tsec-compile-check returns too many unrelated errors

Steps to Reproduce:

Run yarn tsec-compile check
Notice that 52 of 69 issues are unrelated to security

@engelsdamien btw I am seeing 84 errors, many of those are errors for async-import-statements. I am also surprised that tsec complains about the use of trusted types policies. What are we supposed to do with such errors?
src/vs/editor/browser/core/markdownRenderer.ts:35:33 - error TS21228: Creating a Trusted Types policy requires a security review.

35  private static _ttpTokenizer = window.trustedTypes?.createPolicy('tokenizeToString', {

84 errors ? After #112206  I only see 19 Worker and createPolicy related issues.
The Worker issues are a current limitation of tsec which does not  yet understand the Worker construction (we will fix it in tsec and send you and update when it is done, likely sometime next quarter).
As for the createPolicy errors, these are "expected" as they indicate the "vulnerable surface" of your code that requires manual review. In google, usages of createPolicy are only allowed for the security team, which we use to exposes secure by construction APIs.
That being said this does not necessarily translate well to your case, and I will invest some time in the first half of 2021 to:

reduce / restrict and review current usages of createPolicy
improve devX around non-TrustedTypes supported browsers

The good news is that apart from src/vs/workbench/services/extensions/browser/webWorkerExtensionHost.ts:248:24, it seems that all of your code is Trusted Types compatible & you should be able to start experimenting with enforcing Trusted Types through the header.
For reference, here are all the errors I see:
> yarn tsec-compile-check
yarn run v1.22.4
$ node node_modules/tsec/bin/tsec -p src/tsconfig.json --noEmit
src/vs/base/browser/dom.ts:1364:27 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

1364 const _ttpSafeInnerHtml = window.trustedTypes?.createPolicy('safeInnerHtml', {
                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/base/browser/markdownRenderer.ts:35:20 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

35 const _ttpInsane = window.trustedTypes?.createPolicy('insane', {
                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/base/worker/defaultWorkerFactory.ts:9:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

9 const ttPolicy = window.trustedTypes?.createPolicy('defaultWorkerFactory', { createScriptURL: value => value });
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/base/worker/defaultWorkerFactory.ts:19:15 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

19              return new Worker(ttPolicy ? ttPolicy.createScriptURL(wokerUrl) as unknown as string : wokerUrl, { name: label });
                           ~~~~~~
src/vs/base/worker/defaultWorkerFactory.ts:27:14 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

27      return new Worker(ttPolicy ? ttPolicy.createScriptURL(workerUrl) as unknown as string : workerUrl, { name: label });
                   ~~~~~~
src/vs/base/worker/workerMain.ts:11:29 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

11  const trustedTypesPolicy = self.trustedTypes?.createPolicy('amdLoader', { createScriptURL: value => value });
                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/editor/browser/view/viewLayer.ts:372:29 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

372  private static _ttPolicy = window.trustedTypes?.createPolicy('editorViewLayer', { createHTML: value => value });
                                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/editor/browser/view/domLineBreaksComputer.ts:15:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

15 const ttPolicy = window.trustedTypes?.createPolicy('domLineBreaksComputer', { createHTML: value => value });
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/editor/browser/widget/diffEditorWidget.ts:165:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

165 const ttPolicy = window.trustedTypes?.createPolicy('diffEditorWidget', { createHTML: value => value });
                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/editor/browser/core/markdownRenderer.ts:35:33 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

35  private static _ttpTokenizer = window.trustedTypes?.createPolicy('tokenizeToString', {
                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/contrib/notebook/browser/view/renderers/cellRenderer.ts:570:22 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

570  private _ttPolicy = window.trustedTypes?.createPolicy('cellRendererEditorText', {
                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/contrib/notebook/browser/view/renderers/webviewPreloads.ts:391:19 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

391  const ttPolicy = window.trustedTypes?.createPolicy('notebookOutputRenderer', {
                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/services/extensions/browser/webWorkerExtensionHost.ts:44:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

44 const ttPolicy = window.trustedTypes?.createPolicy('webWorkerExtensionHost', { createScriptURL: value => value });
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/services/extensions/browser/webWorkerExtensionHost.ts:223:22 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

223     const worker = new Worker(ttPolicy ? ttPolicy.createScriptURL(url) as unknown as string : url, { name: 'WorkerExtensionHost' });
                           ~~~~~~
src/vs/workbench/services/extensions/browser/webWorkerExtensionHost.ts:248:24 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

248                     const worker = new Worker(data.url, data.options);
                                           ~~~~~~
src/vs/editor/standalone/browser/colorizer.ts:18:18 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

18 const ttPolicy = window.trustedTypes?.createPolicy('standaloneColorizer', { createHTML: value => value });
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/vs/workbench/services/extensions/worker/polyfillNestedWorker.ts:47:8 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

47      self.Worker = <any>class { constructor() { throw new TypeError('Nested workers from within nested worker are NOT supported.'); } };
             ~~~~~~
src/vs/workbench/services/extensions/worker/extensionHostWorker.ts:56:2 - error TS21228: [ban-worker-calls] Constructing Web Workers can cause code to be loaded from an untrusted URL.

56  Worker = <any>function (stringUrl: string | URL, options?: WorkerOptions) {
    ~~~~~~
src/vs/workbench/services/extensions/worker/extensionHostWorkerMain.ts:11:29 - error TS21228: [ban-trustedtypes-createpolicy] Creating a Trusted Types policy requires a security review.

11  const trustedTypesPolicy = self.trustedTypes?.createPolicy('amdLoader', { createScriptURL: value => value });
                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Found 19 errors.

Yeah, the webWorkerExtensionHost.ts is something new and an oversight. There is also still this https://github.com/xtermjs/xterm.js/pull/3190 then we should we good. I have running locally with trusted types enforced and default policy that logs and haven't found more places

84 errors ? After #112206 I only see 19 Worker and createPolicy related issues.

Yeah, after that. I have a feeling that yarn handle these packages well.


Add missing and improve German translations

Hi @pr0gr8mm3r thanks for the change! Can you make a new version of the package.json and also put a correct syntax for CHANGELOG.md?

Hi @pr0gr8mm3r thanks for the change! Can you make a new version of the package.json and also put a correct syntax for CHANGELOG.md?

☑ Done
However, I don't quite get the versioning system, so I just chose 0.2.75. Feel free to make changes to my branch, edits by maintainers is enabled.

