Update dependencies to address CVEs

Author: AlexsandroRyan
This pull request addresses all CVEs reported by the Checkmarx tool during its execution on this repository.
The previous discussion can be found here: https://github.com/cometbft/cometbft/discussions/3558.
I have updated all necessary dependencies to fix the identified CVEs, but some vulnerabilities remain unresolved. I would appreciate any assistance in addressing these remaining issues.

CVE-2021-3538: This issue is related to the github.com/satori/go.uuid package, which is a dependency of tm-load-test. We have already submitted a PR to address this: https://github.com/informalsystems/tm-load-test/pull/221.

CVE-2024-24786: This vulnerability pertains to the google.golang.org/protobuf package. Running go mod graph | grep google.golang.org/protobuf reveals that many packages are using the vulnerable version. It’s unclear if updating them individually is feasible.

CVE-2024-34478: This vulnerability is associated with github.com/btcsuite/btcd, a dependency of github.com/btcsuite/btcd/btcutil, which is currently used at a version lower than 0.24.0. We have also submitted a pull request for this: https://github.com/btcsuite/btcd/pull/2235.

Please let us know if this approach is sufficient or if there is a more efficient way to resolve these issues.

PR checklist

[ ] ~Tests written/updated~
[ ] ~Changelog entry added in .changelog (we use unclog to manage our changelog)~
[ ] ~Updated relevant documentation (docs/ or spec/) and code comments~
[ ] Title follows the Conventional Commits spec

cc @AlexsandroRyan

https://github.com/advisories/GHSA-33m6-q9v5-62r7: This issue is related to the github.com/satori/go.uuid package, which is a dependency of tm-load-test. We have already submitted a PR to address this: https://github.com/informalsystems/tm-load-test/pull/221.

Thanks for the PR 🙏 Ported it to https://github.com/cometbft/cometbft-load-test/pull/32. It will be released in v0.2.0


[Minor] Improve types shown in cast error messages

Which issue does this PR close?
N/A
Rationale for this change
As suggested by @viirya  on https://github.com/apache/arrow-rs/pull/2284#discussion_r936157060 the amount of qualification on the types in cast error messages is both not helpful it may actually obscure the actual problem
What changes are included in this PR?
Use standard fmt::Debug printing for type names in error messages, as done in the rest of the file
Are there any user-facing changes?
Instead of looking like
Cast error: Cannot cast ... to value of arrow::datatypes::types::Time32SecondType type

Errors now look like
Cast error: Cannot cast ... to value of Time32 type

Codecov Report

Merging #2295 (68954b8) into master (299908e) will decrease coverage by 0.00%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #2295      +/-   ##
==========================================
- Coverage   82.14%   82.14%   -0.01%
==========================================
  Files         248      248
  Lines       63492    63493       +1
==========================================
- Hits        52158    52156       -2
- Misses      11334    11337       +3

Impacted Files
Coverage Δ

arrow/src/compute/kernels/cast.rs
97.17% <100.00%> (+<0.01%)
:arrow_up:

arrow/src/datatypes/datatype.rs
62.30% <0.00%> (-0.32%)
:arrow_down:

parquet_derive/src/parquet_field.rs
65.75% <0.00%> (-0.23%)
:arrow_down:

parquet/src/arrow/schema.rs
96.76% <0.00%> (-0.18%)
:arrow_down:

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.


[Device Support Request] Tuya Siren

Could we please have support for this device added please?

{
"node_descriptor": "",
"endpoints": {
"1": {
"profile_id": 260,
"device_type": "0x0000",
"in_clusters": [
"0x0000",
"0x0003"
],
"out_clusters": [
"0x0003",
"0x0019"
]
}
},
"manufacturer": "_TYST11_d0yu2xgi",
"model": "0yu2xgi",
"class": "zigpy.device.Device"
}

This alarm has support implemented there: https://github.com/Koenkk/zigbee-herdsman-converters/blob/master/converters/fromZigbee.js#L5824
With PR #484 recently merged, it shouldn't be too hard to write that support.
As I recently bought that device, I'll try and write the quirks as soon as I have enough time to dive in (which sadly might not be very soon).

