebauthn/server docs with this specific issue, and guidance to specify [-7, -257] for supportedAlgorithmIDs as a fix

I'm currently leaning towards the docs-based fix for this since it seems environment/hosting-specific, and means less code to maintain 🤔

@MasterKale I agree with the docs based fix. Think you might hate yourself in the future otherwise 😅

I just tested Node v16.18.1 locally and it verified without issue 😬
So I've been thinking about what to do here. A couple of ideas come to mind:

Only include -8 in the default value of generateRegistrationOptions()'s supportedAlgorithmIDs argument when Node version is at least v18
Add a new Troubleshooting section to the @simplewebauthn/server docs with this specific issue, and guidance to specify [-7, -257] for supportedAlgorithmIDs as a fix

I'm currently leaning towards the docs-based fix for this since it seems environment/hosting-specific, and means less code to maintain 🤔

I think a docs-based is probably the best approach. Glad we were able to find a resolution!

You might be wondering why I'm adding the 'allowCredentials' in the response rather than the options itself - it's because for some reason if I add the exact same allowCredentials code in the options, the id value is always empty, adding it into the response itself is the only way I could get it to work. Maybe you could shed some light on that as well?

Just had the same issue -
And attaching credentialID to the response directly was the only way to get Prod working correctly since it always returned blank from generateAuthenticationOptions (Prod being a GCP cloud run back end and Vercel front-end)

You might be wondering why I'm adding the 'allowCredentials' in the response rather than the options itself - it's because for some reason if I add the exact same allowCredentials code in the options, the id value is always empty, adding it into the response itself is the only way I could get it to work. Maybe you could shed some light on that as well?

Just had the same issue - And attaching credentialID to the response directly was the only way to get Prod working correctly since it always returned blank from generateAuthenticationOptions (Prod being a GCP cloud run back end and Vercel front-end)

Had the same issue as well. This is because the docs say credentialID should be saved as "base64url then store as TEXT" but generateAuthenticationOptions expects the credentialID to be a buffer.


Add a quantity field for at least face shields and masks

I'm working with a Chicago branch of Helpful Engineering and we are trying to connect Hospitals with various 3d printers/makers of face shields and masks. The current form of the data gives us a sense of who needs what but it doesn't give us a sense of quantitative demand. Can estimated quantity fields be added for at least the face shield portion? This will help us scale our production and meet demand much faster.

Hi Timmy,
One of our collaborators just launched a new matching service called Shield Net: https://shield-net.org/ I would recommend getting directly in touch with them as they have these types of numbers. In fact, you can just join their US-CA network of makerspaces and manufacturers as a collaborator directly and they will help you with matching your donations to requesting sites.
We have recently shared our data with them and they are working on curating all sites requesting face shields on Find the Mask US and Canada to a subset who is able to accept 3Dprinted/maker shields. Please keep in mind some clinics and hospitals are bounded by pre-existing risk management policies and not every site requesting face shields may be formally allowed to accept makermade items.
If you want more information: Shield Net grew from the Badger Shield initiative between UW Makerspace and UW Hospital. If you take a look at their partners, they have amassed a powerful network of commerical manufacturer who will print their design including Delve, Ford, Engineers without Borders, Trek, Microsoft as well as university campuses and well-meaning organizations such as yours. https://making.engr.wisc.edu/shield/
Their network's daily output as of April 1 is over 800,000 shields per day. And sounds like it will only grow with your help.
Once Shield Net curates our list, we aim to re-integrate that under a "Face Sheild - 3D printed/manufactured" option as a listable and fiterable item.