☑ Done
However, I don't quite get the versioning system, so I just chose 0.2.75. Feel free to make changes to my branch, edits by maintainers is enabled.

Hey, would you mind publishing the new version? ;)

Hey, would you mind publishing the new version? ;)

Sorry for the delay @pr0gr8mm3r ! Here is the new version https://www.npmjs.com/package/strapi-plugin-preview-content

Sorry for the delay @pr0gr8mm3r ! Here is the new version https://www.npmjs.com/package/strapi-plugin-preview-content

Thank you!

Thank you!


set input and output colours

try inputs as green, and outputs as blue

see modules.jacks.colour.inlet and modules.jacks.colour.outlet in userSettings.json


extension is not working

Issue Type: Bug

install the docs-markdown extension (v 0.1.2)
press Alt+M then nothing is changed.
select the 'Docs:Markdown authoring menu' from Command Panel, then error message is popped.

Extension version: 0.1.2
VS Code version: Code 1.25.1 (1dfc5e557209371715f655691b1235b6b26a06be, 2018-07-11T15:43:53.668Z)
OS version: Windows_NT x64 10.0.17134

System Info

Item
Value

CPUs
Intel(R) Core(TM) i5-6600 CPU @ 3.30GHz (4 x 3312)

GPU Status
2d_canvas: enabledflash_3d: enabledflash_stage3d: enabledflash_stage3d_baseline: enabledgpu_compositing: enabledmultiple_raster_threads: enabled_onnative_gpu_memory_buffers: disabled_softwarerasterization: disabled_softwarevideo_decode: enabledvideo_encode: enabledvpx_decode: unavailable_softwarewebgl: enabledwebgl2: enabled

Memory (System)
31.89GB (20.94GB free)

Process Argv
C:\Program Files\Microsoft VS Code\Code.exe

Screen Reader
no

VM
0%

Hi @funnycom , thanks for bringing this to our attention.  Are you still running into this issue?

Thanks jamarw.
I deleted and reinstalled the docs-markdown extension, but I enconter the same issue.

No worries @funnycom .  I think I see what the issue is.  The docs-markdown extension works on files with an .md (markdown) extension.  It looks like the file from the screenshot has not been saved as an .md so the extension did not activate.  However, there should be a friendlier error message that pops up. I'll look into that but in the meantime would you mind installing the latest version of the extension (0.1.3) and trying to run the commands on a .md file to see if you still encounter the issue?
Thanks for your help with this.

Ah.... I understand what you saying.  I'm appreciate for your kindly helping.


Release build leaks into global scope

Q: With scope leak, do you mean the first group of statements in javascript.util.js?
A: No javascript.util.js is another issue and I think it's the right way to do it i.e putting "javascript" in global scope is ok and compatible with the old lib. It also hides the browserify stuff from the lib user completely.
The global scope leakage is from the browserify code added to the built lib. "require" and "process" is leaked (and more?). I guess this is intentional by browserify to make CommonJS API available in the browser. I'd like to keep that completely hidden though, perhaps by simply enclosing the built lib with a private scope. This also means we should browserify javascript.util and jsts togheter when jsts is ready so that browserify stuff is only included once.


hard-follows-soft paths for bip32 wallets are not properly tested.

Paths like m/0'/1/2' and m/0/2147483647' are not being tested properly in current test suite.
"hard follows soft" paths are legitimate paths for privkey derivations, they are even included in official bip32 test vector.

this is fixed by https://github.com/haskoin/haskoin/pull/189

The Bip32 code is basically done at this point.
It probably still needs some cleanup before merge.
In particular, I'd like all the packages that depend on haskoin-core compiling cleanly.
I think some review would also be a good idea.
I have changed some of the Bip32 behavior, because I think the old behavior was bugged.
In particular, in
https://github.com/tphyahoo/haskoin/blob/rework_ExtendedKeys_take2/tests/Network/Haskoin/Crypto/ExtendedKeys/Units.hs
please see new vectors for
deriveHardPrvPathVectors :: [(XPrvKey, String, Maybe XPrvKey)]
derivePathVectors :: [(Bip32XKey, String, Maybe Bip32XKey)]
derivePubPathVectors :: [(XPubKey, String, Maybe XPubKey)]

I hope to have something polished and reviewed enough for merge very soon.

There seems to be some directory shuffling going on, so better to use "take3" than take2" branch, which got polluted by the shuffle.
I updated above comment to reflect this.

experimental branch
https://github.com/tphyahoo/haskoin/tree/rework_ExtendedKeys_take4
has all tests (including haskoin-wallet) tests passing.
I think this isn't quite ready for a PR because it should be structured as
-- patch haskoin
-- patch haskoin-wallet
and then pull.
And I need to do the rebase stuff we discussed earlier.
It might be worth having a diff + look just to see if anything seems suspicious neverthelesss.
It is mergable to master as is.


[Bug]: Crash on image upload.

Summary
Uploading in current master crashes the app with following log :

android.database.sqlite.SQLiteException: no such table: recent_languages (code 1 SQLITE_ERROR): , while compiling: SELECT language_name, language_code FROM recent_languages
at android.database.sqlite.SQLiteConnection.nativePrepareStatement(Native Method)
at android.database.sqlite.SQLiteConnection.acquirePreparedStatement(SQLiteConnection.java:986)
at android.database.sqlite.SQLiteConnection.prepare(SQLiteConnection.java:593)
at android.database.sqlite.SQLiteSession.prepare(SQLiteSession.java:590)

Steps to reproduce
Try uploading a pic in current master.
Expected behaviour
Upload should proceed.
Actual behaviour
App crashes
Android version
10
Commons app version
3.1.1
Would you like to work on the issue?
Prefer not

Does this happen even after removing the app's data?

Hi @4D17Y4 , could you list the steps to reproduce in a more detailed manner please? For instance, are you uploading through Contributions > Gallery, or Nearby? At what step does the upload crash?


Question - Does GVFS replace NTFS?

Just trying to get a broad idea of how GVFS operates. Is it a replacement file system for NTFS? I mean does it do what NTFS does but include additional functionality? or does it replace NTFS but lose some NTFS functionblaity?

Works on top of something like NTFS

GVFS uses a file system filter driver called GvFlt, which is a filter driver that sits on top of NTFS. This allows us to inject enumeration results and file contents on demand, but then allow NTFS itself to handle everything else.

