Awesome AI upscaler

Just found a mind-blowing AI upscaler - https://huggingface.co/spaces/gokaygokay/AuraSR-v2.
It has even a pytorch version - https://github.com/lucidrains/gigagan-pytorch
Examples.
https://senkuro.com/manga/re-monster/chapters/119429828913939988/pages/4
Original image:

Colorized image without upscaling:

Upscaled with RealESRGAN_x4plus_anime_6B:

Upscaled with AuraSR-v2:

Seems good for text and doesn't remove artifacts
ERS:

ASR:

I'll test it in a few hrs.

Almost exactly like in the original image:

ESRGAN (Current) (2 seconds):

GigaGAN x4 (AuraSR-v2) (40 seconds) (The space uses this):

GigaGAN x4 Overlapped (AuraSR-v2) (80 seconds):

The AuraSR is for generic use-case, so it's not only larger by x130 times than ESR, but also takes a long time for the upscale.
I don't recommend using it but if you want:
Download https://huggingface.co/fal/AuraSR-v2/blob/main/model.ckpt, rename it as GigaGAN.ckpt and save it in networks folder.
Then run app-stream.py python app-stream.py --no-ssl --upscaler_type=GigaGAN --upscaler_path=networks/GigaGAN.ckpt
Also compare the output with this: https://huggingface.co/spaces/gokaygokay/AuraSR-v2, since this space is not loading for me, and I modified the source code a bit.
PS:

Thank you very much!

BTW, https://mangadex.org/chapter/d72a3eb8-2b20-4c39-a46f-d282eb05e64f/2 doesn't get colorized.

Oh, just 4s? Great! Must be my GPU then.
Fixed. Does the MC-FJ colorize this?

Oh, MC-FJ also doesn't colorize it...

Is there a way to forcefully colorize an image, and also re-colorize it, when sometimes MC colorizes placeholders?
https://senkuro.com/manga/zettai-ni-damage-wo-ukenai-skill-wo-moratta-node-boukensha-toshite-musou-shitemiru/chapters/136754949798249996/pages/1
MangaColorizer-placeholder-colorization-Video_2024-08-02_23-16-13.webm

Oh, just 4s? Great! Must be my GPU then.

Although, AuraSR-vs size is 2.29GB, but the amount of VRAM it uses is about 7.2GB.

when sometimes MC colorizes placeholders?

Oh I forgot about caches. It caches the wrong image. Should work when caching is off. Will fix.

However, without caching, the load on the system increases, as it has to colorize and upscale again.

Fixed. (Needs some more testing though)

Thanks a lot!
But, at the moment, when MC encounters placeholders, it starts processing the image, that has the placeholder first, eternally, as it can be seen from the server log and the image from page 7 as an example.
MangaColorizer-placeholder-colorizition-02-Video_2024-08-03_09-33-33.webm

Weird, this shouldn't happen.

Oh src can change anyways, previous bad fix reverted. Alternate temp fix pushed.

Thank you so much!
Now there are no issues with placeholders, but the issue regarding the "Show Original" option occurred:
https://github.com/user-attachments/assets/39828a62-1a83-4d2e-87b2-07c6ec0f209f

I'm unable to reproduce it. Is it always happening? Can you send me both the logs?

Thank you for your efforts!
Here's the entire process, which is why the screencast turned out a bit long and I had to split it into several parts to meet the size limitations (10 MB) on Github.
Please pay attention to the first pages of chapters 1 and 1.5 (they will appear to be exactly the same at the end of the colorization).
Part1
https://github.com/user-attachments/assets/ea45ce20-8d61-4901-bf79-c457196d66fe

Part 2
https://github.com/user-attachments/assets/0c19ec07-ed57-43ed-bd0d-4c03726109d7

Part 3
https://github.com/user-attachments/assets/00f3e94b-0ca0-47f0-b1d7-52b976302c15

Part 4
https://github.com/user-attachments/assets/17854c4b-e46f-4737-990c-d7ca9745a91b

Part 5
https://github.com/user-attachments/assets/1542ccca-e45b-4698-aba5-b533d6244163

Part 6
https://github.com/user-attachments/assets/f279c95d-95b2-4698-a3fd-37a88dba185e

Logs:
MangaColorizer-server-log.txt

Screenshot, big screenshot, really big screenshot

This only occurs with Senkuro right? They load the next chapter if you scroll to the bottom and pages start recoloring due to reuse of page names. But the original still doesn't get affected for me.

Yes, I only noticed it on senkuro.com. Though, I haven't been watching much manga lately, mostly just manhua.


ReferenceError: WebAssembly is not defined

crash when use WebAssembly

On iOS WebAssembly in nodejs-mobile is not available because it would require JIT features which iOS apps are not allowed to have.


python312Packages.opower: 0.6.0 -> 0.7.0

Diff: https://github.com/tronikos/opower/compare/refs/tags/v0.6.0...v0.7.0
Changelog: https://github.com/tronikos/opower/releases/tag/v0.7.0
Description of changes

Things done

Built on platform(s)

[ ] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)

[ ] sandbox = relaxed
[ ] sandbox = true

[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[ ] Tested basic functionality of all binary files (usually in ./result/bin/)
24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module

[ ] Fits CONTRIBUTING.md.

Add a :+1: reaction to pull requests you find important.

Result of nixpkgs-review pr 335686 run on x86_64-linux 1

5 packages built:

home-assistant-component-tests.opower
python311Packages.opower
python311Packages.opower.dist
python312Packages.opower
python312Packages.opower.dist


Missing icons wxART***

Using wxGlade 0.9.0a1
On Windows I get this error on opening wxglade.py
12:21:47 ч.: can't open file 'mypath\wxGlade\icons\wxART_NEW' (error 2: the system cannot find the file specified.)
12:21:47 ч.: Failed to load image from file mypath\wxGlade\icons\wxART_NEW".
12:21:47 ч.: can't open file 'mypath\wxGlade\icons\wxART_FILE_OPEN' (error 2: the system cannot find the file specified.)
12:21:47 ч.: Failed to load image from file "mypath\wxGlade\icons\wxART_FILE_OPEN".
12:21:47 ч.: can't open file 'mypath\wxGlade\icons\wxART_FILE_SAVE' (error 2: the system cannot find the file specified.)
12:21:47 ч.: Failed to load image from file "mypath\wxGlade\icons\wxART_FILE_SAVE".
12:21:47 ч.: can't open file 'mypath\wxGlade\icons\wxART_REDO' (error 2: the system cannot find the file specified.)
12:21:47 ч.: Failed to load image from file "mypath\wxGlade\icons\wxART_REDO".
12:21:47 ч.: can't open file 'mypath\wxGlade\icons\wxART_REDO' (error 2: the system cannot find the file specified.)
12:21:47 ч.: Failed to load image from file mypath\wxGlade\icons\wxART_REDO".
12:21:47 ч.: can't open file 'mypath\wxGlade\icons\wxART_EXECUTABLE_FILE' (error 2: the system cannot find the file specified.)
12:21:47 ч.: Failed to load image from file "mypath\wxGlade\icons\wxART_EXECUTABLE_FILE".
12:21:47 ч.: can't open file 'mypath\wxGlade\icons\wxART_HELP_BOOK' (error 2: the system cannot find the file specified.)
12:21:47 ч.: Failed to load image from file "mypath\wxGlade\icons\wxART_HELP_BOOK".
I don't see these in the icons folder.
Strange is I don't get the same on Linux Mint.

The ART_... icons are built into wxWidgets/wxPython: https://github.com/wxWidgets/wxWidgets/tree/aab02ec1ceb4602ea1da23a5d422af0f7abea21d/art
That looks like a wxPython issue. Are you using the stock wxPython version from PIP?
Please check whether the ArtProvider.py from the wxPython demo is working for you.

The problem is on my office computer, but I believe I installed from pip. However there it's python2, and on linux I use it with python3 and wheels from https://extras.wxpython.org/wxPython4/extras/linux/
Note that error message pops-up on open wxglade.py (no project loaded, etc.) also note that the path is wxGlade\icons, i.e. it looks for these in the wxGlade subfolder.

That's probably the fallback to check for a file. I've just tried and with Python 2.7 and Phoenix I see the problem too.

It turned out that for Phoenix wxART_... constants are strings in Python 2.
Fix is in the repository. Thanks a lot.

fixed in 0.9.0b1


Add noise generator

I made the NoiseGenerator, but I want to see if you find it confusing or not. It works differently from other generators, since instead of one tile, it has a "Tiles" dictionary, which includes thresholds and TileInfo.

Basically, for each tile in the world size, it loops through all of these and, if the noise value at those coordinates is higher than the threshold, it places the corresponding TileInfo.
func _set_grid() -> void:
	for x in settings.worldSize.x:
		for y in settings.worldSize.y:
			var noise = settings.noise.get_noise_2d(x, y)
			for threshold in settings.tiles:
				if not (threshold is float) or not (settings.tiles[threshold] is TileInfo):
					continue
				if noise > threshold:
					grid[Vector2(x, y)] = settings.tiles[threshold]
					break

It generates results like this:

Obviously, it will be a lot better when Godot finishes implementing typed dictionaries. (https://github.com/godotengine/godot/pull/78656)
I'd appreciate the feedback!

Btw, this wouldn't work with the GenerateBorders or Walls modifiers, since those get the

This is as far as it goes with optimization it seems. Though one change I'd recommend is to create another variable that contains only the tiles from settings.tiles that match if not (threshold is float) or not (settings.tiles[threshold] is TileInfo) and run the loop on that to save a bunch of comparisons, I don't think it would make a ton of difference but it might be worth a shot

I could maybe add a setter to the variable so if it finds any values or keys that don't match those types, it deletes it, so you can't even add any.


undefined is not an object (evaluating 't.api.getBalance') when executing api.doInvoke

Executing the following code is creating an issue for us when using react-native:
import { api, wallet, u, nep5 } from '@cityofzion/neon-js';
.
.
.
export const submitNeonStory = async (w, promoter_wallet, hex_wallet, hex_challenge) => {
return api.doInvoke({
net: env.net,
url: env.rpcEndpoint,
account: w,
script: {
scriptHash: env.nodis_contract,
operation: 'submit',
args: [promoter_wallet, hex_wallet, hex_challenge]
},
gas: 0
})
}
We're getting the following error:
undefined is not an object (evaluating 't.api.getBalance')

node_modules/@cityofzion/neon-js/dist/browser.js:21:174719 in yt$argument_3
node_modules/regenerator-runtime/runtime.js:45:44 in tryCatch
node_modules/regenerator-runtime/runtime.js:274:30 in invoke

http://packager.q8-kvy.anonymous.nodis.exp.direct/node_modules/expo/AppEntry.bundle?platform=ios&dev=true&minify=false&hot=false:176495:43 in

node_modules/promise/setimmediate/core.js:45:7 in tryCallTwo
node_modules/promise/setimmediate/core.js:200:23 in doResolve
node_modules/promise/setimmediate/core.js:66:12 in Promise
node_modules/@cityofzion/neon-js/dist/browser.js:21:174286 in yt
node_modules/promise/setimmediate/core.js:37:14 in tryCallOne
node_modules/promise/setimmediate/core.js:37:14 in tryCallOne
node_modules/promise/setimmediate/core.js:123:25 in setImmediate$argument_0
node_modules/react-native/Libraries/Core/Timers/JSTimers.js:146:14 in _callTimer
node_modules/react-native/Libraries/Core/Timers/JSTimers.js:194:17 in _callImmediatesPass
node_modules/react-native/Libraries/Core/Timers/JSTimers.js:458:30 in callImmediates

[native code]:null in callImmediates

node_modules/react-native/Libraries/BatchedBridge/MessageQueue.js:407:6 in __callImmediates
node_modules/react-native/Libraries/BatchedBridge/MessageQueue.js:143:6 in __guard$argument_0
node_modules/react-native/Libraries/BatchedBridge/MessageQueue.js:384:10 in __guard
node_modules/react-native/Libraries/BatchedBridge/MessageQueue.js:142:17 in __guard$argument_0

[native code]:null in flushedQueue
[native code]:null in callFunctionReturnFlushedQueue

The error is probable here. What is w that you are passing in?