Add a security.md file to repo, highlighting existing vulnerabilities

Is your feature request related to a problem? Please describe.
Currently Snyk is used to scan the repo for vulnerabilities. If these are not resolved, then we should inform the community of their existence and the reasons behind not mitigating them.
Describe the solution you'd like
A security.md file describing the current vulnerabilities and the expected mitigation or reasons for lack thereof
Describe alternatives you've considered
A section on the README.md

Instead of this could we just use https://dependabot.com/?
This tool would even create automatic PRs if there are dependency upgrades. You can see it in action here: https://github.com/gothinkster/vue-realworld-example-app/pulls?q=is%3Apr+is%3Aclosed+label%3Adependencies

Hi @igeligel , the repo as well as the whole org has been setup to be scanned by Snyk, hence the warnings we get about the code and its dependencies when we log into the Snyk console.
In some cases, it's just a lo-fi way of acknowledging / clarifying why we, at the moment, have vulnerabilities and why we choose not to address them. For example, this repo has HTTP vulnerabilities introduced by the testing framework but as of the time of writing this we do not wish to force our users to upgrade to the .NET version that fixes this.

Having said that, dependabot could work in a complimentary fashion

I think so too.

at the moment, have vulnerabilities and why we choose not to address them

To not address them sounds really wrong in my opinion. I mean the basic reason is that clients do not want to upgrade their .NET version. I know this cost time and money but can we really live with delivering security vulnerabilities? If people want to have the newest features, they should also be able to upgrade their framework. If they want to stay on an old version they are free to fork the repo at the point where the release is created.
Also, I think there is some misunderstanding here. The Core library is targeting netstandard2.0 here  which means it can run in those environments:

.NET Core >= 2.0
.NET Framework >= 4.6.1 (though .NET Framework +4.7.2 is recommended)
Mono >= 5.4

See compatibility table
The testing library is still running on .NET standard and upgrading versions there would not break anything. Anyway, considering Snyk is testing everything in this project including the test project we should be able to tell Snyk to ignore the test project actually. I could not find a way to tell snyk to ignore the test, sample or example projects but I will reach out to the person who set those scans up and will ask there.
So right now we do not have any security vulnerability in the created package but in the development environment which is alright.

Thank you for the feedback.
Allow me to firmly state the following:

In some cases, it's just a lo-fi way of acknowledging / clarifying why we, at the moment, have vulnerabilities and why we choose not to address them.

No, that does not mean that we enforce a blanket rule for not addressing vulnerabilities. In our case the vulnerability exists in the testing framework and not on the actual library we offer. I think that allows us for some room to maneuver as we chart the next steps. Having a file indicating this vulnerability and why it's not addressed yet while working out strategies to improve the library, works towards transparency.
I don't believe this PR is about "not dealing with vulnerabilities" but rather if we have to explain ourselves, we can do it with such a file and provide other users with a "heads up".

Why should we create noise if it is not important for our customer?
We should really think about this because the security vulnerability does not affect the artifact which is the product for the customers in the end.
The normal workflow of someone wanting to integrate Klarna into their current .NET systems would be to google `klarna .net or searching on nuget directly. If there is any message of security vulnerability which just affects developing, we should not make a public statement about it and rather create an issue and leave it at that. I think this is enough transparency for every developer who wants to contribute to this repository.
Public vulnerabilities should be listed in the README.md. This will also encourage users to upgrade their versions. Nuget has the possibility to update a README.md file for a better description of packages: https://github.com/NuGet/Home/wiki/Package-README.md-support Unfortunately there is no way to bundle the markdown file currently but updating it manually would be fine enough.


'dependency has a new identifier' error with Webpack 3 and optimize.ModuleConcatenationPlugin.

After upgrading to Webpack 3 and using the new webpack.optimize.ModuleConcatenationPlugin(), the first build works fine but subsequent builds error with Unhandled rejection Error: dependency has a new identifier.
Relevant webpack config:
    new webpack.optimize.ModuleConcatenationPlugin(),
    new HardSourceWebpackPlugin({
      cacheDirectory: path.join(__dirname, 'jscache/[confighash]'),
      recordsPath: path.join(__dirname, 'jscache/[confighash]/records.json'),
      configHash: webpackConfig => nodeObjectHash().hash(webpackConfig),
      environmentHash: {
        root: process.cwd(),
        directories: ['node_modules'],
        files: ['package.json']
      }
    }),