@sanoursa Is GvFlt the basis for the new onedrive functionality announcd in the FCU?  It looks almost identical =).

Is it any functional differens between  GvFlt and Dockan?

Given that GvFlt is a closed source chocolatey package there is not much source to peek into except GVFS itself. MS promised to post a blog article about it's mode of operation "soon".
From the scarcely available information I deduce that it is rather a "filter driver in userspace" than filesystem in user space. They did not seem to want to pay the overhead of a FUSE mount for their product, so they went with a filter driver that forwards the request to NTFS of the file is available locally.
This is cool in its own right, but one cannot replace the other, it seems.
Sent from my Android device with K-9 Mail. Please excuse my brevity.

@Rondom No, it's a filter driver in kernel space (gvflt.sys).  That's why they were talking about performance and context switching.  If the filter driver were in userspace, you wouldn't get any improvement in performance over a generic FUSE implementation.
You can see it in this documentation page referenced as a kernel filesystem filter driver (which is why its extension is .sys rather than .dll):
https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes
It seems simple enough to understand: The GVFS implementation above and available in this respository is basically all of the code that doesn't need to live in kernelspace, and the GvFLT code implements the kernel-side stuff, which probably has to do with fast switching between pulling from disk and pulling from the remote repositories.  The code is probably not very interesting to Linux or OSX developers since a lot of it is probably very Windows-specific, dealing in particular with the kernel-exposed parts of the NTFS driver and kernel networking API in order to reduce context switching to a minimum.
So the idea is once the request for the file is issued from userspace with NtOpenFile, the GvFLT driver intercepts this call, pulls the file from 1.) cache in memory 2.) disk or 3.) the remote repository, and returns it transparently to the caller of NtOpenFile.
The gist of why why it lives in kernel space rather than userspace is that it reduces the number of expensive context switches (from user mode to kernel mode and vice-versa) vs a FUSE-style implementation, where for each file, you would have to jump into the FUSE kernel driver, up into userspace, back down into the FUSE driver, then back into the kernel for resolution of the system call (if I understand how FUSE works).
If you read the posts by the developers, they mention that the additional context switches from FUSE-style implementations slowed things down a lot and did not produce acceptable performance from the internal Microsoft perspective (GVFS arising from Microsoft's own decision to move completely over to GIT from their previous solution).  The details of how the Gvflt driver are very Windows-specific, although it might be that their caching strategies and some design elements might be relevant to implementations on other platforms.

Thanks for the detailed explanation. I was not clear. The "it" in the second paragraph was referring to GVFS not to GvFlt. So, GvFlt is a filter driver that enables implementing filter driver functionality in user space, of which GVFS is an example. So, what I meant is that you can think of GvFlt as "filter driver in user space" (as opposed to filesystem in userspace). Please correct me, if I am wrong on this.
(Oh, and I typed that message on my mobile this morning not being aware that the email came from the GVFS repo, thinking it was from another repo. Otherwise I would have kept my mouth shut and let the people here that have more of a clue talk :smile:  )

FUSE is just an API to talk to a driver that allows you to implement filesystem logic in a userspace library. It looks like GvFLT moves more of that logic directly into the kernel space, ostensibly sacrificing some flexibility for performance.
I don't know if GvFLT has been documented well enough to see directly if you could e.g. write a generic FUSE wrapper around it.
What is likely the case is that the associated gvflt service has some kind of COM interface that provides an API that gets used in the GVFS sourcecode here, and that API will let you program against the driver without having to make direct IOCONTROL calls to it.


Devtron issue

Devtron is not displayed

It's been added to the extensions list in main.js, but haven't had time to get it installed and working properly just yet. Open to a PR if you get it added to your project!

Looks like Devtron is no longer maintained and does not work in the latest versions of Electron, which are used in this project.
Closing the issue, removed references to Devtron in [this commit: https://github.com/iPzard/electron-react-python-template/commit/2342a8dbdd48b1c9b6b6984aea65d3f99cb3d90b


License info in README

I can't see any information about which license the project is under in the README.md file. It'd be good to get a small notice at the bottom of the readme, with a link to the license file!

I'm on it!  I think I'm going to replace the LGPL with the MIT license.  MIT is much simpler, and LGPL might be a turnoff for any interested parties.


[DOC] Fix docstrings for doc sprint

Describe the issue linked to the documentation
#863
Easy files to fix

https://github.com/alan-turing-institute/sktime/blob/77c2547b7f05e2975962eca749d4c9f4f2b8468e/sktime/utils/_maint/_show_versions.py
https://github.com/alan-turing-institute/sktime/blob/main/sktime/transformations/series/boxcox.py

Working on fixing transformations/series/boxcox.py 🤖


finish token length and source map in kybra

The token length is a little messed up here
error: call expression is not allowed here.
  --> /home/bdemann/code/demergent_labs/kybra/examples/func_types/src/func_types/main.py:42:28
   |
42 |   BasicFunc: TypeAlias = Func(Query[[str], str])  # type: ignore
   |  ____________________________^
43 | | ComplexFunc: TypeAlias = Func(Update[[User, Reaction], nat64])  # type: ignore
   | |____^ Illegal expression used here
   |

thread 'main' panicked at 'error: Only Async, list, manual, opt, or tuple are allowed subscripts for candid values
  --> /home/bdemann/code/demergent_labs/kybra/examples/complex_types/src/state.py:12:16
   |
12 |       posts: dict[str, "StatePost"]
   |  ________________^
13 | |     reactions: dict[str, "StateReaction"]
   | |________^ Invalid subscript here
   |', src/py_ast/kybra_types/kybra_expr/to_act_data_type.rs:50:26
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

This token size is messed up

💣 Something about your Python code violates Kybra's requirements

error: Only Async, list, manual, opt, or tuple are allowed subscripts for candid values
   --> /home/bdemann/code/demergent_labs/kybra/examples/primitive_types/venv/lib/python3.10/site-packages/kybra/__init__.py:136:18
    |
136 |       err: Optional[str]
    |  __________________^
137 | |
138 | |     def __init__(self, ok: T, err: str):
    | |__________________^ Invalid subscript here
    |

We are closing this issue anticipating an entire rearchitecture of Kybra similar to what we have done with Azle. This removes most of the compiler architecture as it is. We believe that this issue no longer applies to the new planned architecture.
In case our rearchitecture is not successful, or we otherwise need to find these closed issues, the search term KYBRA_REARCHITECTURE can be used.