This is an open wallet.
const w = await new wallet.Account(key)

are you providing the api field of the configuration object? That is the API provider for it to retrieve the balance.

I am not providing the api field at the moment. Not sure I ever used this field. Can you provide an example?

http://cityofzion.io/neon-js/docs/en/examples/smart_contract.html#high-level

Thanks. In this example, a variable is assigned to api. Can't seem to find what the value would look like. Is that supposed to be a node URL/
When reverting the neon-js version to 3.9.11, api doesn't seem to be necessary.

this should give a clearer picture if you are in v4.


3.1.x WAL writes much more to disk than 3.0.x

OrientDB Version: 3.1.7
Java Version: 1.11
OS: Linux
Expected behavior
WAL writes and OrientDB write throughput is similar or better in 3.1.x than in 3.0.x
Actual behavior
Sending the same data to 3.0.x and 3.1.x results in a 5x slowness. I've been debugging the code and measuring performance and it looks like the amount of data written to the WAL in 3.1.x is much bigger than in 3.0.x
Steps to reproduce
Send the same data to a 3.0.x and a 3.1.x OrientDB servers.
In my use case I'm upserting a high volume of data to a graph that contains around 500k vertex and 4 million edges

Hi @madmac2501 , a big surprise for me. Will check this of course. Can you provide any benchmark as a referral which I can use?

Hi @madmac2501 , a big surprise for me. Will check this of course. Can you provide any benchmark as a referral which I can use?

Sorry but I'm testing with customer data and I cannot share the data. But the overall numbers are a graph that contains around 500k vertex and 4 million edges. I can share the schema with the classes and the indexes privately.
Please send me an email to<EMAIL_ADDRESS>and I can share more info privately.
Thanks a lot.

Sorry but I'm testing with customer data and I cannot share the data. But the overall numbers are a graph that contains around 500k vertex and 4 million edges. I can share the schema with the classes and the indexes privately.
Please send me an email to<EMAIL_ADDRESS>and I can share more info privately.
Thanks a lot.

Any chance that you built 3.1 latest snapshot and try?

Any chance that you built 3.1 latest snapshot and try?

sure, I'll test latest version from git.

sure, I'll test latest version from git.

"Sorry but I'm testing with customer data and I cannot share the data." - I mean is it possible for you to create a minimal artificial benchmark to reproduce the issue? I have benchmarked both versions. 3.1. a bit slower, but only on a small number of percents not 5 at times.

"Sorry but I'm testing with customer data and I cannot share the data." - I mean is it possible for you to create a minimal artificial benchmark to reproduce the issue? I have benchmarked both versions. 3.1. a bit slower, but only on a small number of percents not 5 at times.

I got the same performance results with 3.1.x with commit 342dedeab8b86f2e7ef86bccc4a681f481417484.
I'll try to build a synthetic benchmark but it will take some time. I'll come back when I reproduce the performance with this new benchmark.
Thanks a lot @laa

I got the same performance results with 3.1.x with commit 342dedeab8b86f2e7ef86bccc4a681f481417484.
I'll try to build a synthetic benchmark but it will take some time. I'll come back when I reproduce the performance with this new benchmark.
Thanks a lot @laa

I've been trying to build a synthetic benchmark but I still have not found a clear dataset to reproduce it. Still working on it.

Hi @madmac2501 ,
Could you do the following then.
Could you setup https://github.com/jvm-profiling-tools/async-profiler .  Then could you perform your benchmark on production data using both 3.1 and 3.0 versions and send results back to me.


History still visible when all graphs are closed.

To Reproduce:

Open any number of graphs.
Upon closing all of them history is still visible.

The issue doesn't seem big but upon clicking restore, nothing is happening.

@pradeeban I think that is not an issue, As in chrome bowser history also persists even when we close the tabs

As history accounts for what work we have done in past not the work we are doing now , is @pradeeban this is correct

Oh ! I think name of the issue should be not able to restore history

The issue @Rahuljagwani reported is once you close the study, its (the last-closed graphml) history is still visible. It is a valid issue (although it does not bother us much).
I will test and merge shortly.
There is also a bigger issue with how history is handled for studies. But that is for a separate discussion.

As history accounts for what work we have done in past not the work we are doing now , is @pradeeban this is correct

Hi @parteekcoder , you are absolutely correct about the browser history thing.
But case here is little different as when we close last graph history remains visible in history modal and it is not possible to restore any state of it as variables curGraphIndex and curGraphInstance will become 0 and null respectively. So no point in showing last graphs history.
One point you mentioned about browser tab history can be good extension in concore-editor i.e. it will contain history of all graphs or studies loaded and removed.

The issue @Rahuljagwani reported is once you close the study, its (the last-closed graphml) history is still visible. It is a valid issue (although it does not bother us much).
I will test and merge shortly.
There is also a bigger issue with how history is handled for studies. But that is for a separate discussion.

Sure we will discuss on it.

When Shubham implemented DHGWorkflow during his GSoC 2021, he had visions for sharing the graphs across multiple users through a server version, and thus a stronger reason for maintaining history. When Aviral adopted DHGWorkflow for concore as the concore editor during his GSoC 2022, we had already moved away from the ideas of such a collaborative server environment. So, while it is still a neat feature, the history feature is rarely used anymore. That explains the untested issues and bugs you have found (and will find) in the history feature. @parteekcoder @Rahuljagwani

When Shubham implemented DHGWorkflow during his GSoC 2021, he had visions for sharing the graphs across multiple users through a server version, and thus a stronger reason for maintaining history. When Aviral adopted DHGWorkflow for concore as the concore editor during his GSoC 2022, we had already moved away from the ideas of such a collaborative server environment. So, while it is still a neat feature, the history feature is rarely used anymore. That explains the untested issues and bugs you have found (and will find) in the history feature. @parteekcoder @Rahuljagwani

Understood, I will keep this in mind while testing.


Breaks binary and image build up for kind in staging

Issue #, if available:
Description of changes:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

/retest

/unhold

/override cloud-provider-vsphere-tooling-presubmit
/override cluster-api-tooling-presubmit
/override emissary-tooling-presubmit
/override harbor-tooling-presubmit
/override imagebuilder-presubmit
/override kind-tooling-presubmit
/override kube-rbac-proxy-tooling-presubmit
/override trivy-tooling-presubmit


[EPIC] - Automate the Rancher UI Release Process

We need to automate the Rancher UI process.

Identify all steps in the process. Phil from the UI team is the point person to help.
Recommend a means of automating the steps. This can be via GHA, Go code, etc...
Define structure for release command sub command

Docs

[DRAFT] Proposal
Release Checklist
Dashboard and Ember Release Process


Aborted (core dumped) in tf.raw_ops.MatrixSolve

Issue type
Bug
Have you reproduced the bug with TensorFlow Nightly?
Yes
Source
source
TensorFlow version
tf 2.17
Custom code
Yes
OS platform and distribution
Linux Ubuntu 22.04.3 LTS (x86_64)
Mobile device
No response
Python version
3.9.13
Bazel version
No response
GCC/compiler version
No response
CUDA/cuDNN version
No response
GPU model and memory
No response
Current behavior?
When the shape of the matrix argument is empty and the gpu is available, tf.raw_ops.MatrixSolve triggers a crash.
It can be reproduced on tf-nightly when the gpu is available.
Standalone code to reproduce the issue
import tensorflow as tf
tf.raw_ops.MatrixSolve(matrix=tf.random.uniform([], dtype=tf.dtypes.double, maxval=1000000000), rhs=tf.random.uniform([1, 2], dtype=tf.dtypes.double, maxval=1000000000), adjoint=True)

Relevant log output
2024-11-20 14:51:08.714846: I tensorflow/core/util/port.cc:153] oneDNN custom operations are on. You may see slightly different numerical results due to floating-point round-off errors from different computation orders. To turn them off, set the environment variable `TF_ENABLE_ONEDNN_OPTS=0`.
2024-11-20 14:51:08.775383: E external/local_xla/xla/stream_executor/cuda/cuda_fft.cc:485] Unable to register cuFFT factory: Attempting to register factory for plugin cuFFT when one has already been registered
2024-11-20 14:51:08.852267: E external/local_xla/xla/stream_executor/cuda/cuda_dnn.cc:8454] Unable to register cuDNN factory: Attempting to register factory for plugin cuDNN when one has already been registered
2024-11-20 14:51:08.876168: E external/local_xla/xla/stream_executor/cuda/cuda_blas.cc:1452] Unable to register cuBLAS factory: Attempting to register factory for plugin cuBLAS when one has already been registered
2024-11-20 14:51:08.931206: I tensorflow/core/platform/cpu_feature_guard.cc:210] This TensorFlow binary is optimized to use available CPU instructions in performance-critical operations.
To enable the following instructions: SSE4.1 SSE4.2 AVX AVX2 AVX512F AVX512_VNNI AVX512_BF16 AVX512_FP16 AVX_VNNI AMX_TILE AMX_INT8 AMX_BF16 FMA, in other operations, rebuild TensorFlow with the appropriate compiler flags.
2024-11-20 14:51:16.385650: I tensorflow/core/common_runtime/gpu/gpu_device.cc:2021] Created device /job:localhost/replica:0/task:0/device:GPU:0 with 535 MB memory:  -> device: 0, name: NVIDIA GeForce RTX 4090, pci bus id: 0000:1f:00.0, compute capability: 8.9
2024-11-20 14:51:16.387914: I tensorflow/core/common_runtime/gpu/gpu_device.cc:2021] Created device /job:localhost/replica:0/task:0/device:GPU:1 with 71 MB memory:  -> device: 1, name: NVIDIA GeForce RTX 4090, pci bus id: 0000:d4:00.0, compute capability: 8.9
2024-11-20 14:51:16.542383: F tensorflow/core/framework/tensor_shape.cc:356] Check failed: d >= 0 (0 vs. -1)
Aborted (core dumped)

@x0w3n,
Have you tried by providing the input value as a tensor rather than the empty dataset? I tried and it is working as expected. Kindly find the gist of it here. Also the input is a tensor of shape [..., M, M] whose inner-most 2 dimensions form square matrices.