This alarm has support implemented there: https://github.com/Koenkk/zigbee-herdsman-converters/blob/master/converters/fromZigbee.js#L5824
With PR #484 recently merged, it shouldn't be too hard to write that support.
As I recently bought that device, I'll try and write the quirks as soon as I have enough time to dive in (which sadly might not be very soon).

Appreciate your help

For now, the device can be used by manipulating the attributes in the TuyaManufClusterSiren cluster. Their name should be straightforward.
I'll clean up the patch first (making tox happy because it seems it doesn't like my formatting).
Then I will try to find standard clusters that are relevant to that siren and map the information and commands to them.
If someone has information as to how tuya "get_data" should be used to actually get some data back, I'm all ears.

The liked MR makes the tuya siren available as an On/Off device, a Temperature sensor and an humidity sensor. Other attributes (melody, sound duration, automatic alarms, etc.) are available as attributes on the Tuya cluster, and are persistent.
A followup might implement IAS warning device clusters, but that would entail saving the current melody, setting it to a specific "alarm-like" melody, probably changing the maximum duration, then activating the alarm, and reverting back the settings to what they were before, which might be overkill for a zhaquirks implementation.


Update dependencies

$subject

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/7009284291

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/7009284291
Status: failure

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/7009284291

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/7009284291
Status: cancelled


Trim eclipse deps

c2cpg currently depends on a spotless plugin which brings several unnecessary dependencies.  Please investigate whether such a workaround is necessary with 11.2
Why is trimming necessary
With this PR, the size of the atom distributable reduces from 80 MB to 60 MB without losing functionality. The extra space could be used to pack another frontend since there is a limit of 100 MB per package on npm and PyPI.
As an added bonus, log4j could be upgraded since we no longer need the problematic osgi library.
cc: @fabsx00

We should not put jars into this repo or we will run into the traffic limit again.
Also, MacroArgumentExtractor is quite important for correctly generating synthetic calls for macro invocations. I am not aware if a suitable replacement atm.

He is on vacation until 06/30 but that should be doable, yes.

I can probably teach sbt to download that jar as part of the dependency resolution mechanism.

What's the state of this one?

@fabsx00 I was getting SecurityException with this approach. I also noticed that all the indirect dependencies are required to pass all the tests, so the promise of osgi less build isn't possible.

So I am closing this for now.
Looks like the Eclipse dependency hell is not resolvable that easy.


Imported K3s cluster shows up in cluster manager list view, but not in side nav

Setup

Rancher version: 2.6.3 (v2.6-head)
Browser type & version: Chrome

Describe the bug
Imported K3s cluster shows up in cluster manager list view, but not in side nav. It should show up in both places
To Reproduce

Import a K3s cluster
See that it is not listed after clicking the top left hamburger menu

@Shavindra Pretty sure this is fixed - can you verify

During testing on v2.6.3, v2.7.0, and v2.7-head (Commit ID: dadb4c0), and I was unable to reproduce this issue on any of those versions. Due to that fact, as well as comments from @mantis-toboggan-md, I am closing this ticket as resolved.
Steps to Reproduce:

Create a K3s cluster outside of Rancher
Import the cluster into Rancher
Open the left side panel

v2.6.3:

v2.7.0:

v2.7-head (Commit ID: dadb4c0):


✏ Create actor card loader component

Description
Create a loader component for the actor card. This may be identical to the show card loader, but it will be good to have a dedicated component incase things change.

Closed by #781


Template review feedback

Thanks for submitting a template to the gallery, there were a few issues in your template that needed to be resolved ahead of approving the template for the gallery.

The documentation url mentioned in the manifest file is invalid. Please provide valid url.

Hi,
The problem is solved.
In the next few days, we will update documentation.
Many Thanks!


production estimage is too high - https://azure.com/e/65354031bc084e539b6c8ccfc1a7b097

The production estimate estimates that the storage cost to be five terabytes and as a result a very high cost please have a look at lowering this or adjusting the pricing calculator correctly  - https://azure.com/e/65354031bc084e539b6c8ccfc1a7b097

updated the links in the README.md #91


Add a few more known tuya preambles

Added these preambles along with the changes merged in #23, hence closing this PR.