GDScript: Assume constructor to be accessible from class

Since the constructor is accessed directly from the class, even if not marked static, it can be retrieved as a Callable without an instance.
Fix #80526

Thanks!


[Feature Request]: Reduce number of byte[] copies in TextSource

What would you like to happen?
The current TextSource implementation is spending a lot of time during byte[] copying:

Hadoop LineReader.java implementation is signficantly faster (~2x) when handling typical files due to an implementation that reduces how many byte[]s are copied. A simple benchmark reading 10 million lines (60-120 characters long) shows that it takes about ~2.05 seconds to process such a file while the Apache Beam TextSource takes ~4.03 seconds.
Issue Priority
Priority: 2
Issue Component
Component: io-java-text

CC: @bhisevishal


Fail to batch insert bitmap

My ck-jdbc version is 0.3.1

ru.yandex.clickhouse
clickhouse-jdbc
0.3.1

When I insert bitmap one by one, it success.
But i use executeBatach() method to insert bitmap, the bitmapCardinality(usr_bit) return 0 incontradicts with the former result.
val initSQL =
      """
        |INSERT INTO xxx.xxxxxxx
        |(user_bit, tag_id, shard_id)
        |VALUES
        |(?,?,?)
        |""".stripMargin

val conn = ckJdbcUtils.getLocalConnection
    val ps = conn.prepareStatement(initSQL)
    val bitmap = new RoaringBitmap()
    bitmap.add(110)
    bitmap.add(125)
    var i = 0
    var num =0
  for (i <- 1 to 100) {
    val bitmap = new RoaringBitmap()

    bitmap.add(i)
    ps.setObject(1, ClickHouseBitmap.wrap(bitmap,ClickHouseDataType.UInt32))
    ps.setLong(2, 8877)
    ps.setInt(3, 56)
    ps.addBatch()
    num+=1
    if (num >= 10) {
      println(s"record size ${num}")
      ps.executeBatch()
      num = 0
    }
  }

  if (num != 0) {
    println(s"record size ${num}")
    ps.executeBatch()
    ps.close()
  }

Hi @Nicemo, this is a known issue. I'd suggest you to use extended API like below:
// use extended API - recommended in 0.3.0
try (ClickHouseStatement statement = connection.createStatement()) {
    statement.sendRowBinaryStream("insert into my_bitmap_table", new ClickHouseStreamCallback() {
        public void writeTo(ClickHouseRowBinaryStream stream) throws IOException {
            ...
            // RoaringBitmap bitmap = RoaringBitmap.bitmapOf(1,2,3,...);
            // In addition to RoaringBitmap, you can pass:
            // ImmutableRoaringBitmap, MutableRoaringBitmap and even Roaring64NavigableMap
            stream.writeBitmap(ClickHouseBitmap.wrap(bitmap, ClickHouseDataType.UInt32));
            ...
        }
    });
}

Current implementation of this driver has limited support for serializing binary data like bitmap in text format and send to server. I hope I can enhanced the driver in 0.3.2 by switching to RowBinary format.

insert into table values(?,?,?) was converted to a larger SQL with multiple values for batch insertion. It does not work with binary data very well, because we were using text-based data format and UTF-8 for encoding.
It's better to use input function(similar as external table but more like a pipe line) as example shown here instead.


add s3 logs to request page

Adds a new table on the request page for all its tasks s3 logs.
we should merge in https://github.com/HubSpot/Singularity/pull/523 before rolling this out though as we'll run into that same issue here.
@tpetr

this is all set, merge issue with #523 mentioned ^ is not longer an issue.

closing this in favor of moving towards a more consolidated task log view


Adding a heading right after an image removes the heading formatting

Describe the bug
When you add a heading (say H2) right after an image, the markdown that's saved does not respect H2's formatting
To Reproduce
Steps to reproduce the behavior:

Set this HTML content on the Tiptap editor:

This should be an H2

Use tiptap-markdown to convert to Markdown
Set that markdown on the editor again
Notice that the formatting on the H2 is gone and has become plain text that says ## This should be an H2

Expected behavior
The formatting should intact for any element added directly after an image.
Screenshots
https://github.com/aguingand/tiptap-markdown/assets/6132555/9263c6ed-c7b0-4f0e-b7fb-2801a08b6d80
Desktop (please complete the following information):

Chrome 120.0.6099.216

Additional context
If I add a "new line" between the image and the heading, then the formatting stays intact.
Reproduction
Here's the CodeSandbox.

Can you provide a reproduction on Codesandbox or a github repo ?
As a sidenote, FYI the  must be wrapped inside a

Added a CodeSandbox in the first message.
I tried adding the p around the img in the repro but that didn't help.

Stumbled upon the same issue!

As a sidenote, FYI the  must be wrapped inside a

Unless you set inline:true within the tiptap image extension, the images are not inside a p tag by default.
Image.configure({
    inline: true,
})

Using inline images caused some odd UX unless you actually want inline images. You have to press enter after adding an email to get out of the image's p tag and continue writing.
This is how the markdown is parsed if you do not use inline images.
# Title

![](https://image.png)## Subtitle

What we need is:
# Title

![](https://image.png)

## Subtitle

Done the same using JS:
res.replace(/!\[.*?\]\(.*?\)/g, (match) => `${match}\n\n`);

This always add line breaks after images


Not returning client from AppSync service

Have followed the README steps to being up the backend with cloudformation and connect it up.
The failure point is in the AppService, where consumers' calls to this.appsync.hc() is returning undefined instead of the client.

ERROR Error: Uncaught (in promise): TypeError: Cannot read property 'then' of undefined
TypeError: Cannot read property 'then' of undefined
at ChatComponent.register (chat.component.ts:92)
at eval (chat.component.ts:43)
at ZoneDelegate.invoke (zone.js:388)
at Object.onInvoke (core.js:4760)
at ZoneDelegate.invoke (zone.js:387)
at Zone.run (zone.js:138)
at eval (zone.js:872)
at ZoneDelegate.invokeTask (zone.js:421)
at Object.onInvokeTask (core.js:4751)
at ZoneDelegate.invokeTask (zone.js:420)
at ChatComponent.register (chat.component.ts:92)
at eval (chat.component.ts:43)
at ZoneDelegate.invoke (zone.js:388)
at Object.onInvoke (core.js:4760)
at ZoneDelegate.invoke (zone.js:387)
at Zone.run (zone.js:138)
at eval (zone.js:872)
at ZoneDelegate.invokeTask (zone.js:421)
at Object.onInvokeTask (core.js:4751)
at ZoneDelegate.invokeTask (zone.js:420)
at resolvePromise (zone.js:814)
at eval (zone.js:877)
at ZoneDelegate.invokeTask (zone.js:421)
at Object.onInvokeTask (core.js:4751)
at ZoneDelegate.invokeTask (zone.js:420)
at Zone.runTask (zone.js:188)
at drainMicroTaskQueue (zone.js:595)

Seems to be occurring with<EMAIL_ADDRESS>not in the 0.4.8 version defined in package json.
Removing the carat and preventing npm from using ^0.4.8 (resolving to 1.3.4) has fixed the issue.
Closing this.