Send did change synchronously to address #267

I think it is enough to send didChange synchronousy to fix #267. I've only tried it with pyright so there might be some issue together with other language servers.

Hi, it looks reasonable to do this synchronously since it should always be fast.
However, it seems to break completion with rls 1.41
Start kak like
PATH=target/debug:$PATH kak +110 src/main.rs
and type matches. in a new line. I no longer get field/method completions.
Of course this could be because of some issue with rls..

also let me know if you have found a way to trigger the race condition

Thanks krobelus! I'm swamped right now, I hope I can get a reliable way to reproduce the race condition later.


[fix] updated nativekey

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.


Issue with sqlcmd connection

$ sqlcmd -S localhost -U sa
Password:
Sqlcmd: Error: Microsoft ODBC Driver 18 for SQL Server : SSL Provider: [error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:self signed certificate].
Sqlcmd: Error: Microsoft ODBC Driver 18 for SQL Server : Client unable to establish connection. For solutions related to encryption errors, see https://go.microsoft.com/fwlink/?linkid=2226722.
Have tried multiple options setting env variables, disabling encryption changes to MSSQL config file, disabling ODBC driver connection encryption. Nothing works. Some serious documentation issues with the images provided for MSSQL for Linux images listed in Azure portal. Please reach out to<EMAIL_ADDRESS>

@nkotha88 -- thank you for your feedback.  Please consider these resources:

SQL Server on Microsoft Q&A
DBA Stack Exchange
Stack Overflow

If you feel this is a product issue, please add it here:

SQL Server feedback

@David-Engel -- please look into this potential documentation issue.

@nkotha88
With mssql-tools18, sqlcmd and bcp behavior changed to be secure, by default, and will require encryption from the server. In your case, the server is using a self-signed (likely the built-in) certificate. If your server doesn't require encryption, you can use the -No option to connect without encryption:
sqlcmd -No -S localhost -U sa

If your server requires encryption (or you want to use it) and you know you can trust it, you can use the -C option to trust the server's certificate:
sqlcmd -C -S localhost -U sa

The Connecting with sqlcmd article describes the sqlcmd options.

Some serious documentation issues with the images provided for MSSQL for Linux images listed in Azure portal.

Which articles have issues? If you point me to the ones you are looking at, I can forward the info to the appropriate person.
Thanks,
David

Hi David and William,
Thank you for reaching out.
Here are a few things that I as a new bee to SQL on Azure Linux have faced during VM image SQL Server 2022 on RHEL HA-8.6 deployment and then configuring it.
Coming from Oracle and using Linux with Oracle/PostgreSQL and some SQL on Windows experience I feel the following changes could help a customer starting out to explore SQL on Linux Journey.
Looking forward to hear anything I did not do as best practice.

Below command does not work as we can see, probably a typo?
https://learn.microsoft.com/en-us/sql/linux/quickstart-install-connect-red-hat?view=sql-server-ver16&tabs=rhel8
Install the SQL Server command-line tools
sudo yum install -y mssql-tools18 unixodbc-dev ==> This one needs to be corrected if not you will get the following error.
@.*** ~]$ sudo yum install -y mssql-tools18 unixodbc-dev
Repository packages-microsoft-com-prod is listed more than once in the configuration
Repository packages-microsoft-com-mssql-server-2022 is listed more than once in the configuration
Last metadata expiration check: 0:13:35 ago on Mon 14 Aug 2023 05:45:34 AM UTC.
No match for argument: unixodbc-dev
Error: Unable to find a match: unixodbc-dev
WA: Use below cmmands.
sudo yum install mssql-tools18 unixODBC-devel
or sudo ACCEPT_EULA=Y yum install -y mssql-tools18 unixODBC-devel

Let's say I followed the correct doc https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/linux/sql-vm-create-portal-quickstart?view=azuresql&viewFallbackFrom=sql-server-ver1https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/linux/sql-vm-create-portal-quickstart?view=azuresql&viewFallbackFrom=sql-server-ver16

after deployment of VM. SQLCMD -No option is still an issue, and you need to refer to https://learn.microsoft.com/en-us/sql/linux/quickstart-install-connect-red-hat?view=sql-server-ver16&tabs=rhel8
again, for references/troubleshooting. Since we do not have enough info on what is installed on the server and the best practices and references based on various versions of SQL and ODBC config.
For example sqlcmd -No -S localhost -U sa does not work if we do not reinstall ODBC with 18 version for SQL Server 2022 on RHEL HA-8.6 image.
@.*** ~]$
@.*** ~]$ sudo systemctl stop mssql-server
@.*** ~]$ sudo /opt/mssql/bin/mssql-conf set-sa-password
Enter the SQL Server system administrator password:
Confirm the SQL Server system administrator password:
Configuring SQL Server...
ForceFlush is enabled for this instance.
ForceFlush feature is enabled for log durability.
The system administrator password has been changed.
Please run 'sudo systemctl start mssql-server' to start SQL Server.
@.*** ~]$
@.*** ~]$
@.*** ~]$
@.*** ~]$ sudo systemctl start mssql-server
@.*** ~]$
@.*** ~]$
@.*** ~]$ echo 'export PATH="$PATH:/opt/mssql-tools/bin"' >> ~/.bash_profile
@.*** ~]$ echo 'export PATH="$PATH:/opt/mssql-tools/bin"' >> ~/.bashrc
@.*** ~]$ source ~/.bashrc
@.*** ~]$
@.*** ~]$ sudo firewall-cmd --zone=public --add-port=1433/tcp --permanent
success
@.*** ~]$ sudo firewall-cmd --reload
success
@.*** ~]$ sqlcmd -No -S localhost -U sa
Password:
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : SSL Provider: [error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:self signed certificate].
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Client unable to establish connection.
@.*** ~]$
@.*** ~]$
@.*** ~]$ sqlcmd -C -S localhost -U sa  ==> Again -C options works with this version of ODBC which appears to be 17 which comes default with the image.
Password:
1>
2>
3>
Work Around: for -No part of SQLCMD: Go to doc https://learn.microsoft.com/en-us/sql/linux/quickstart-install-connect-red-hat?view=sql-server-ver16&tabs=rhel8
and start at ODBC part to remove and readd properly with version 18.
sudo ACCEPT_EULA=Y yum install -y mssql-tools18 unixODBC-devel
sudo yum check-update
sudo yum update mssql-tools18
Now below works:
@.*** ~]$ echo 'export PATH="$PATH:/opt/mssql-tools18/bin"' >> ~/.bash_profile
@.*** ~]$
@.*** ~]$ echo 'export PATH="$PATH:/opt/mssql-tools18/bin"' >> ~/.bashrc
@.*** ~]$ source ~/.bashrc
@.*** ~]$
@.*** ~]$ sqlcmd -No -S localhost -U sa
Password:
1>
2>
3>

Highlight that the admin user created during the installation is only limited to Linux OS level super user or can be used as sudo. The need for sa user
right after logging into the new deployment. Any references to details of tools actually installed with the image like the binary's/log directory structures and tools etc.
  Even referencing some links to SQLCMD usage https://learn.microsoft.com/en-us/sql/connect/odbc/linux-mac/connecting-with-sqlcmd?view=sql-server-ver16
  in all the docs.

If you do not stumble on  https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/linux/sql-vm-create-portal-quickstart?view=azuresql&viewFallbackFrom=sql-server-ver1https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/linux/sql-vm-create-portal-quickstart?view=azuresql&viewFallbackFrom=sql-server-ver16
and configure using  https://learn.microsoft.com/en-us/sql/linux/quickstart-install-connect-red-hat?view=sql-server-ver16&tabs=rhel8 then you will find many options pretty confusing
and after some extensive time, you would look for other documents like the QuickStart guide.
sudo /opt/mssql/bin/mssql-conf setup ==> especially for this step as it differs a lot in both docs.

We do not have any tutorial links/blogs/videos pointing out which docs to follow for SQL Server Image on Linux post deployment. All the content was generic to VM
troubleshooting and Maintenace etc.

==> It was after I deployed it a few times troubleshooting I saw the plans section under the image creation tabs which had the following. This could be changed to refer to the post

deployment doc for better guidance.

[cid:09f25c5c-edd3-4381-8cf3-a5a5fad85a75]
[cid:2d55b6fa-a0c8-4b85-ba14-4598dda92a5d]
Thanks,
Nitish

From: David Engel @.>
Sent: Friday, August 11, 2023 6:34 PM
To: MicrosoftDocs/sql-docs @.>
Cc: Nitish Reddy Kotha @.>; Mention @.>
Subject: Re: [MicrosoftDocs/sql-docs] Issue with sqlcmd connection (Issue #9239)
@nkotha88https://github.com/nkotha88
With mssql-tools18, sqlcmd and bcp behavior changed to be secure, by default, and will require encryption from the server. In your case, the server is using a self-signed (likely the built-in) certificate. If your server doesn't require encryption, you can use the -No option to connect without encryption:
sqlcmd -No -S localhost -U sa
If your server requires encryption (or you want to use it) and you know you can trust it, you can use the -C option to trust the server's certificate:
sqlcmd -C -S localhost -U sa
The Connecting with sqlcmdhttps://learn.microsoft.com/en-us/sql/connect/odbc/linux-mac/connecting-with-sqlcmd?view=sql-server-ver16 article describes the sqlcmd options.
Some serious documentation issues with the images provided for MSSQL for Linux images listed in Azure portal.
Which articles have issues? If you point me to the ones you are looking at, I can forward the info to the appropriate person.
Thanks,
David
—
Reply to this email directly, view it on GitHubhttps://github.com/MicrosoftDocs/sql-docs/issues/9239#issuecomment-1675475668, or unsubscribehttps://github.com/notifications/unsubscribe-auth/A3TBLUGCPVD2VRUW3PJMIELXU2XQ5ANCNFSM6AAAAAA3NF4THY.
You are receiving this because you were mentioned.

As requested in another PR, please move this discussion internally if you're a Microsoft employee.


Higher level HPA Preferences API and controller

Its easy to federate a given k8s resource with the current federation v2 infrastructure. Federated HPA is also no exception. Default propagation of hpa with possible overrides per cluster (as with using template, overrides and placements) has some, but limited usage. A higher level HPA scheduling API and controller with extended logic makes for a feature set with more usage and value.
A suitable resource name for this could be HPASchedulingPreferences (similar to ReplicaSchedulingPreferences) under group federatedscheduling.
This also provides feature parity with federation V1.

what is the status of this feature?