Output on repeat builds (absolute paths replaced with [...]):
Unhandled rejection Error: dependency has a new identifier
    at [...]/node_modules/hard-source-webpack-plugin/index.js:1094:26
    at factory ([...]/node_modules/webpack/lib/NormalModuleFactory.js:253:5)
    at applyPluginsAsyncWaterfall ([...]/node_modules/webpack/lib/NormalModuleFactory.js:99:14)
    at [...]/node_modules/tapable/lib/Tapable.js:204:11
    at NormalModuleFactory.params.normalModuleFactory.plugin ([...]/node_modules/webpack/lib/CompatibilityPlugin.js:52:5)
    at NormalModuleFactory.applyPluginsAsyncWaterfall ([...]/node_modules/tapable/lib/Tapable.js:208:13)
    at resolver ([...]/node_modules/webpack/lib/NormalModuleFactory.js:74:11)
    at [...]/node_modules/hard-source-webpack-plugin/index.js:1411:11
    at fromCache ([...]/node_modules/hard-source-webpack-plugin/index.js:1374:18)
    at [...]/node_modules/hard-source-webpack-plugin/index.js:1381:18
    at [...]/node_modules/hard-source-webpack-plugin/index.js:1390:12
    at [...]/node_modules/webpack/lib/NormalModuleFactory.js:64:5
    at applyPluginsAsyncWaterfall ([...]/node_modules/webpack/lib/NormalModuleFactory.js:246:4)
    at [...]/node_modules/tapable/lib/Tapable.js:204:11
    at NormalModuleFactory.<anonymous> ([...]/node_modules/hard-source-webpack-plugin/index.js:1485:39)
    at [...]/node_modules/tapable/lib/Tapable.js:206:14

Looking at the code where the error is being thrown (https://github.com/mzgoddard/hard-source-webpack-plugin/blob/master/index.js#L1091), the values being compared are:
cacheDependency._resolvedModuleIdentifier (absolute paths replaced with [...]):
[...]/node_modules/babel-loader/lib/index.js??ref--0-0![...]/static/js/app/accounts/auth.js [...]/node_modules/babel-loader/lib/index.js??ref--0-0![...]/static/js/app/accounts/login.js [...]/node_modules/babel-loader/lib/index.js??ref--0-0![...]/static/js/app/organizations.js [...]/node_modules/babel-loader/lib/index.js??ref--0-0![...]/static/js/app/projects.js [...]/node_modules/babel-loader/lib/index.js??ref--0-0![...]/static/js/app/accounts/register.js [...]/node_modules/babel-loader/lib/index.js??ref--0-0![...]/static/js/app/scenarios.js [...]/node_modules/babel-loader/lib/index.js??ref--0-0![...]/static/js/app/tplSetup.js [...]/node_modules/babel-loader/lib/index.js??ref--0-0![...]/static/js/app/app.js

depModule.identifier() (absolute paths replaced with [...]):
[...]/node_modules/babel-loader/lib/index.js??ref--0-0![...]/static/js/app/app.js

On the first build, or any build without webpack.optimize.ModuleConcatenationPlugin() enabled, the entire block (https://github.com/mzgoddard/hard-source-webpack-plugin/blob/master/index.js#L1053-L1098) is not executed.

I see what's going on. That error is doing its job. hard-source can't do its job if a dependency resolves to a different module so it has to invalidate the module it was parsed from.
e.g.
Module A depends on './b'. './b' resolves to Module B.
In the next build './b' resolves to Module BB. hard-source has to invalidate Module A so it can rebuild with an updated resolution.
To support the ConcatenatedModule, hard-source needs to find the original module the dependency resolved to that is now part of ConcatenatedModule so it can record the proper _resolvedModuleIdentifier for when it performs this check.