Uncaught TypeError: object is undefined

Version
5.0.2
Browser and OS info
Chrome 73 / Windows 10, Firefox 67 / Windows 10
Steps to reproduce
Register a nested Vuex module like so
globalStore.registerModule(['dialogs', 'snackbars'], store);

and then open Vue devtools
What is expected?
The Vuex tab of devtools should show dialogs->snackbars->{}
What is actually happening?
All Vue devtools tabs are empty, except for the components tab. Essentially this completely breaks the devtools

This is essentially the same bug as in #919, but takes place a little further down the chain
The actual error takes place in backend.js, in the 'set' function, line 657
I have also tried using the standalone Electron Vue dev tools, but they have the same issue.

Not sure if it's related to this bug (I was having this issue above before), but after the update to 5.0.2 the Vue app crashes on boot if the dev tools are installed. Chrome performance monitor says 100% CPU usage (For the tab).

@DanEvans485 Please open a new issue with a runnable reproduction so I can look at this.

@G-Bro Please provide a runnable reproduction and actual error traces. I can register a nested dynamic module without issue.

@Akryum I have found a few scenarios where registering Vuex modules appears to break the Vue devtools. I have outlined below some of the methods that do and don't work.
In each of these cases, the dialogs.snackbars module functions within Vue itself, but not within the Vue devtools
Scenario 1: Dynamic module registration with an empty object
if I also register the parent module dynamically then the devtools break
❌ Breaks devtools
globalStore.registerModule(['dialogs'], {});
globalStore.registerModule(['dialogs', 'snackbars'], store);

Scenario 2: Static module registration with an empty object
if I instead register the module during the initialisation of Vuex like below, there are no issues
✔ Works
modules: {
  ...
  dialogs: {},
},

Scenario 3: Dynamic module registration with an module object
Registering the module dynamically works so long as there is a 'state' property in the module object
✔ Works
globalStore.registerModule(['dialogs'], {
    state: {},
});

Scenario 4: Dynamic module registration with a generic object
Registering the module dynamically with a non-empty object does not work if it doesn't meet Vuex module structure
❌ Breaks devtools
globalStore.registerModule(['dialogs'], {
    a: 1, b:2, c: 3,
});

Here is the trace from the Firefox console when registering the dialogs.snackbars module in scenarios 1 and 4
TypeError: object is undefined backend.js:657:5
    set moz-extension://b88b1336-4719-4558-8704-3aca02c304bb/build/backend.js:657
    initVuexBackend moz-extension://b88b1336-4719-4558-8704-3aca02c304bb/build/backend.js:11850
    forEach self-hosted:262
    initVuexBackend moz-extension://b88b1336-4719-4558-8704-3aca02c304bb/build/backend.js:11842
    connect moz-extension://b88b1336-4719-4558-8704-3aca02c304bb/build/backend.js:1472
    initBackend moz-extension://b88b1336-4719-4558-8704-3aca02c304bb/build/backend.js:1382
    handshake moz-extension://b88b1336-4719-4558-8704-3aca02c304bb/build/backend.js:2696

I hope that helps.

I couldn't reproduce this error even on scenarios 1 and 4. Could you share a runnable reproduction?

version: 5.0.3
After some experimentation, I think the problem is with unregisterModule used with nested modules.
this.$store.registerModule(['bar'], {state:{}})
this.$store.registerModule(['bar', 'foo'], {state:{}})
this.$store.unregisterModule(['bar', 'foo'])

Result:
Uncaught TypeError: Cannot set property 'foo' of undefined
    at set (backend.js:657)
    at earlyModules.forEach (backend.js:11850)
    at Array.forEach (<anonymous>)
    at initVuexBackend (backend.js:11842)
    at connect (backend.js:1472)
    at initBackend (backend.js:1382)
    at handshake (backend.js:2696)

Not sure if this is related, but changing data on deep nested objects via components tabs throws TypeError.
For example:
changing the string 'site' within:
coupon: {
code: "example"
client: {
site: "https://www.example.com/"
}
}
Throws: "TypeError:  Cannot read property 'client' of undefined"
changing the string 'code', works without problems.


Issue #365 add regrid to msw packages

Fixes #365
Description
Adds regrid functionality to a number of metaswap packages
Adds unittests for regridding these packages
Checklist

[X] Links to correct issue
[ ] Update changelog, if changes affect users
[X] PR title starts with Issue #nr, e.g. Issue #737
[X] Unit tests were added
[ ] If feature added: Added/extended example

Approved. There are some loose ends though, could you make issues for:

That we still need to assess proper default regridding methods for MetaSWAP grid data
The GridData, Sprinkling, IdfMapping package still need an implementation for regridding.

issues were made for these 2 loose ends: #1001 and #1002


README: remove mention of installing pylama_pylint

pylama_pylint is deprecated and doesn't need to be installed any more, so this mention in the README/docs is confusing.

Coverage remained the same at 78.269% when pulling 31556187d95ca0a0e82a3aca864aadeb2253b792 on Deimos:patch-1 into f436ccc6b55b33381a295ded753e467953cf4379 on klen:develop.

@Deimos Thank you for the PR


To Add an option to create multiple Standby MDS nodes in CephFilesystem CRD

Description of your changes:
Added an option to create multiple Standby MDS nodes in CephFilesystem CRD
Which issue is resolved by this Pull Request:
Resolves #4068
Checklist:

[ ] Reviewed the developer guide on Submitting a Pull Request
[ ] Documentation has been updated, if necessary.
[ ] Unit tests have been added, if necessary.
[ ] Integration tests have been added, if necessary.
[ ] Pending release notes updated with breaking and/or notable changes, if necessary.
[ ] Upgrade from previous release is tested and upgrade user guide is updated, if necessary.
[ ] Code generation (make codegen) has been run to update object specifications, if necessary.
[ ] Comments have been added or updated based on the standards set in CONTRIBUTING.md
[ ] Add the flag for skipping the CI if this PR does not require a build. See here for more details.