@a0144 this was put out on the backlog to be explored if an user requirement comes up, or  interested user/users show up with a relevant use case. Do you have a use case which can substantiate the need of this feature?

@irfanurrehman yes, I have two on-prem kubeadm clusters, where under normal circumstances only one is used to run the workloads. The pods for each service are scaled up by HPA locally in cluster1 as long as there are enough resources to do so. If not, they should be scaled into the second cluster. If you have some ideas of other ways to make it work I'd be really glad to get some tips.

@a0144. I am not aware of any alternative behaviours to make this work as of now. I would recommend you join the kubefed work group sync tomorrow @ 7:30 PT at https://zoom.us/my/k8s.mc to talk about your use case. I can add an agenda item if you confirm your presence.

@irfanurrehman Thanks for the info. I'll join the meeting tomorrow

Hi @irfanurrehman @a0144. Do you have any news on this, like design proposals?

@sancyx this issue is waiting for more evidence of the utility. If you have a reasonable use case then we can talk further about it. Talking about it at the community meeting as mentioned here is a good first step.

/remove-lifecycle stale


fix: css order problem in async chunk

In some case which use async chunk, the style of current chunk could be covered by the dependencies, cause page style to fail.
Example: https://github.com/vitejs/vite/issues/3924

Additional context

What is the purpose of this pull request?

[ ] Bug fix
[ ] New Feature
[ ] Documentation update
[ ] Other

Before submitting the PR, please make sure you do the following

[x] Read the Contributing Guidelines.
[x] Read the Pull Request Guidelines and follow the Commit Convention.
[x] Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
[x] Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
[x] Ideally, include relevant tests that fail without this PR but pass with it.

https://github.com/vbenjs/vite-plugin-style-import/issues/27

@poyoho @IanVS pinging you since you have been looking into this problem before. Related PRs:

https://github.com/vitejs/vite/pull/6301
https://github.com/vitejs/vite/pull/9278

This PR from @sanyuan0704 looks good to me. Looking at your previous PRs @poyoho I think I may be missing something here. But seeing the same scheme but in the aggregation of module preload and CSS for HTML entries, we are also doing the same order as this PR is proposing: https://github.com/vitejs/vite/blob/85fa2c89f35ecdda4ec5ed52ea50110337d98822/packages/vite/src/node/plugins/html.ts#L657

Thanks for the ping, @patak-dev.  I built this branch and tried it out in my app, and unfortunately it doesn't seem to fix the issue for me.  I think it would be great if the tests from https://github.com/vitejs/vite/pull/9278 could be added in this PR as well, and that might illuminate the problem.

Thanks for the ping, @patak-dev. I built this branch and tried it out in my app, and unfortunately it doesn't seem to fix the issue for me. I think it would be great if the tests from #9278 could be added in this PR as well, and that might illuminate the problem.

I found the reproduction repo in your issue https://stackblitz.com/edit/vite-gu874q?file=main.jsx. And in this pr branch the css problem in the repo can be resolved.

I don't doubt that, but there are other cases that @poyoho and I identified as he's been working extensively on this issue, which we've worked together to create test cases for.  For instance, mixing css and css module imports, or one that's particularly tricky: multiple imports that share a common css import.

@sanyuan0704  Thank you very much for studying this question. But the real situation is much more complicated than that test case.
I think this PR does not solve the problem of CSS order. Because this PR is the same as my first plan. If you are interested in following up on this issue, you can refer to our latest test case # 9278

@IanVS @poyoho shouldnt we still apply this PR as a step in the right direction? We now have two diff orders if the preload is in HTML or it is in a dynamic impor in JS. Even if we dont solve all the issues, we should at least start using the same order in both places, no?

Sure I don't see why not, as long as the issue stays open. We can update the reproduction with a different test case.

This change can pass some test case. However, the most fundamental reason is that the loading of dev is A -> B -> C, and the loading of prod is A- > (B + C). So If you add setTimeout to the dynamic import of the test case or change the import order in the chunk, I think the test case will not pass.
I am worried that it will affect users who used to run well with this bug.

This change can pass some test case. However, the most fundamental reason is that the loading of dev is A -> B -> C, and the loading of prod is A -> (B + C). So If you add setTimeout to the dynamic import of the test case or change the import order in the chunk, I think the test case will not pass.
I am worried that it will affect users who used to run well with this bug.

I think the problem solved by this pr is that the css of the asynchronous chunk itself should not be overwritten by the dependent chunk style, which should be a very reasonable function.Because in current version, vite will inject css link by follow sequence:
chunk style
dependencies style link

But the correct way is opposit:
dependencies style link
chunk style

@poyoho about this,

I am worried that it will affect users who used to run well with this bug.

They should already be affected by this issue if that is the case. Right now, if you have module.js with deps on a.css and b.css (through an internal async js module) then we have:
If you do <script src="module.js"> in an entry HTML, then the order is b.css -> a.css. If you change that to a dynamic import, it is then a.css -> b.css.
So depending on how we import it, we have two different orders. Looks like at least the order should be b.css -> a.css in both cases, no?

Adding this one to the 3.2 milestone to avoid potential issues. I think we should start the 3.2 beta sooner this time so we can ship this fix and others that are already piling up.

@poyoho

the most fundamental reason is that the loading of dev is A -> B -> C, and the loading of prod is A -> (B + C).

The loading is parallel in prod, but the CSS's precedence is determined by the order of link/style tags. So it does not matter whether the loading is parallel or serial.
During dev, the order of style tag is determined in the order of module evaluation. During prod, the order of link tag is determined in the order of __vitePreload.
So IIUC what we need to consider is the difference between ES module evaluation order and __vitePreload order. (Since we use rollup's chunking mechanism, I think it's concatinated in the ES module evaluation order)

So If you add setTimeout to the dynamic import of the test case

Do you mean something like below?
// main.jsx
setTimeout(() => {
  import('./components/GreenButton').then(({ GreenButton }) => {
    render(<GreenButton />, document.querySelector('#green'))
  })
}, 1000)

import('./components/BlueButton').then(({ BlueButton }) => {
  render(<BlueButton />, document.querySelector('#blue'))
})

This worked with this PR. I think it's working because import('./components/BlueButton') imports Button.css -> BlueButton.css and import('./components/GreenButton') imports only GreenButton.css. (__vitePreload dedupes Button.css when importing GreenButton)
Or do you mean something like below?
// GreenButton.jsx
import React from 'react'
import { Button } from './Button'
import './GreenButton.css'

await new Promise(resolve => setTimeout(resolve, 1000))

export function GreenButton() {
  return <Button className="green">I'm a green button</Button>
}

This seems to work with this PR too. (esbuild.supported = { 'top-level-await': true } is needed)
I'm not familar with top-level await module evaluation order. So there might be a case, it does not work. 🤔

change the import order in the chunk

// GreenButton.jsx
import React from 'react'
import './GreenButton.css'
import { Button } from './Button'

export function GreenButton() {
  return <Button className="green">I'm a green button</Button>
}

I think you mean the code above. Yes, this does not work with this PR. (green button should be black but it's green)
The tricky point here is JS only evaluate modules once but users might not expect CSS to be evaluated only once.
But I think this case can be ignored. It's very difficult to implement, I even guess it's impossible to fulfill it. IIUC Webpack's mini-css-extract-plugin also does not support this. It gives users a warning, so that might be great to have.
https://github.com/webpack-contrib/mini-css-extract-plugin/blob/752b913523077d74d575c777b2bcc3239b724688/src/index.js#L1231-L1270
https://github.com/webpack-contrib/mini-css-extract-plugin/tree/master#ignoreOrder

And my test case is from #9278. setTimeout case like this. I think it is impossible to guarantee the same CSS order under the current CSS loading logic. So my approach is to make the CSS loading logic of Dev and prod consistent.
And maybe we can use more runtime to fix it had the same order. But I still think it's hard to do 🤦

This problem has bothered me for a long time. When I use UnoCSS and UI component library together, UnoCSS can correctly override UI component library styles in development environment, but not in production environment, the reason is that Vite development and production CSS are not in the same order
(This text is a machine translation, sorry, my English is not very good)

@patak-dev  Hello, i have add test case and remove react in them.

I'm confused that after pnpm install the nest-deps files has been influenced and i cannot commit the files in  node_modules/test-pcakage-a/

Thanks! I do not know why it didn't work in your environment, but I've pushed a commit after running pnpm i. Maybe you are using an old pnpm?

Thanks! I do not know why it didn't work in your environment, but I've pushed a commit after running pnpm i. Maybe you are using an old pnpm?

My local pnpm version was 7.9 which matched the vite repo.But it still cannot work.Anyway, thank you for updating the file
to make the tests pass ❤.


feat: allow Multipart to be public

I'm working on a package which uses this package, but internally manages the Shelf Request instance so the body is readable more than once.
Currently the Stream<Multipart> get parts extension getter calls read() which doesn't work in this case. If the Multipart constructor was public, this would allow handling of internally reading the request body.

Released as shelf_multipart: ^1.0.0. Thanks!


Action

Codecov Report

Merging #12 into master will increase coverage by 0.19%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master      #12      +/-   ##
==========================================
+ Coverage   83.07%   83.26%   +0.19%
==========================================
  Files          11       11
  Lines         520      526       +6
==========================================
+ Hits          432      438       +6
  Misses         88       88

Impacted Files
Coverage Δ

src/aws_okta_processor/core/okta.py
96.24% <0%> (+0.09%)
:arrow_up:

src/aws_okta_processor/core/fetcher.py
32.6% <0%> (+1.49%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fb21d97...314c3bc. Read the comment docs.

Codecov Report

Merging #12 into master will increase coverage by 0.19%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master      #12      +/-   ##
==========================================
+ Coverage   83.07%   83.26%   +0.19%
==========================================
  Files          11       11
  Lines         520      526       +6
==========================================
+ Hits          432      438       +6
  Misses         88       88

Impacted Files
Coverage Δ

src/aws_okta_processor/core/okta.py
96.24% <0.00%> (+0.09%)
:arrow_up:

src/aws_okta_processor/core/fetcher.py
32.60% <0.00%> (+1.49%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fb21d97...e02823a. Read the comment docs.

Codecov Report

Merging #12 into master will increase coverage by 0.19%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master      #12      +/-   ##
==========================================
+ Coverage   83.07%   83.26%   +0.19%
==========================================
  Files          11       11
  Lines         520      526       +6
==========================================
+ Hits          432      438       +6
  Misses         88       88

Impacted Files
Coverage Δ

src/aws_okta_processor/__init__.py
100% <100%> (ø)
:arrow_up:

src/aws_okta_processor/core/okta.py
96.24% <0%> (+0.09%)
:arrow_up:

src/aws_okta_processor/core/fetcher.py
32.6% <0%> (+1.49%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fb21d97...121b9b8. Read the comment docs.