Auto generated documentation should show up as a GitHub page

We should generate our documentation with each release and have it update GitHub Pages. The existing README should be refactored such that it includes examples while linking to the generated docs for parameters.
https://github.com/puppetlabs/puppet-strings#output-documents-to-github-pages

Released in v2.30.1


explicitly pass options with .call to ensure consistent objects

The rational behind this commit is that the initialize method in some situations is unable to override silent.
This occurs when the user instantiating a collection does not pass in any options. In this case, the Collection
constructor creates an empty object ( https://github.com/jashkenas/backbone/blob/master/backbone.js#L722 ).
Then the user override initialize is called using .apply ( https://github.com/jashkenas/backbone/blob/master/backbone.js#L726 )
with arguments, then on the next line the options object is passed. If the user provided options it's all good, because arguments[1]
and options are the same object. But if they do not provide it, arguments[1] is undefined and options is the new created empty object.

For what its worth, the tests are passing locally for me, and Travis is failing on a different test.

Weeee! passing tests. Any thoughts on this? I need to know how I'll proceed on my work based on this being accepted or not.

Good catch.
Ideally, we'd be able to do a version of this patch that still allows for any number of arguments to be passed to the constructor/initialize ... and not limit it to just two.

Really? I feel like you shouldn't be allowed to mutate options passed into initialize.
What's the use case for doing this in initialize instead of where you've invoked the constructor?

No -- it's not about mutation. It's about arguments[1] being undefined in that apply, instead of an empty object. Right?

It's about arguments[1] being undefined in that apply, instead of an empty object.

Right I get that. But what's the use case for needing the same options object in your initialize if not to mutate it?
If you didn't pass anything down from the instantiation why would you need the options object that the constructor creates for itself?

On second thought, @akre54 is right.
If you don't pass in any options, then suddenly getting an empty options object in your initialize would be very weird.

A couple facts still remain here.
If the user doesn't pass options while instantiating, .initialize and .reset receive different arguments.
And while I don't see an issue with one constructor mutating the options in the prototype chain, if that is not desired, some other method of overriding {silent: true} needs to be available. And saying 'make the user pass in that option' isn't acceptable. I have a collection that MUST trigger events, always and forever, that shouldn't be a user choice. Just as it is forced to be silent, there needs to be a method override that is a child constructor.

Also, I don't see the rational behind not emitting events in var c = new Collection([{},{}]) while emitting them when using c.add(....)

@jashkenas As far as the object 'suddenly appearing', every constructor has options || (options = {}), so that is already happening.


liquidation price formula

Hi there,
I have been following the formula on the documentation but my numbers are always about 3 percent off. is there any example code that I can look into?
this is my code:
maintenance_margin_fraction = float(self.vars['market_info'][symbol]['maintenanceMarginFraction'])
oracle_price = float(self.client.public.get_markets(symbol).data['markets'][symbol]['oraclePrice'])

is_long = position_type == 'long'
is_short = position_type == 'short'
is_close = position_type == 'close'

try:
    total_account_value = self.vars['quote_balance']
except KeyError:
    self.fetch_account_balance()
    total_account_value = self.vars['quote_balance']
total_maintenance_margin_requirement = 0
for s in self.exchange_trading_symbols:

    total_maintenance_margin_requirement += abs(
        qty * oracle_price * float(self.vars['market_info'][symbol]['maintenanceMarginFraction'])
    )
    total_account_value += abs(qty * oracle_price)
if is_long:
    return oracle_price * (
                1 - (maintenance_margin_fraction * total_account_value / total_maintenance_margin_requirement))
elif is_short:
    return oracle_price * (
                1 + (maintenance_margin_fraction * total_account_value / total_maintenance_margin_requirement))
else:
    return None

Did you find a solution ?.

Did you find a solution ?.