@xenolinux PRs should actually be opened against the rook/rook repo in the master brach, then we will manage the backports to this fork as necessary. Thanks!

@travisn ok. I will open PR against rook/rook repo.


Support for async blocks for (setup, prepare, iterate)

subj

Async code can't be precisse measured. It's better to use bench.hyoo.ru for full app benchmarking.


doc: Jade dependencies missing from test/README

On Ubuntu it needs ninja-build libpixman-1-dev libtasn1-dev
Probably some other things from here: https://github.com/Blockstream/Jade/blob/master/Dockerfile#L2
cc @JamieDriver

With just the specific dependencies above (rather than everything in the Dockerfile), the qemu build fails for me on Ubuntu 21.10:
Dependencies
                      SDL support: NO
                SDL image support: NO
                      GTK support: NO
                           pixman: YES
                      VTE support: NO
                    slirp support: internal
                         libtasn1: YES
                              PAM: NO
                    iconv support: NO
                   curses support: NO
                    virgl support: NO
                     curl support: NO
                Multipath support: NO
                      VNC support: NO
                   brlapi support: NO
                      vde support: NO
                   netmap support: NO
                Linux AIO support: NO
           Linux io_uring support: NO
               ATTR/XATTR support: YES
                     RDMA support: NO
                   PVRDMA support: NO
                      fdt support: internal
                libcap-ng support: NO
                      bpf support: NO
                    spice support: NO
                      rbd support: NO
                   xfsctl support: NO
                smartcard support: NO
                      U2F support: NO
                           libusb: NO
                    usb net redir: NO
                   OpenGL support: NO
                              GBM: NO
                 libiscsi support: NO
                   libnfs support: NO
                  seccomp support: NO
                GlusterFS support: NO
                      TPM support: NO
                   libssh support: NO
                      lzo support: NO
                   snappy support: NO
                    bzip2 support: NO
                    lzfse support: NO
                     zstd support: NO
                NUMA host support: NO
                          libxml2: YES
                         capstone: NO
                  libpmem support: NO
                libdaxctl support: NO
                          libudev: YES
                       FUSE lseek: NO

  Subprojects
                    libvhost-user: YES

Found ninja-1.10.1 at /usr/bin/ninja
+ git checkout fd85235d17cd8813d6a31f5ced3c5acbf1933718
HEAD is now at fd85235 hw/xtensa: add ESP32 machine
+ git submodule update --recursive --init
+ ninja -C build
ninja: Entering directory `build'
[43/2098] Generating qemu-version.h with a meson_exe.py custom command
fatal: No names found, cannot describe anything.
[937/2098] Compiling C object libcommon.fa.p/disas_i386.c.o
FAILED: libcommon.fa.p/disas_i386.c.o
cc -Ilibcommon.fa.p -I../dtc/libfdt -I../slirp -I../slirp/src -I. -Iqapi -Itrace -Iui -Iui/shader -I/usr/include/libmount -I/usr/include/blkid -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -I/usr/include/gio-unix-2.0 -I/usr/include/pixman-1 -fdiagnostics-color=auto -pipe -Wall -Winvalid-pch -Werror -std=gnu11 -O2 -g -isystem /home/dev/HWI/test/work/jade/qemu/linux-headers -isystem linux-headers -iquote . -iquote /home/dev/HWI/test/work/jade/qemu -iquote /home/dev/HWI/test/work/jade/qemu/include -iquote /home/dev/HWI/test/work/jade/qemu/disas/libvixl -iquote /home/dev/HWI/test/work/jade/qemu/tcg/i386 -pthread -fsanitize=undefined -fsanitize=address -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -m64 -mcx16 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -Wold-style-declaration -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -fstack-protector-strong -fPIC -D_REENTRANT -MD -MQ libcommon.fa.p/disas_i386.c.o -MF libcommon.fa.p/disas_i386.c.o.d -o libcommon.fa.p/disas_i386.c.o -c ../disas/i386.c
In file included from /usr/include/string.h:519,
                 from /home/dev/HWI/test/work/jade/qemu/include/qemu/osdep.h:87,
                 from ../disas/i386.c:34:
In function ‘strcpy’,
    inlined from ‘PNI_Fixup’ at ../disas/i386.c:6434:4,
    inlined from ‘PNI_Fixup’ at ../disas/i386.c:6400:1:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:79:10: error: ‘__builtin_memcpy’ offset [0, 7] is out of the bounds [0, 0] [-Werror=array-bounds]
   79 |   return __builtin___strcpy_chk (__dest, __src, __glibc_objsize (__dest));
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘strcpy’,
    inlined from ‘PNI_Fixup’ at ../disas/i386.c:6427:4,
    inlined from ‘PNI_Fixup’ at ../disas/i386.c:6400:1:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:79:10: error: ‘__builtin_memcpy’ offset [0, 5] is out of the bounds [0, 0] [-Werror=array-bounds]
   79 |   return __builtin___strcpy_chk (__dest, __src, __glibc_objsize (__dest));
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
[944/2098] Compiling C object libcommon.fa.p/hw_scsi_mptsas.c.o
ninja: build stopped: subcommand failed.

I'll try to take a look - but the jade fw and the qemu emulator are both built by setup_environment.sh in the normal test docker image.
% git show db17fed8ff1109910ed65a36ddd20ba60bf90ee0 ci/cirrus.Dockerfile
...
     libevent-dev \
+    libgcrypt20-dev \
     libnewlib-arm-none-eabi \
     libusb-1.0-0-dev \
+    ninja-build \
     pkg-config \
...

Ok, my bad - I did indeed add those!   You got me.

Guess I'll just install the whole kitchen skink https://github.com/bitcoin-core/HWI/blob/0d846a64967697eacd999cf7967fc6a5ba5b6282/ci/cirrus.Dockerfile#L5-L38 but it's nice to have a more narrow list.

Hi @Sjors,
I've added a section to the test/README.md - I hope it is sufficient.
Let me know if not - happy to iterate until we get it right!
Cheers,
Jamie.