Codecov Report

Merging #12 into master will increase coverage by 0.19%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master      #12      +/-   ##
==========================================
+ Coverage   83.07%   83.26%   +0.19%
==========================================
  Files          11       11
  Lines         520      526       +6
==========================================
+ Hits          432      438       +6
  Misses         88       88

Impacted Files
Coverage Δ

src/aws_okta_processor/core/okta.py
96.24% <0.00%> (+0.09%)
:arrow_up:

src/aws_okta_processor/core/fetcher.py
32.60% <0.00%> (+1.49%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fb21d97...0024491. Read the comment docs.


Table 'superset.logs' doesn't exist

When I try to install Superset and run it on my local machine, I received this error. I am using Windows 10 (Python 3.7.4)
ProgrammingError: (1146, "Table 'superset.logs' doesn't exist")
  File "sqlalchemy/engine/base.py", line 1244, in _execute_context
    cursor, statement, parameters, context
  File "sqlalchemy/engine/default.py", line 552, in do_execute
    cursor.execute(statement, parameters)
  File "MySQLdb/cursors.py", line 206, in execute
    res = self._query(query)
  File "MySQLdb/cursors.py", line 319, in _query
    db.query(q)
  File "MySQLdb/connections.py", line 259, in query
    _mysql.connection.query(self, query)
ProgrammingError: (MySQLdb._exceptions.ProgrammingError) (1146, "Table 'superset.logs' doesn't exist")
[SQL: INSERT INTO logs (action, slice_id, json, dttm, duration_ms) VALUES (%s, %s, %s, %s, %s)]
[parameters: ('syncing', 0, '{}', datetime.datetime(2020, 9, 23, 3, 32, 22, 899802), 157.641)]
(Background on this error at: http://sqlalche.me/e/f405)
  File "flask/app.py", line 2446, in wsgi_app
    response = self.full_dispatch_request()
  File "flask/app.py", line 1951, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "flask/app.py", line 1820, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "flask/_compat.py", line 39, in reraise
    raise value
  File "flask/app.py", line 1949, in full_dispatch_request
    rv = self.dispatch_request()
  File "flask/app.py", line 1935, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "superset/utils/log.py", line 79, in wrapper
    referrer=referrer,
  File "superset/utils/log.py", line 157, in log
    sesh.bulk_save_objects(logs)
  File "sqlalchemy/orm/scoping.py", line 162, in do
    return getattr(self.registry(), name)(*args, **kwargs)
  File "sqlalchemy/orm/session.py", line 2700, in bulk_save_objects
    False,
  File "sqlalchemy/orm/session.py", line 2888, in _bulk_save_mappings
    transaction.rollback(_capture_exception=True)
  File "sqlalchemy/util/langhelpers.py", line 68, in __exit__
    compat.reraise(exc_type, exc_value, exc_tb)
  File "sqlalchemy/util/compat.py", line 153, in reraise
    raise value
  File "sqlalchemy/orm/session.py", line 2882, in _bulk_save_mappings
    render_nulls,
  File "sqlalchemy/orm/persistence.py", line 102, in _bulk_insert
    bookkeeping=return_defaults,
  File "sqlalchemy/orm/persistence.py", line 1084, in _emit_insert_statements
    c = cached_connections[connection].execute(statement, multiparams)
  File "sqlalchemy/engine/base.py", line 988, in execute
    return meth(self, multiparams, params)
  File "sqlalchemy/sql/elements.py", line 287, in _execute_on_connection
    return connection._execute_clauseelement(self, multiparams, params)
  File "sqlalchemy/engine/base.py", line 1107, in _execute_clauseelement
    distilled_params,
  File "sqlalchemy/engine/base.py", line 1248, in _execute_context
    e, statement, parameters, cursor, context
  File "sqlalchemy/engine/base.py", line 1466, in _handle_dbapi_exception
    util.raise_from_cause(sqlalchemy_exception, exc_info)
  File "sqlalchemy/util/compat.py", line 398, in raise_from_cause
    reraise(type(exception), exception, tb=exc_tb, cause=cause)
  File "sqlalchemy/util/compat.py", line 152, in reraise
    raise value.with_traceback(tb)
  File "sqlalchemy/engine/base.py", line 1244, in _execute_context
    cursor, statement, parameters, context
  File "sqlalchemy/engine/default.py", line 552, in do_execute
    cursor.execute(statement, parameters)
  File "MySQLdb/cursors.py", line 206, in execute
    res = self._query(query)
  File "MySQLdb/cursors.py", line 319, in _query
    db.query(q)
  File "MySQLdb/connections.py", line 259, in query
    _mysql.connection.query(self, query)

inbox! i will show that!

Hi,
Please fill out the form for a bug report. Although this is probably not a bug, have you run superset db upgrade and did it finish successfully?
Also note that Windows is not a supported platform for Superset.

@dpgaspar
can not finish upgrade because Table 'superset_demo.tagged_object' doesn't exist  error


Ray casts which touch a TriMesh edge report intersection with a backface

This issue was originally reported on ncollide: https://github.com/dimforge/ncollide/issues/335

Imagine Santa's sled knocking some snow off the top of a roof. It could be argued that no impact happened, or it could be argued that the impact happened with the edge. parry3d reports that Santa collided with the inside of the house.
This is important for using ray casting to determine whether a point is inside a mesh. As per https://github.com/dimforge/ncollide/issues/317, I am casting a ray and checking whether it intersected with a backface. In the motivating example, a point nowhere near the mesh happens to cast a ray which skims a ridge in the mesh: due to this issue, a backface intersection is reported.

The issue is demonstrated here (on the parry branch): https://github.com/clbarnes/ncollide-issue-graze/tree/parry

Note that the motivating example for this, containment checks for points in meshes, is now potentially made obsolete by contains_local_point actually doing a solid containment check if the pseudonorms are calculated.


Don't try to deploy to staging on a fork of this repository

Apparently the cbuild is trying to deploy to staging even on forks (and then it doesn't work because it doesn't have the staging credentials)

I can't not because it happens automatically


add a back arrow in the plugins menu at the top

currently, to go back to all the others, you have to scroll down to the bottom to hit Back button.

Will see about adding it to my current pull request that introduces a top panel to plugin configs #2245


Demo OPA gatekeeper and kyverno

What: comparison with regards with how user input validated, especially with crossplane resources, like claims
Why: Sharing knowledge, collect feedback

Please add task(s) to this issue or close it :)


Errors when running GradientStrategy in shots mode

Simple repro: in TEST(GradientStrategiesTester, checkDeuteronVQE) (GradientStrategiesTester.cpp) set {{"shots", 1024}} when initializing qpp.
This will hit xacc::error added in https://github.com/eclipse/xacc/commit/156d56aa8c0a033d5329f0be07ef9e3e62b81c14
Root cause: the observed circuits (constructed by the gradient strategy impl) contain a base circuit for identity term with no Measure. Hence, no measurement shots data is added.
Need to investigate if this is a bug in the gradient strategy (e.g., should filter identity term) or we could simply remove xacc::error in the above commit.
e.g., some accelerators may throw if sending circuits with no measure.

This is indeed a problem with gradient strategy. Sending base circuit w/o measurement (identity term) will cause problems for aer and potentially ibm as well.
e.g., https://github.com/eclipse/xacc/blob/master/quantum/plugins/ibm/aer/accelerator/aer_accelerator.cpp#L196: this will crash since the counts field is not present.
In VQE, we explicitly handle this (removing non-observing circuits): https://github.com/eclipse/xacc/blob/master/quantum/plugins/algorithms/vqe/vqe.cpp#L135
but not in the gradient strategies.
Hence, the proper fix is to address this bug in the gradient strategy.


Crash when disconnecting without a login

Steps to reproduce:

Connect to matterircd.

Try to login with an expired/invalid token.

Disconnect.

Expected result: matterircd keeps running so a reconnect + login with a new token is possible.
 Things may break.  module=matterircd
INFO[2020-08-14T09:13:02+02:00] Listening on <IP_ADDRESS>:6668                   module=matterircd
INFO[2020-08-14T09:13:05+02:00] New connection: <IP_ADDRESS>:58470               module=matterircd
loggerlevel: info
INFO[0006] login as vmiklos (team: ...) on ...
[0006]  INFO matterclient: Found version 5.22.0.dev.5c89b8de75ffefb58e1672e7d6457246.false
ERRO[0006] login failed: Invalid or expired session, please login again.,
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0xa0 pc=0x5b2f48]

goroutine 20 [running]:
github.com/42wim/matterircd/mm-go-irckit.CmdQuit(0x8bc040, 0x40001ee8f0, 0x40001ee9c0, 0x4000535590, 0x40002742d0, 0x1)
        /home/vmiklos/git/go/src/github.com/42wim/matterircd/mm-go-irckit/server_commands.go:398 +0xd0
github.com/42wim/matterircd/mm-go-irckit.commands.Run(0x40001e32f0, 0x8bc040, 0x40001ee8f0, 0x40001ee9c0, 0x4000535590, 0x533c5c, 0x4000094058)
        /home/vmiklos/git/go/src/github.com/42wim/matterircd/mm-go-irckit/commands.go:55 +0xf0
github.com/42wim/matterircd/mm-go-irckit.(*server).handle.func1(0x40001ee8f0, 0x40001ee9c0, 0x4000535590)
        /home/vmiklos/git/go/src/github.com/42wim/matterircd/mm-go-irckit/server.go:347 +0x54
created by github.com/42wim/matterircd/mm-go-irckit.(*server).handle
        /home/vmiklos/git/go/src/github.com/42wim/matterircd/mm-go-irckit/server.go:346 +0xcc

I guess the fix is to improve CmdQuit(), so it checks for nil u and/or u.br. Is that enough or there is some deeper problem there?

Just handling nil u.br works, as far as I see.


Syntax

I don't understand this syntax.
$("form").conversationalForm(<ConversationalFormOptions> {
	...
});

Primarily I'm not familiar with this <ConversationalFormOptions>
Can you point to some resource that explain what you mean here?
Thanks

@c316 it's a data type reference (to navigate the readme). See what the data type includes here
This will be removed in next release as it, as you point out, confuses more that it benefits.
jQuery example: /examples/jquery
And a jsbin
Lastly then a seperat documentation sheet is being worked on as well.

Thanks
On Wed, Apr 5, 2017 at 11:37 AM, Felix Nielsen<EMAIL_ADDRESS>wrote:

@c316 https://github.com/c316 it's a data type reference (to navigate
the readme). See what the data type includes here
https://github.com/space10-community/conversational-form#self-instantiate-with-vanilla-js
This will be removed in next release as it, as you point out, confuses
more that it benefits.
jQuery example: /examples/jquery
https://github.com/space10-community/conversational-form/blob/master/examples/jquery.html
And a jsbin https://jsbin.com/matigotewa/4/edit?html,js,output
Lastly then a seperat documentation sheet is being worked on as well.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/space10-community/conversational-form/issues/102#issuecomment-291920595,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AC_1PhiWL6WgfuC28u1pLndb7d8ub7uqks5rs8NmgaJpZM4MzN6R
.