I've dug deep enough into this to have figured out a solution. It'll be in two stages.
The first stage will handle the message currently appearing as an unhandled rejection and allow modules depending on ones in the ConcatenatedModule to be cached. Modules that get concatenated will not be cached in this. In this hard-source will continue to help with modules with commonjs or amd syntax, or es6 module syntax that are not concatenated. This will likely primarily benefit libraries with large numbers of files that fall into those categories.
The first stage should be available soon. It should only be blocked by needing to check that the other tests pass for webpack 3. (Last I checked some hard-source es6 module tests failed.)
The second stage will support caching the modules in the ConcatenatedModule. To support this, the details of how these modules are cached are different enough than previously cached modules to increase my interest in refactoring some of the code to provide internal plugin hooks that can handle the details appropriately. These internal hooks will at a later time be used by other plugins. (I only mention this as I'll be very likely to change the internal hooks until they stabilize. Use them at your own disgression. The internal hooks will be distinguished from public hooks by being prefixed with two dashes -- like how private object variables are often prefixed with two underscores __.)

#146 has been merged into the 0.5 prerelease line with support for caching modules inside the ConcatenatedModule. 0.5 is ready for use, I'm looking to do a few more changes to finalize that version.

Published 0.5 last week with the mentioned ConcatenationPlugin support.


doesn't work

Tried with no other mods enabled and with my mods enabled and doesn't seem to work at all. I am now on 0.7.7 and still doesn't work (tried on 0.7.6 and notta). Enabling the warning on drop and on paste doesn't trigger either, so seems it is not functioning at all.

Please provide the following information:
Os used, browser, system played.

Any errors in the console.

No, nothing. About the only thing that is happening is that if you drag an image from a website then the url shows up, but that is base feature not of the mod, there is no conversion to an image afterwards.

herp derp, sorry didn't get email with your first comment.
OS: Windows 10
Browser: Chrome
System played: Cypher System
Foundry version: 0.7.7

everything works as expected for me.

hm... yea made a fresh world and works, but in my main world it isn't...
I've disabled all my other chat mods, but still notta. Will get back to you if/when I figure out what is the lynch pin. Thanks for checking.

mmm... found it: https://github.com/Moerill/fvtt-markdown-editor
Any chance of becoming compatible?

closing as it does work, just incompatible. Will make new ticket for the compatibility ask. Thanks!


Shared cookie between applications with different sheme authentication

I have follow the documentation about shared cookie between application but i think the problem is my use case.
I have one application which use wsfederation to authenticate my user. And an other applications which run on the same URL, so which can read the cookie. Now I need to know if the user is authenticated and access to some claim. But the second application doesn't read the cookie and return a not authenticated user.
The cookie is only readable by WsFederation middleware? I can't understand why it's not working and I can't debug this part and I don't have log to said that the cookie is wrong or some stuff like that.

See https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?view=aspnetcore-2.1&tabs=aspnetcore2x

I finally find the code and understand how it works but did not succeed to understand where was my mistake. But if I'm right :

Each Authentification Middleware must create a cookie which is encrypted by a data protector which is instantiated with this specific combination

CookieAuthenticationMiddleware:40
var dataProtector = provider.CreateProtector(typeof(CookieAuthenticationMiddleware).FullName, Options.AuthenticationScheme, "v2");
Options.TicketDataFormat = new TicketDataFormat(dataProtector);

So I think that my mistake is that the AuthenticationSheme is not the same in the two apps but I didn't manage to understand which params I have to change.
I did the test to finally give the protector provider and the ticketDataFormat on both of the application and it works as expected. It's ugly so if you have a nice solution I'm listening
So here is how it works for now :
App 1
services.AddDataProtection()
                .PersistKeysToFileSystem(new DirectoryInfo(Configuration["KeyStorageLocation"]))
                .SetApplicationName("SharedCookieApp");

var provider = ActivatorUtilities.GetServiceOrCreateInstance<IDataProtectionProvider>(services.BuildServiceProvider());
var dataProtector = provider.CreateProtector("toto");

services.ConfigureApplicationCookie(options =>
            {
                options.Cookie.Name = ".AspNet.SharedCookie";
                options.DataProtectionProvider = provider;
                options.TicketDataFormat = new TicketDataFormat(dataProtector);
            });

services.AddAuthentication("CustomAuthentification")
                .AddWsFederation(options =>
                {
                    // MetadataAddress represents the Active Directory instance used to authenticate users.
                    options.MetadataAddress = "https://adfs01.gpi.pri/FederationMetadata/2007-06/FederationMetadata.xml";