TA comments on milestone 2

Hello,
Thank you for your submission of milestone 2. I am sure that you put a lot of effort into producing the app and its documentation. I see that you are always commiting and using pull requests, but try to add an extended description of the commits that you find a little vague. You also use issues for communication and task assignment, but I see that team members tend not to comment on issues.
Regarding the app, I like how you use a mix of bar, and line plots for visualizations. I also liked the interactive features that you added. I have some suggestions for the app that I will be listing below.

It is always required for an online visualization tool to have a description of the app at the beginning.
In the unemployment by year tab. I suggest you add a slider to control the year range.
I also suggest that enable the option to select all in the dropdown menu.
I can't seem to change the beginning of the years range on the slider in the seasonal unemployment  tab.
You should include or cite the data source.
You have used some interactive features which I find very helpful for users.
Finally, I like your reflection you did every thing that was required in this task

Thank you very much for your comments, Hossameldin.

We will try to add a description of our app at the beginning. If there is no time, we will add that to our R app.
For your comment on adding a slider to control year for the unemployment by year tab, we think it is unnecessary because the purpose of this tab is to show the change across the years as you can see that the x-axis of the chart is the year.
It is very good advice to add select all in the dropdown menu and we will try to add that feature for our R app.
In the seasonal unemployment tab, the slider is to choose one year to show the seasonal change in that year. And we made it clear that it is the year you are choosing, not the year range. But your confusion reminds us we may need to change the slider to something else like radio buttons. We plan to change that for our R app.
Thank you for reminding us about the data source. We'll add the data source.


Remote closing connection leads to unhandled exceptions in _sync

I just wanted to point out, that without an error callback, the current implementation of having listen_forever in a thread created by the library can lead to unhandled exceptions that cannot be intercepted.
Following traceback sometimes occurs during running my currently developed bridge software, which atm. lets matrix clients run with start_listener_thread() - it happens very occasionally. I only get a real palpable error later, when i try to send with one of those clients - so until then it does not get noticed. i can also provide more information, but i think this is a more general issue.
I also should mention, my client was connected via https externally
I am of course rewriting it to handle threading on my own anyway so it is not an issue for me i hope in the future - however documentation should probably point out problems like this to the user, so he can prepare or set a general exception handler, and maybe if you keep a "simple we do the threading" solution, an exception callback for the thread would also be a solution.
from pip:
used package: matrix-client==0.3.2
the error logged:
matrix_client.client [ERROR]: Exception thrown during sync
the traceback:
Traceback (most recent call last):
  File "/myproject/directory/lib/python3.5/site-packages/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/myproject/directory/lib/python3.5/site-packages/urllib3/connectionpool.py", line 384, in _make_request
    six.raise_from(e, None)
  File "<string>", line 2, in raise_from
  File "/myproject/directory/lib/python3.5/site-packages/urllib3/connectionpool.py", line 380, in _make_request
    httplib_response = conn.getresponse()
  File "/usr/lib/python3.5/http/client.py", line 1198, in getresponse
    response.begin()
  File "/usr/lib/python3.5/http/client.py", line 297, in begin
    version, status, reason = self._read_status()
  File "/usr/lib/python3.5/http/client.py", line 266, in _read_status
    raise RemoteDisconnected("Remote end closed connection without"
http.client.RemoteDisconnected: Remote end closed connection without response

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/myproject/directory/lib/python3.5/site-packages/requests/adapters.py", line 445, in send
    timeout=timeout
  File "/myproject/directory/lib/python3.5/site-packages/urllib3/connectionpool.py", line 638, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/myproject/directory/lib/python3.5/site-packages/urllib3/util/retry.py", line 367, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/myproject/directory/lib/python3.5/site-packages/urllib3/packages/six.py", line 685, in reraise
    raise value.with_traceback(tb)
  File "/myproject/directory/lib/python3.5/site-packages/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/myproject/directory/lib/python3.5/site-packages/urllib3/connectionpool.py", line 384, in _make_request
    six.raise_from(e, None)
  File "<string>", line 2, in raise_from
  File "/myproject/directory/lib/python3.5/site-packages/urllib3/connectionpool.py", line 380, in _make_request
    httplib_response = conn.getresponse()
  File "/usr/lib/python3.5/http/client.py", line 1198, in getresponse
    response.begin()
  File "/usr/lib/python3.5/http/client.py", line 297, in begin
    version, status, reason = self._read_status()
  File "/usr/lib/python3.5/http/client.py", line 266, in _read_status
    raise RemoteDisconnected("Remote end closed connection without"
urllib3.exceptions.ProtocolError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response',))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/myproject/directory/lib/python3.5/site-packages/matrix_client/api.py", line 670, in _send
    verify=self.validate_cert
  File "/myproject/directory/lib/python3.5/site-packages/requests/sessions.py", line 512, in request
    resp = self.send(prep, **send_kwargs)
  File "/myproject/directory/lib/python3.5/site-packages/requests/sessions.py", line 622, in send
    r = adapter.send(request, **kwargs)
  File "/myproject/directory/lib/python3.5/site-packages/requests/adapters.py", line 495, in send
    raise ConnectionError(err, request=request)
requests.exceptions.ConnectionError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response',))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/myproject/directory/lib/python3.5/site-packages/matrix_client/client.py", line 473, in listen_forever
    self._sync(timeout_ms)
  File "/myproject/directory/lib/python3.5/site-packages/matrix_client/client.py", line 555, in _sync
    response = self.api.sync(self.sync_token, timeout_ms, filter=self.sync_filter)
  File "/myproject/directory/lib/python3.5/site-packages/matrix_client/api.py", line 105, in sync
    api_path=MATRIX_V2_API_PATH)
  File "/myproject/directory/lib/python3.5/site-packages/matrix_client/api.py", line 673, in _send
    raise MatrixHttpLibError(e, method, endpoint)
matrix_client.errors.MatrixHttpLibError: Something went wrong in GET requesting https://myproject.host/_matrix/client/r0/sync: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response',))

i am struggeling with the same exception, any way to fix it?

I don't think so. This SDK is kind of abandoned. I have switched to matrix-nio and it works much better.

@Artiom-M thanks for the heads-up, i am currently using https://gitlab.com/gibberfish/python-matrixbot and i was not planning to write my own bot as of right now :)
i will try to patch the matrix-python-sdk sources to meet my use case and hopefully work around the issue.
cheers

I catch same issue(( How solve it? Who know?