--
Joshua Bechard
Learn to do right! Seek justice, encourage the oppressed.
Defend the cause of the fatherless,
plead the case of the widow.
Isaiah 1:17


TypeScript intermittently shows errors with declaration file

VSCode Version: Version 1.26.1 (1.26.1)
OS Version: Mac OS 10.13.6

Steps to Reproduce:

edit a file that uses information declared in a typescript declaration file
open the declaration file and watch the errors disappear, close the declaration and watch the errors re-populate

Does this issue occur when all extensions are disabled?: Yes

Do you have a tsconfig.json?

I did. I can actually close this now. I had to create a file named custom.d.ts. I'm not sure why it had to be custom though and not a handful of other filenames. Also, I had to move it to the root of my project (not the subfolder where all the markdown files were).


Line breaks within quotes should not start new record

From @AndyNichols on May 20, 2014 16:10
CSV Lint is wrongly interpreting line breaks within quotes as starting a new record. So

A,"B
C",D

is two records of two fields, when it should be one of four.
This is as per RFC 4180 section 2.6
Copied from original issue: theodi/csvlint#149

I sense that this probably is better applied to https://github.com/theodi/csvlint.rb

I think this issue is the same as, or at least related to, #198


Node ignores high-peers value defined in the config map

Environment

Smapp version: v1.0.11
Node version: v1.0.7
OS: Ubuntu 22.04

Describe the bug
Spacemesh node constantly has over 100 connections when it's run through Smapp. It seems that high-peers value is not used although it's present in the config map. Values defined in the config map are:
  "p2p": {
    "disable-reuseport": false,
    "p2p-disable-legacy-discovery": true,
    "bootnodes": [
        "/dns4/mainnet-bootnode-10.spacemesh.network ...",
        "... omitted ...",
        "/dns4/mainnet-bootnode-19.spacemesh.network ..."
    ],
    "min-peers": 10,
    "low-peers": 20,
    "high-peers": 30
  },

The issue started to appear with Smapp version v1.0.11. I didn't have any problems with v1.0.9.
Steps to reproduce

Download spacemesh_app_1.0.11_amd64.deb from the release page
Install
Run Smapp
Observe the number of Connected neighbors in the Network tab

Expected behavior
The number of Connected neighbors should be between 10 and 30.
Actual behavior
The number of Connected neighbors is constantly over 100. The node is running for 3 hours already and the value is not decreasing. Restart also doesn't help.

Logs
N/A
Additional info
xxx@xxx:/opt/Spacemesh/node$ ./go-spacemesh version
v1.0.7+65f516c6fca65eaf495b227aad526390eaa8eb20

xxx@xxx:~$ grpcurl -plaintext <IP_ADDRESS>:9092 spacemesh.v1.NodeService.Version
{
  "versionString": {
    "value": "v1.0.7"
  }
}

xxx@xxx:~$ grpcurl -plaintext <IP_ADDRESS>:9092 spacemesh.v1.NodeService.Status
{
  "status": {
    "connectedPeers": "112",
    "isSynced": true,
    ...
  }
}

It could be that the issue is with the go-spacemesh and not Smapp, but I'm not sure.

We expect an improvement for that to land in next go-spacemesh release. Then we will also include that improvement in next smapp release.

Thanks for the updated version, but unfortunately the issue still persists. Several people confirmed this on Discord. It may be that this is an issue that exists only on Linux, but I might be wrong.

The situation became worse. I have 3 nodes and they have 271, 278, and 212 connected peers respectively.

@nenadvasic what's your current config for peers?

"p2p": {
    "disable-reuseport": false,
    "p2p-disable-legacy-discovery": true,
    "bootnodes": [
        ...
    ],
    "min-peers": 5,
    "low-peers": 10,
    "high-peers": 15
}

@pigmej

ok two items.
That's for sure too low limits to do kinda anything because the moment you connect to the bootnode you'll get peers from the bootnode, and there are 10 bootnodes in your config I guess.
So the result will be constant low -> over high flow.
That does not fully explain 271 though.
What you could do is:
https://github.com/spacemeshos/go-spacemesh/blob/v1.0.9/p2p/README.md
(please note that you need 1.0.9 for that)
And configure one node to be direct peer for all other your nodes.

Thank you, I will take a look. Btw, that node that had 271 connections is running through Smapp, and I just noticed that the config file was updated automatically. Now that node has:
"min-peers": 20,
"low-peers": 50,
"high-peers": 80

I didn't know that the node can update configs by itself 🤔

could you please check what go-spacemesh version are you running? i am running v1.0.8 with the following config, it went above 100 only in the initial bootstrap period after that it never goes above 50-60:
{
    "p2p": {
        "min-peers": 30,
        "low-peers": 60,
        "high-peers": 100,

ok two items.
That's for sure too low limits to do kinda anything because the moment you connect to the bootnode you'll get peers from the bootnode, and there are 10 bootnodes in your config I guess.
So the result will be constant low -> over high flow.
That does not fully explain 271 though.
What you could do is:
https://github.com/spacemeshos/go-spacemesh/blob/v1.0.9/p2p/README.md
(please note that you need 1.0.9 for that)
And configure one node to be direct peer for all other your nodes.

I confirm that the issue has been resolved with go-sm v1.0.11
Thank you @pigmej @dshulyak 🙏


Suggest snake_case when attaching a node script

Godot version
4.0 Beta3
System information
Any
Issue description
When a node script is attached the suggested name (love this feature btw) should be converted to snake case. It currently just takes the name of the node (which uses PascalCase). There is one exception, if the scene is saved then the file names base name is used.
I suggest:

get rid of the file name based naming
use String().to_snake_case()

I think this is the relevant function that needs to get + .to_snake_case() at one of the strings.
void ScriptCreateDialog::config(const String &p_base_name, const String &p_base_path, bool p_built_in_enabled, bool p_load_enabled) {
	class_name->set_text("");
	class_name->deselect();
	parent_name->set_text(p_base_name);
	parent_name->deselect();
	internal_name->set_text("");

	if (!p_base_path.is_empty()) {
		initial_bp = p_base_path.get_basename();
		file_path->set_text(initial_bp + "." + ScriptServer::get_language(language_menu->get_selected())->get_extension());
		current_language = language_menu->get_selected();
	} else {
		initial_bp = "";
		file_path->set_text("");
	}
	file_path->deselect();

	built_in_enabled = p_built_in_enabled;
	load_enabled = p_load_enabled;

	_language_changed(current_language);
	_class_name_changed("");
	_path_changed(file_path->get_text());
}

Steps to reproduce
Create a script using the attach script to node-button.
Minimal reproduction project
No response

Duplicate of https://github.com/godotengine/godot-proposals/issues/1211
There is a PR implementing it.


Add CLI support so this can be run without a wrapper script

Good Evening!
I am currently using this tool as part of my build pipeline to generate documentation for my project.
Currently I need to use a wrapper script to get this running.  I invoke the wrapper script like this: cat myDotFile.dot | node myWrapper.js > out.svg.
This is what the wrapper script looks like:
const Viz = require('viz.js');

let data = '';

process.stdin.resume();
process.stdin.setEncoding('utf8');

process.stdin.on('data', function (chunk) {
    data += chunk;
});

process.stdin.on('end', function () {
    const result = Viz(data);
    console.log(result);
});

Would it be possible to make this directly invokable so that I could do something like:
node_modules/viz.js/vix.js --input myDotFile.dot --output myDotFile.svg

This would be awesome.
Thanks !

@JakeSummers Why do you want to use Viz.js and not the "real" dot program?

Hi @mdaines ,
I want build dot diagrams as part of my build process but my build process needs to be OS independent.  Using this NPM package to build the dot files achieves that.

Fair enough. However, I don't want to include a wrapper script in this project. You are of course free to publish your wrapper script as a separate NPM package that depends on Viz.js.

Thanks for the consideration.


Cannot create custom_origins

Describe the Bug
Cannot create a custom origin behind the default one, because

The given value is not suitable for child module variable "custom_origins" defined at .terraform/modules/cloudfront-cdn/variables.tf:327,1-26: element 0: attribute "s3_origin_config" is required.
Or when we add s3_origin_config
Error: error updating CloudFront Distribution (E2WW4FISAR8BSH): IllegalUpdate: You must specify either a CustomOrigin or an S3Origin. You cannot specify both.

Expected Behavior
We should be able to add a custom origin accordingly to the documentation
Steps to Reproduce
Add the following block to the main.tf
  custom_origins = [
    {
      domain_name    = "domain.com"
      origin_id      = "custom-origin-staging"
      origin_path    = "/staging"
      custom_headers = []
      custom_origin_config = {
        http_port                = 80
        https_port               = 443
        origin_protocol_policy   = "https-only"
        origin_ssl_protocols     = ["TLSv1", "TLSv1.1", "TLSv1.2"]
        origin_keepalive_timeout = 5
        origin_read_timeout      = 30
      }
    }
  ]

Steps to reproduce the behavior:

Run: terraform plan - get the error about missed s3_origin_config option
Add required options3_origin_config = {
  origin_access_identity = ""
}

Run terraform apply and the the error from CloudFrontError: error updating CloudFront Distribution (XXXXXXXXXXXXXX): IllegalUpdate: You must specify either a CustomOrigin or an S3Origin. You cannot specify both.

Environment
cloudposse/cloudfront-cdn/aws = 0.22.1
aws = 3.63.0

Additional Context
Maybe something is missing in my configuration, and where we can find a working example with a custom origin?
Thank you!

I have the same problem，but I didn't apply. Shouldn't custom source have origin_access_identity? Adding this config will cause my origin to be recreate.

same issue

Same here, now way to add different origin than S3.
IllegalUpdate: You must specify either a CustomOrigin or an S3Origin. You cannot specify both.

If you want setup this set
s3_origin_config = null

I just ran into this. There's no documentation or examples on this use case, but I figured out the solution by looking at the code.
Set s3_origin_config = null.


False positive for react/prop-types in decorator

Minimal example:
import { Component } from 'react'

const test = null
@test(_ => ({ arg }) => arg)
export class Test extends Component {}

It reports the following error:

'arg' is missing in props validation (react/prop-types)

Seems to be the same issue as #591
It should be fixed in the next release, fill free to re-open if it is not the case.


Make content adapt to screen width resize.

Make content respond to window width resize
Do not change colors, since visible snapshots remain the same

responding to height resize will be part of #259

tests pls ;)

Done.
Looks like resizing a window through JS is impossible through tests, so had to make a workaround with parameters to test properly.


[WIP] request tracking improvements

Current coverage is 84.63%

Merging #299 into master will increase coverage by +0.09% as of 1761398

@@            master    #299   diff @@
======================================
  Files           37      38     +1
  Stmts         4108    4145    +37
  Branches       532     532
  Methods          0       0
======================================
+ Hit           3473    3508    +35
  Partial        144     144
- Missed         491     493     +2

Review entire Coverage Diff as of 1761398

Powered by Codecov. Updated on successful CI builds.