Unfortunatly no.


[BUG] MYSQL not starting - it says it has files in data folder, even when I clean it out  --initialize specified but the data directory has files in it. Aborting.

Here is the full log of the error. It basically just try to restart constantly but is coming up with the same error. If I manually delete the folder it recreates it (with the auto.cnf) and gives back the same error:
2024-02-13 03:51:24+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 8.3.0-1.el8 started.
2024-02-13 03:51:25+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'
2024-02-13 03:51:25+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 8.3.0-1.el8 started.
2024-02-13 03:51:25+00:00 [Note] [Entrypoint]: Initializing database files
2024-02-13T03:51:25.913150Z 0 [System] [MY-015017] [Server] MySQL Server Initialization - start.
2024-02-13T03:51:25.917781Z 0 [Warning] [MY-010918] [Server] 'default_authentication_plugin' is deprecated and will be removed in a future release. Please use authentication_policy instead.
2024-02-13T03:51:25.917819Z 0 [System] [MY-013169] [Server] /usr/sbin/mysqld (mysqld 8.3.0) initializing of server in progress as process 80
2024-02-13T03:51:25.922590Z 0 [ERROR] [MY-010457] [Server] --initialize specified but the data directory has files in it. Aborting.
2024-02-13T03:51:25.922615Z 0 [ERROR] [MY-013236] [Server] The designated data directory /var/lib/mysql/ is unusable. You can remove all files that the server added to it.
2024-02-13T03:51:25.923161Z 0 [ERROR] [MY-010119] [Server] Aborting
2024-02-13T03:51:25.924244Z 0 [System] [MY-015018] [Server] MySQL Server Initialization - end.
which Branch / PHP Version are you using ?
php83
Steps to reproduce
Expected behavior
well it should work without mysql constantly trying to restart.
docker -v
Docker version 25.0.2, build 29cf629

I was ale to resolve this by resetting my whole system. Raspberrypi OS Lite on a raspy 4.
Not sure why this came up, I assume it were some permission issues.
Anyway it is currently working fine. If this comes back I might post it here, hopefully with more details.


Disable Nix tests from CI

The NixOS KVM in the lab keeps loosing connectivity and we now have the
docker compose tests which should be used instead.
The existing tests are still kept, we're just not running them on CI.

bors try

bors r+


Ignore LineDecoration order when comparing

This PR fixes #80666 . I was really hoping that this will be fixed for September update, but no-surprisingly, was pushed back.
Disclaimer
Be aware that I was unable to test this in vscode build itself, because It's very problematic to get build running. I've tested similar code in debugger's conditional breakpoint and this code in simplified test scenario. But yeah, real-life test is necessary.
The problem
LineDecorations often are changing order when there is after decorator, which messes up drag&drop. With Error Lens extension this is annoying as... something very annoying. More info https://github.com/microsoft/vscode/issues/80666#issuecomment-686768434
The solution
There are 2 approach for this: first to sort every LineDecoration array, but I've settled for second: make comparison order-proof. For starters changes are done in one place, but also future changes will less likely break this.
I've tried to optimize this as good as I could, but maybe this may be improved further.
The elephant
Isn't order important somehow?
No. Which style is used should be determinated by order of CSS rules, so even in different order, decorators should show-up in the same way. If this wasn't the case, this would cause weird style flashing.
The performance
For arr.length <= 1 this could be even faster. For arrays in correct order above 2 elements, this will have overhead of additional array (bSeen), but still should be the same number of comparisons (w/ _equals). On the other hand usually there isn't that many visible elements with 2+ decorators.
However for arrays with different order this will also prevent re-rendering these lines - which happens more often than you may think.
@alexdima This is probably for you to take a look. Or maybe @rebornix  ?

@alexdima @rebornix can you take a look at this before end of current iteration?

Thank you! I decided to sort the line decorations in the end.


SAK-31106

https://jira.sakaiproject.org/browse/SAK-31106?filter=-2
Attempted fix of messaging error. Difficult to confirm with new build.

Closing this PR #2484 is for the same issue.