                    // Wtrealm is the app's identifier in the Active Directory instance.
                    // For ADFS, use the relying party's identifier, its WS-Federation Passive protocol URL:
                    options.Wtrealm = Environment.GetEnvironmentVariable("EXTERNAL_URL");
                });

App 2
services.AddDataProtection()
                .PersistKeysToFileSystem(new DirectoryInfo(Configuration["KeyStorageLocation"]))
                .SetApplicationName("SharedCookieApp");

var provider = ActivatorUtilities.GetServiceOrCreateInstance<IDataProtectionProvider>(services.BuildServiceProvider());
var dataProtector = provider.CreateProtector("toto");

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                .AddCookie(options =>
                {
                    options.Cookie.Name = ".AspNet.SharedCookie";
                    options.DataProtectionProvider = provider;
                    options.TicketDataFormat = new TicketDataFormat(dataProtector);
                });

The answer to this question:

Each Authentification Middleware must create a cookie which is encrypted by a data protector which is instantiated with this specific combination

Is yes.
We're closing this issue because it appears all the issues have been resolved.


ci: Use temporary directory for unit tests

ci: Use temporary directory for unit tests
This commit implements the use of a temporary directory for unit tests in order to ensure a clean and isolated environment for testing purposes.
Signed-off-by: Mayank Pal<EMAIL_ADDRESS>Fixes #4617

@iPraveenParihar  Hopefully now it meets the requirement

@iPraveenParihar Hopefully now it meets the requirement

@mayankpall, please look at the following error and update the commit body.
✖   body's lines must not be longer than 80 characters [body-max-line-length]

edited it to shortest as possible.

@iPraveenParihar all checks have passed

@Madhu-1  removed err = os.Mkdir("/etc/ceph-csi-config", 0o600)

@Madhu-1  removed and squashed all the commits

@Madhu-1, can we skip e2e tests for this PR? Since changes are in unit tests?

@Madhu-1, can we skip e2e tests for this PR? Since changes are in unit tests?

yes that make sense, we can skip multi-arch buil and E2E for this kind of PR's

@Mergifyio queue

@mergifyio rebase

@Mergifyio queue

@Mergifyio refresh

@Mergifyio queue default

@Rakshith-R, can you take look at this?
Mergifyio can't queue due to
The merge queue pull request can't be updated
Details:

Unable to update: user mayankpall is unknown.

@mergifyio rebase

@mergifyio queue


Replace styelint, eslint and prettier with biomejs

Discussed in https://github.com/HyphaApp/hypha/discussions/4283

Originally posted by theskumar December 16, 2024
Why?
Pros

faster
Rust-based, Node.js not required
Plays nicely with pre-commit, the current setup feel hacky
Similar configuration, don’t have to work with three different tools
It’s built as a replacement for Prettier, ESLint, and the rules can be ported over
Good editor support across VSCode

Cons

It’s a bit new
While it supports almost all the rules, it doesn't support 100% of all the rules

Conclusion:
Given this project is not FE heavy, we probably don't need a heavily customized tool to run linter and formatter; the current tools are quite slow, esp. This feels to me like the ruff of the Node.js world, and will help with the dev efficiency because we only have to work with a single tool that is easy to maintain, is faster, and provides better error reports.
https://biomejs.dev/
cc: @frjo @wes-otf