How to intercept Graphql request?

Hello,
I need to intercept Grahpql requests to my tests, but this is fetch type, so the Intercept service isn't getting the request, is there any way to intercept this request?
the request is returning the result of this way
data: {values: {totalPages: 10,…}},…}     data: {values: {totalPages: 10,…}}         values: {totalPages: 10,…}
Thank You.

Hey @ThiagoMFerreira, did you had any progress with this kind of tests?
I believe I'm having the same issues.
It doesn't catch graphql requests, although they're shown in the network tab.

Hey @ThiagoMFerreira, did you had any progress with this kind of tests?
I believe I'm having the same issues.
It doesn't catch graphql requests, although they're shown in the network tab.

Hi @ruancarvalho any progress yet 😔

GraphQL requests are not particularly special. This plugin has been supporting fetch since v3 (https://github.com/chmanie/wdio-intercept-service/blob/master/CHANGELOG.md#---300--13022019).
Have you noticed this:

There's one catch though: you can't intercept HTTP calls that are initiated on page load (like in most SPAs), as it requires some setup work that can only be done after the page is loaded (due to limitations in selenium).

Hey @chmanie Even though my requests happens inside my test, it does not capture the Grapqh requests. Do you have any thoughts about it?

I had same problem when trying intercepting graphql request which it would return JSON data. it seems interceptor didnt recognised the requests as ajax calls at all

@trietnguyen267 I had the same problem.
Solved it using the mock function https://webdriver.io/docs/mocksandspies/#spies
You are able to mock the graphql requests and then create a helper function to validate what you want based on the operationName.
const mocks = await browser.mock('**/graphql', { method: 'post' })
console.log(mock.calls[0].postData)


each does not return the list

The docs [http://underscorejs.org/#each] say "Returns the list for chaining." which I presumed meant I could return _.each(myarray, ...) but I got undefined back.
A simple test in console gives the same results:
> _.each([{a:1},{b:2}], (v) => { v.foo = JSON.stringify(v); })
undefined

Got: undefined
Expected: [{a:1, foo: "{a:1}", b:2, foo:"{b:2}"}] (i.e. the list)

Seems I was using an old version of underscore.


Support multi-session quality_control by tracking metric or evaluation provenance

Users have requested that we find a way to track multi-session quality control in the main schema, rather than some kind of extension.
Short explanation for why this is needed:

A user has ten assets that all do their own raw/processing qc and pass and then they need to compare them somehow, e.g. matching ophys fov
They run a multi-session capsule that generates evaluations/metrics to check whether the fov is the same. This is a blocking step because the annotation is manual
Someone annotates the metrics and marks that one asset has a different fov, it needs to be dropped for further multi-session analysis
A second multi-session is now run that needs to pull only the assets with the same fov. To match metrics -> assets the metrics need to track which asset they were generated from

Notes from discussion on 10/3:

There's no easy ability to generate isolated data assets the way I had hoped for, so dumping the quality_control.json isn't that simple, people are going to have to use the data-access-api to do this, with some limited permissions
We need to stratify QC status based on local vs global scope and include whether evaluations have multiple upstream dependencies
We need to mark evaluations (or metrics?) as having external dependencies, and possibly list their dependency structure using the "name" fields


Ensure touch support is good across all primitives

Referred in https://github.com/radix-ui/primitives/discussions/375
I know @jjenzz had mentioned Slider, but it might be helpful to identify other components that we feel could benefit from additional testing.
ScrollArea for sure. Immediate thought it, what if the user tries to scroll on both axes simultaneously with a track press on one and a button press on another? Should we consider built-in drag-scroll support?

We've done the work by relying more often on pointer events, we can close this as specific issues come up and get addressed.


Add Spinlock for ESP32

ESP32 has two processor cores. If tasks running concurrently on both cores are writing into the TelnetSpy ringbuffer a inconsistency of data may occur.
This can been seen latest when the telnet connection is established and the buffer is printed on the telnet terminal: Some additional "ghost"-characters are written after the last "real" line.
To avoid this misbehaviour 3 macros are defined in TelnetSpy.h to introduce a mutex (portMUX_TYPE) that only becomes valid on an ESP32.
Using this mutex creates a spinlock for protecting critical sections in TelnetSpy.cpp.
This is done on a very low level (= single character), so only the access to the variables bufLen, bufUsed, bufRdIdx, bufWrIdx is considered as a critical section. The intention is not to protect complete lines.
Because these variables are now incremented/decremented correctly, the result is that no more additional "invalid" characters will be seen in the buffer.

Thanks for making this ESP32 compatible...
What ver of RingBuf are you using?
I get this error when I try to compile for ESP32
#error "This library only supports AVR and ESP8266 Boards"

Wait..  The master branch doesn't use ringbuf..  But the 1.1 tag does.
Should I use master to V1.1?  IIRC..  I had to switch to 1.1 to get it to work with ESP8266?  The new merged
master seems to work with ESP32.  I'll see if it still works with ESP8266...


Add a base dataset class that loads arrow files

Stack from ghstack (oldest at bottom):

#125
-> #124
#123

I'm hesitant to add mock data generators that would be required for unit testing this class. I suspect if we write 'composable' datasets and keep the actual data loading pretty isolated from any other logic (packing, shuffling, sharding) we can test the specific functionality of composing datasets separately. If we do add mock datasets, they won't cover the s3 path, which is the majority of what this class does.
I did test manually of course, and it would be pretty easy to add the code to generate mock datasets if we think it's necessary.

messed up ghstack, making new PRs


Add WarriorJS to Docusaurus users

Motivation
WarriorJS is using Docusaurus for its documentation, added it to the users.
Also, the users array was growing quite large in siteConfig.js, so I took the liberty to extract it into a file inside of the website/data directory (also new). I'm fine with reverting this change if you don't think is a good one.
The one thing I'm now sure about is the changes to package-lock.json that were done when I run npm install on the root of the project. I don't know exactly why installing the dependencies would rewrite the lock file, but I suspect it could have something to do with the version of npm I'm using. Just in case:
$ node --version
v8.11.1
$ npm --version
6.0.0

Please let me know if I have to do something with regards to that. And thanks!
Have you read the Contributing Guidelines on pull requests?
Yes.
Test Plan
Same users being shown in the landing page:

WarriorJS now added to the users page:

Related PRs
N/A

@yangshun Done! Changed it to JSON, and also reverted the changes to package-lock.json.

Your project looks fun, @olistic 😄

Hey @JoelMarcey! Thanks 😄 It's still in its early stages, I'm focusing now on building a community of players and contributors. If you guys know people that could be interested I'd really appreciate help spreading the word out!
And thanks to you both and the rest of the people involved in Docusaurus 🙏 It helped me bring my documentation site to life with little to no effort and just worry about the content and nothing else.
cc. @yangshun

Very happy to hear that! 😄

@olistic I believe this is the first Docusaurus site for a game, so I think I tweeted about it from our Docusaurus twitter account https://twitter.com/docusaurus/status/994333018071298048 😄

That's awesome @JoelMarcey! Thanks!


Sort projects

Description
As mentioned in the issue i have made changes and sorted the project in style_links.json file.
Fixes #358

Type of change

[x] This change requires a documentation update

Explain the Testing instructions
Test Configuration:

Operating system: ANY
Version: ANY
Text-editors used: VS CODE

Checklist:

[x] My code follows the style guidelines of this project
[x] I have performed a self-review of my own code
[x] I have commented my code, particularly in hard-to-understand areas
[x] I have made corresponding changes to the documentation
[x] My changes generate no new warnings
[x] I have added tests that prove my fix is effective or that my feature works
[x] New and existing unit tests pass locally with my changes
[x] Any dependent changes have been merged and published in downstream modules

ATTACH SCREEN-SHOTS / DEPLOYMENT LINK

Hey @VidhiBhatt01 @DEEPALI-SUK
Kindly review the PR and check if any changes are required?
Thanks

@mrkc2303 there are unnecessary files in the commits please update your PR.

@DEEPALI-SUK Thats may be because of my PR #361
Kindly let me know what can i do?

You need to delete all unwanted files. If you have raised any PR previously from the same branch then use a different one for this PR.

For the same issue i will open another PR and resolve the errors.
I am closing this for the same


⚠ Bofrost.at has degraded performance

In 0b68b08, Bofrost.at (https://www.bofrost.at) experienced degraded performance:

HTTP code: 200
Response time: 817 ms

Resolved: Bofrost.at performance has improved in 8003154.


kubernetes secret list permission

This is a follow up to this issue. It is a bug, and a major security vulnerability, to give traefik access to read all secrets via the list RBAC. Requiring traefik to have secret list permissions is not acceptable. List allows "for collections, including full object content" per the docs. This is not a question.  It is a blocker for using the traefik kubernetes provider. I really like traefik and look forward to using it once this is resolved. Thank you.

Hello @mattharrigan,
You are correct when you state that granting list RBAC allows for access to the content.
We initialize the informer here:
https://github.com/containous/traefik/blob/master/pkg/provider/kubernetes/crd/client.go#L172
and you will notice that it is namespaced. If you would like to restrict secrets access to a specific namespace, you can do so using the namespaces (https://docs.traefik.io/v2.2/providers/kubernetes-crd/#namespaces) filter. This will allow traefik to list and watch only the namespaces you provide.
Go applications that use the Go-client have no ability to tell what RBAC permissions they have. This is demonstrated by your observation in the first ticket: Granting list on a secret allowed the informer to create a lister, but did not allow the associated watcher to be created, nor the associated Get that usually accompanies the lister.
The issue is tied back to the initialization of the informer: By default, Traefik will attempt to watch all secrets, so that if you create a new namespace, and create an ingressRoute, and reference a new secret, Traefik will be able to read it.
If you are more concerned about security and require less flexibility and dynamic discovery, you can restrict it via namespacing, but currently there is no implementation of dynamic watchers for individual secrets, it is done via namespace.

nor the associated Get that usually accompanies the lister

I disagree. The list permission can read the secret contents without get permissions. This is the core of the security vulnerability. Listing the names of the secrets is not that huge of a deal. Reading the contents is.
In my cluster there are many other secrets in even the most minimal namespace. Some of them are effectively admin tokens. Allowing read access to them is not acceptable.

@mattharrigan, I think you misunderstood that statement.
The get in the go-client bypasses the informer cache, and queries the API directly. List is effectively a superset of get. This is why if you grant list, it is usually assumed that you are also granting get (since list can read all contents anyways).
In Traefik's case, to accomplish what you are asking, would require keeping track of every secret referenced, and then creating informers/listers and event handlers dynamically and keeping them synchronized, while ensuring that we don't duplicate anything.
This possibility was raised in #1784.
I don't disagree with the proposal of this feature, I'm just saying that this is not a bug, but a feature proposal.

I think its a bug, not a feature request, since traefik k8s provider currently requires being configured in a fundamentally insecure manner. However debating that point is probably not helpful. I would simply like it resolved.
There are probably many possible solutions. I am not a familiar with the details or implementation of traefik, but in my use case there are only a small number of secrets for certs, so one option could be to not give traefik any permissions for secrets and instead provide them by file. Its all the traefik CRD's that are highly dynamic, and I really like how traefik gets/watches them directly via the built in k8s client.
wrt my previous quote, I don't think traefik ever tries to use get directly. It appears to use the Lister. So by not giving get, it doesn't really prevent anything from being created because the code doesn't try to create them anyways. But again I'm coming in cold to this codebase.

I think we agree that its ok to give traefik read access to secrets it needs. Where we disagree is that I think namespace granularity for RBAC is at best fragile and commonly impossible. k8s has a rich and rapidly evolving ecosystem. Its not reasonable to assume nothing else is operating in the namespace other than traefik. Those other things may rely on the assumption that a secret is "secret".
To throw out another possibility, create a new CRD for the cert secrets in the traefik api space. Granting list, get, watch to that resource would be acceptable IMO.

This blog post says that listing secrets is the number 1 example of a risky permission.

I would very much appreciate this issue being resolved. One specific feature request would be that if traefik doesn't have secret list permissions, log that fact, but do not exit with an error. This is very much analogous to phone apps which request may permissions for location, contacts, etc, but in case they are not granted the app continues to operate, albeit with reduced capability. My hope is that this more specific feature request is relatively easy and non controversial. Thank you.

From my point of view, there may be two use cases for traefik in k8s.

certs are stored in a single namespace and a centralized auth server does the authentication and authorization check. In this case. We  only need to access limited namespace to get required certs and the namespace name can be known before deploy traefik. (But backend service and ingress object maybe created in any namespace dynamically)
Each service store crerts in their own namespace and  dose auth separately. Since service can be deployed dynamically, we don't know which namespace should be watched when deploying traefik.

For case 1, I think we can add a startup option for traefik, which can point out secrets in which namespace should be listed. Then we can init the informer cache correctly.
For case 2, we can just keep current behaviors.
@dtomcej Is that make sense?

It looks like Traefik 2.5 runs fine if it doesn't have permission to access Secrets. (Of course, in that case, TLS keys and certs can't be stored in Secrets.)
It would be nice if Traefik could use TLS secrets if it only has get permission to these secrets (as opposed to list), but as far as I understand, this would require to change a lot of code, because instead of setting up a single informer for all secrets, Traefik would need to set up one separate watch connection for each secret referenced in an Ingress object. Beyond the significant refactoring that this would require, I don't even know if that's a desirable behavior (what would be the load on the API server if we have one watch connection per referenced secret?). I honestly don't know what's the best behavior here.

You can correct, I revisit the ingress spec and find it can only reference the secret in the same namespace. It's not a easy work.
BTW: remove secrets list permission from cluster role don't work for me. The treafik in my cluster failed to route requests.   :-<

Hi @rtribotte, I understand your point, but I still have the question about why Traefik needs to include secrets in the cluster resource discovery. A K8S cluster might have lots of secrets unrelated to Traefik behaviour and does not look correct for Traefik to require access to all those secrets. And the situation is worst when you find out that list permissions to all secrets allows to actually read the value of the secret.
And regarding your last paragraph,

Even if Traefik would not rely on informers and not require the list permission, it would still require the get permission in a whole namespace, which in a way is pretty much the same as list permission, by allowing to read any secret (as long as the requested name is indeed matching).

I don't see why Traefik would still permissions to read any secrets. If you know which is the requested name and do a match to get it and read, you can ask the users to have that only secret available for Traefik with that specific name. And request permissions only for that secret.

Hello @jnonino,
To sum up the situation regarding the required RBAC verbs for secrets resource with Traefik:

RBAC verbs for secrets
Discovery
Events (secret update)
Errors

list, watch
OK
OK
-

list, get
OK
NOK
E0227 08:39:45.501950       1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.28.4/tools/cache/reflector.go:229: Failed to watch *v1.Secret: unknown (get secrets)

get, watch
NOK
NOK
W0227 08:38:00.439389       1 reflector.go:535] pkg/mod/k8s.io/client-go@v0.28.4/tools/cache/reflector.go:229: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:default:traefik-ingress-controller" cannot list resource "secrets" in API group "" at the cluster scopeE0227 08:38:00.439449       1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.28.4/tools/cache/reflector.go:229: Failed to watch *v1.Secret: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:default:traefik-ingress-controller" cannot list resource "secrets" in API group "" at the cluster scope

get
NOK
NOK
W0227 08:41:36.897369       1 reflector.go:535] pkg/mod/k8s.io/client-go@v0.28.4/tools/cache/reflector.go:229: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:default:traefik-ingress-controller" cannot list resource "secrets" in API group "" at the cluster scopeE0227 08:41:36.897411       1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.28.4/tools/cache/reflector.go:229: Failed to watch *v1.Secret: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:default:traefik-ingress-controller" cannot list resource "secrets" in API group "" at the cluster scope

list
OK
NOK
E0227 08:39:45.501950       1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.28.4/tools/cache/reflector.go:229: Failed to watch *v1.Secret: unknown (get secrets)

watch
NOK
NOK
W0227 08:38:00.439389       1 reflector.go:535] pkg/mod/k8s.io/client-go@v0.28.4/tools/cache/reflector.go:229: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:default:traefik-ingress-controller" cannot list resource "secrets" in API group "" at the cluster scopeE0227 08:38:00.439449       1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.28.4/tools/cache/reflector.go:229: Failed to watch *v1.Secret: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:default:traefik-ingress-controller" cannot list resource "secrets" in API group "" at the cluster scope

We give more thoughts to this issue, and we have a proposal.
We could introduce a field selector option that would be used for the secrets informers at initialization (e.g.:  metadata.name=supersecret). This selector would allow the discovery of secrets based on their names, and also based on the namespace, depending if using a Role or a ClusterRole for Traefik service.
This field selector should be then used in combination with narrowed RBACs, by using the resourceNames option:
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: traefik-ingress-controller
  namespace: default

rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch
    resourceNames:
      - supersecret
...

This would allow to guarantee that verbs list and watch, needed by the usage of informers, is limited only to a very specific subset of secrets in the cluster.
WDYT?

Hi @rtribotte, I think that ti would be get if Traefik stops requiring a wide access to all secrets in a namespace or the whole cluster.
I actually got into this discussion with a PR in traefik-helm-chart adding what you are suggesting at the end of your  comment: https://github.com/traefik/traefik-helm-chart/pull/1009.
Do you think this use of field selectors can be included in next Traefik release? We are running Traefik v2.11.0 installed via the official Helm chart you provide so we are ready to update and adopt this new feature once it is released!!!

Hello @jnonino,
This feature makes a lot of sense. Unfortunately, this would not make it to our roadmap for a while as we are focused elsewhere. So we cannot commit this to be in the next Traefik release (which will not be a v2.x, as any enhancement will now land on v3.x). If you or another community member would like to build it, let us know, and we will work with you to ensure you have all the information needed to merge it.
Don't forget to check out the contributor docs and link the PR to this issue.

This issue seems to have carried over to the gateway API provider. If I use the helm chart setting to restrict access to specific secrets the gateway provider never starts (the gateway resource is listed as waiting on provider) and the pod logs errors:
W0612 14:28:14.816188       1 reflector.go:539] k8s.io/client-go@v0.29.2/tools/cache/reflector.go:229: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:default:traefik" cannot list resource "secrets" in API group "" at the cluster scope
E0612 14:28:14.816221       1 reflector.go:147] k8s.io/client-go@v0.29.2/tools/cache/reflector.go:229: Failed to watch *v1.Secret: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:default:traefik" cannot list resource "secrets" in API group "" at the cluster scope

Like the original poster, this is a hard blocker for us. We have been exploring migrating from nginx chroot to traefik with the Gateway API. Given that your focus is on the gateway API, is this something that can be fixed in that provider?

@rtribotte is the proposal to add some cluster label selector attribute on the pkg/provider/kubernetes/crd/clientWrapper so that it can use the NewSharedInformerFactoryWithOptions with the label selector filter rather than the NewSharedInformerFactory when setting the factoryClusterScope?
I haven't dug through how that bubbles up in your config, but if thats the proposed solution I'd be open to taking a look at it. Any information or background you have would be helpful.

Hello @justinrush,
Sorry for the late reply.
I think it would rather be a field selector configuration for the WithTweakListOptions to use with the Kubernetes Secret informers factory:
https://github.com/traefik/traefik/blob/b1b4e6b918e8eeaf9e24823baf24dbc77f7d373e/pkg/provider/kubernetes/crd/client.go#L229

Hello @justinrush,
Sorry for the late reply.
I think it would rather be a field selector configuration for the WithTweakListOptions to use with the Kubernetes Secret informers factory:
https://github.com/traefik/traefik/blob/b1b4e6b918e8eeaf9e24823baf24dbc77f7d373e/pkg/provider/kubernetes/crd/client.go#L229

Makes sense to me. I'll work on setting up a local dev/test environment and submit a PR.

ok, PR https://github.com/traefik/traefik/pull/10894 submitted, @mattharrigan / @jnonino FYI in case you have thoughts on ways this should exposed in the helm chart.


Use serde 0.8

I updated bigint, complex, and rational to use serde 0.8, and also fixed deserialization and the serde feature as such in the rational crate (didn't add any tests, but it compiles now).
Similar to https://github.com/rust-num/num/pull/196 for num/complex, “use serde;” needed to be removed in num/rational.

The rational fixes are welcome right away.  The serde upgrade changes our public interface though, so that's Yet Another Breaking Change.  We should do that eventually, but let's separate this.

Hmm, since it didn't require any code change, maybe our serde dependency could use an explicit range.  The caret requirement uses strict semver, but we might allow something like >= 0.7 < 0.9.  Then we should be compatible with any user's 0.7.* or 0.8.*.  What do you think?

We really should have at least a build test too.  Can you add a line to .travis/test_nightly.sh?
(Only nightly just because I know serde won't work with our rust-1.0.0 build.)

Alright, the PR was split into two, see https://github.com/rust-num/num/pull/223. I am still basing the serde update off of the other one, since building the entire num crate with the serde feature is broken otherwise.

I confirmed that the dual-serde works locally, but could you add another test for this?  The existing test you added will grab the latest possible, so that will be some 0.8.*.  After that, you can force a downgrade like cargo update -p serde --precise 0.7.0 and build again.

All done, thanks for the extra requests. I finally had a reason to mess around with travis a bit. :-)

Great, thanks!
@homu r+ 4f6f7b3

:zap: Test exempted - status

What is the process of getting a new version of this (0.1.35?) to crates.io?

I just need to go through and publish each update crate.  I'll try to do that tonight.

OK, 0.1.35 is out, enjoy!