Played around with biome this week and it's fast!
With the conf below I got no warnings with our current code base.
With time we could remove the rules and just go with "recommended: true". That will lead to many changes but the ones I looked at looked very reasonable.
{
  "$schema": "https://biomejs.dev/schemas/1.9.4/schema.json",
  "vcs": {
    "enabled": true,
    "clientKind": "git",
    "useIgnoreFile": true,
    "defaultBranch": "main"
  },
  "files": {
    "ignoreUnknown": true,
    "ignore": [
      "**/*.min.js",
      "**/javascript/esm/**",
      "**/javascript/vendor/**",
      "public/**",
      "eslint.config.mjs",
      "site.webmanifest"
    ]
  },
  "formatter": {
    "enabled": true,
    "useEditorconfig": true,
    "formatWithErrors": false,
    "indentStyle": "space",
    "indentWidth": 2,
    "lineEnding": "lf",
    "lineWidth": 80,
    "attributePosition": "auto",
    "bracketSpacing": true,
    "ignore": []
  },
  "organizeImports": { "enabled": true },
  "linter": {
    "enabled": true,
    "rules": {
      "recommended": false,
      "complexity": {
        "noExtraBooleanCast": "error",
        "noMultipleSpacesInRegularExpressionLiterals": "error",
        "noUselessCatch": "error",
        "noUselessLoneBlockStatements": "error",
        "noUselessUndefinedInitialization": "error",
        "noWith": "error"
      },
      "correctness": {
        "noConstAssign": "error",
        "noConstantCondition": "error",
        "noEmptyCharacterClassInRegex": "error",
        "noEmptyPattern": "error",
        "noGlobalObjectCalls": "error",
        "noInvalidBuiltinInstantiation": "error",
        "noInvalidConstructorSuper": "error",
        "noNonoctalDecimalEscape": "error",
        "noPrecisionLoss": "error",
        "noSelfAssign": "error",
        "noSetterReturn": "error",
        "noSwitchDeclarations": "error",
        "noUndeclaredVariables": "error",
        "noUnreachable": "error",
        "noUnreachableSuper": "error",
        "noUnsafeFinally": "error",
        "noUnsafeOptionalChaining": "error",
        "noUnusedLabels": "error",
        "noUnusedPrivateClassMembers": "error",
        "useArrayLiterals": "error",
        "useIsNan": "error",
        "useValidForDirection": "error",
        "useYield": "error"
      },
      "security": { "noGlobalEval": "error" },
      "style": {
        "noCommaOperator": "error",
        "noYodaExpression": "error",
        "useBlockStatements": "off",
        "useConsistentBuiltinInstantiation": "error",
        "useSingleVarDeclarator": "error"
      },
      "suspicious": {
        "noAsyncPromiseExecutor": "error",
        "noCatchAssign": "error",
        "noClassAssign": "error",
        "noCompareNegZero": "error",
        "noControlCharactersInRegex": "error",
        "noDebugger": "error",
        "noDuplicateCase": "error",
        "noDuplicateClassMembers": "error",
        "noDuplicateObjectKeys": "error",
        "noDuplicateParameters": "error",
        "noEmptyBlockStatements": "error",
        "noFallthroughSwitchClause": "error",
        "noFunctionAssign": "error",
        "noGlobalAssign": "error",
        "noImportAssign": "error",
        "noLabelVar": "error",
        "noMisleadingCharacterClass": "error",
        "noPrototypeBuiltins": "error",
        "noRedeclare": "error",
        "noShadowRestrictedNames": "error",
        "noSparseArray": "error",
        "noUnsafeNegation": "error",
        "useGetterReturn": "error",
        "useValidTypeof": "error"
      }
    }
  },
  "javascript": {
    "formatter": {
      "trailingCommas": "es5"
    },
    "globals": ["define", "htmx", "jQuery", "Alpine"]
  },
  "css": {
    "formatter": {
      "indentWidth": 4
    }
  }
}

I also think we could update the indent_size setting in .editorconfig. Two spaces as default and four for py, html and md? What do you think?


(BOLT-151) Yield node results as they finish

All of the run_* methods now take an optional block. If one is provided, then
the node and its result will be yielded to the block as the operation finishes.
Only one result will be yielded at a time, so callers do not need to worry about
concurrency issues. For example, colorize modifies the global stdout stream
color and doesn't need to worry about concurrency issues.

This approach works well for the human readable format and when executing plans, as the latter case could make the results available to the plan to perform some action.
But it won't work for the oneline output format, as we'll need to print output as it occurs, not when the node finishes. Moving to an observable pattern would work better for that.

CLA signed by all contributors.

We could yield events as well. That would help if we want the human readable output to include information when a node starts or the one line. I can also see how it might align better with intermediate output for plans.
This is going to make the JSON format a bit harder but it should be fine.

I had plans of making the notifier more general so that it could send events as part of the executor lifecycle, start, progress, done, etc. I think that will eventually be necessary to support oneline output format. But I don't really have time to implement those changes. So I'm ok merging this, unless @pcarlisle has concerns?

as is is fine with me


cant do anything

i get this and i dont know to fix it i have it installed It was not possible to find any installed .NET Core SDKs
Did you mean to run .NET Core SDK commands? Install a .NET Core SDK from:
https://aka.ms/dotnet-download
Problem encountered on https://dotnet.microsoft.com/learn/dotnet/hello-world-tutorial/install
Operating System: windows
Provide details about the problem you're experiencing. Include your operating system version, exact error message, code sample, and anything else that is relevant.

Can you run the command dotnet --info and let us know the output? It seems that you only downloaded the runtime but not the SDK. Did you use the download button from the page? It should download the right product.


Update references to trailofbits to sigstore to avoid confusion

Description
README.md still indicates trailofbits instead of sigstore, which is confusing for users.
Version

0.0.9

Thanks for filing this!


Transcription of Obsidian Audio Records not working

Hi,
looks like the transcription of obsidian recorded audio is not working.
I use OpenAI GPT 4o.
What can I do to give you more useful information to that. Are there logfiles somewhere?

Hi @Malli88 Is that still the case now?


Make links clickable

If post it text contains a link, render as a link

Done using https://github.com/tasti/react-linkify in https://github.com/niventc/wally/commit/677fbbf907afccc1122af3e7f6d4bebe8195a309


Hitting "Cancel" when selecting new Save directory clears field, making saving impossible

If user cancels, just retain previous value. If empty, default to EnlightenSpectra.

resolved in #469


More tests

Most of these features are covered in examples but not in the testing suite.

Quantization schemes:

Onnxruntime @aliabdelkader
GPTQ @lopozz
AWQ
BnB

Loading with dummy weights:

Pytorch
Onnxruntime.

Optimizations:

FAv2
BetterTransformer
torch.compile.

@aliabdelkader yess I left these as first issues for anyone interested in contributing and having these settings tested as part of the CI. You just need to add a configuration and make sure that it's tested in the CI (might require adding some packages).

#take
ok great, I am working on it.

Hi @aliabdelkader and @IlyasMoutawwakil I benchmarked some GPTQ models in the past week and I'd be up to write a test for this quantization scheme if you're not already on it. Let me know

thanks ! would love to review the quantization configs ! make sure u include backend.no_weights: true,false when possible to ur sweep configs as the no weights feature is probably one of the most important features of optimum-benchmark and making sure it's always compatible with quantization schemes seems interesting

@lopozz no i did not work on that scheme yet. So, I would not mind if you want to write the test for it.
@IlyasMoutawwakil sure, I will include the backend.no_weights: true,false sweep to the quantizatio test configs.

Hi @IlyasMoutawwakil I was trying the same configuration file of #125 and I got this error
AttributeError: 'LlamaRotaryEmbedding' object has no attribute 'cos_cached'

I believe it is caused by the newest refactoring. The last commit I see is  97e0b9e18a09ca3552f7d771cdfd3fa134c55a16 (more makefile stuff) of 4 days ago, so I believe I am working with the latest version. Should I open a new issue for this?

@lopozz I think it's a transformers issue https://github.com/unslothai/unsloth/issues/168#issuecomment-1943749354, try downgrading ur transformers version

Hi,
I just want to mention that I wont be able to work on the point related to FAv2 in case someone else wants to pick it up.