Added labels options for the on/off switch state for the switch control widget

This add on/off custom labels options available on the switch widget (see #308 )

@webbati Apologies for the delay in merging this. There's just two quick fixes needed, and then I'll be happy to merge.

Thanks Luca, merged in 93abe0d07e1fc600ef3c1e69579978bc7c43be05


https connect failing with all the samples (qemu_x86 & mbedtls)

Describe the bug
I'm evaluating samples to understand the https (TLS 1.2) connect with the Zephyr & mbedtls. I've taken the http_big_download sample, compiled for qemu_x86 and ran but it failed to work. The case is same with all the other https samples (like http_client)
Samples path: samples/net/sockets/big_http_download
target: qemu-x86
To Reproduce
Steps to reproduce the behavior:

Go to Zephyr build environment (cd ~/zephyrproject/zephyr)
build: west build -b qemu_x86 samples/net/sockets/big_http_download -p -- -DCONF_FILE="prj.conf overlay-tls.conf"
run: west build -t run
See error in the console:  net_tcp: net_tcp_connect: (0x160540): conn: 0x1679a0, ret=-116
The full console logs are attached (console-log.txt).

Expected behavior
https connect should be successful and the file should have been downloaded.
Impact
Showstopper. The basic HTTPS connect is not happening.
Logs and console output
Attached 'console-log.txt'
Environment (please complete the following information):

OS: Ubuntu 18.04
Toolchain:
Zephyr version: 3.1.99 (/home/vmadmin/zephyrproject/zephyr) + west
The C compiler identification is GNU 10.3.0
The CXX compiler identification is GNU 10.3.0
The ASM compiler identification is GNU
Found assembler: /home/vmadmin/zephyr-sdk-0.14.2/x86_64-zephyr-elf/bin/x86_64-zephyr-elf-gcc

Additional context
Followed "qemu for networking" page & ran loop-socat.sh, sudo loop-slip-tap.sh & sudo dnsmasq.sh in separate terminals before running the program in qemu_x86.
If TLS is removed (i.e., no HTTPS) - the connection is working properly.
console-logs.txt

From the wireshark traces (attached here), I see the QEMU is sending the SYN (from its IP <IP_ADDRESS>). But QEMU is not receiving the SYNACK back from the 7-zip (<IP_ADDRESS>). Hence the sample code, keeps resending the SYN and stops.
I tried changing the timeout value to 0 (infinite) - but no change in behavior.
2_new.zip


Provide nice api for use in featureContext

$this->sqlContext->get('api')->insert($table, ['id' => 123, 'column1' => 'jklhasjdf']);
as opposed to the current
$this->sqlContext->insert('table', 'id: 123, column1:jklhasjdf');
Or something like
$dataObject = $this->sqlContext->get('api')->getNewDataObject(); $dataObject->targetTable($table); $dataObject->setSelectColumns(); $dataObject->setInsertValues(); $dataObject->setUpdateValues(); $dataObject->setWhereCriteria(); $dataObject->setDeleteCriteria(); $this->sqlContext->get('api')->insert($dataObject);

The above is very close to an entity manager, maybe a good idea to just use the entity manager instead of this then. The improvements suggested for the API could be to do with allowing for multi_query execution. An idea in the pipeline.

Done https://packagist.org/packages/genesis/sql-api-wrapper


Where to write the code for opening new activity when we get result after ocr

Hi rmtheis,
I have successfully used OCR demo in my app and in this demo , the result is displayed on camera screen itself. My motive is i need to show the result ocr text on another activity.
So where in CaptureActivity.java (or any other class) i should write the code of intent fire since i tried to use two lines of code to open activity many places in the demo but crashed.
Kindly help

Hi !
The result ocr text is show in boolean handleOcrDecode(OcrResult ocrResult) method with ocrResult.getText()

It's up to you. agnaramonboris' suggestion is good.


The answer is NO.
Therefore I propose to introduce a new method asyncQuery. It would use POST /_api/cursor with x-arango-async: store header which returns job id. Then we could easily cancel a query by PUT _api/job/{job-id}/cancel.

https://github.com/arangodb/arangojs/pull/484
PR has been submitted

@zhenruyan Thanks for the PR! It is a great step forward.
However the proposal goes a bit further by introducing an async query that would return job ID. This would be very helpful if I want to cancel queries triggered by one HTTP request into my API backend.

job id in response header X-Arango-Async-Id
For the time being, I haven't found a way to take it out and merge it into the body.


Add line break

Gonna leave it like it is for now.

@freekmurze, okay, just be aware of it:

O, I didn't notice it was rendering wrong. Thanks!

You’re welcome!


Elf loader

Is your feature request related to a problem? Please describe.
What's wrong with adding an elf loader to Zephyr?
Describe the solution you'd like
I would like to be able to execute position independent elf binaries from flash formatted with ext2 that is already supported. This would pave the way towards porting busybox to zephyr and being able to run programs from flash. Of course the biggest issue is that this will have to be position independent executables that can be loaded into any portion of physical memory and execute in place from there instead of being mapped.
I think that if full posix compliance is implemented in zephyr then porting many existing tools will be very easy. It shouldn't really matter that zephyr is an rtos and not a desktop os. It should still be possible to build and run a wide variety of portable software on zephyr.
Describe alternatives you've considered
Even minix has a collection of standalone utilities and is able to run x11. Zephyr today is bigger in size than minix yet it doesn't have the tools to port x11 to it.
Additional context
https://github.com/Stichting-MINIX-Research-Foundation/minix/blob/master/minix/lib/libexec/exec_elf.c
http://edeproject.org/wiki/installingonminix

Duplicate of https://github.com/zephyrproject-rtos/zephyr/issues/2746

Loading code is one thing, what you ask for is something that simply is not going to happen, instead of a static application, you want a huge kernel that has every single feature enabled (which would be required for external applications to run). Instead of trying to make zephyr into something it is not i.e. linux, just go and use linux.

Loading code is one thing, what you ask for is something that simply is not going to happen, instead of a static application, you want a huge kernel that has every single feature enabled (which would be required for external applications to run). Instead of trying to make zephyr into something it is not i.e. linux, just go and use linux.

Zephyr is already reimplementing many of the basic utilities anyway (filesystem, network etc). This will get worse with time when custom utilities are continuously added for things like network config, file manipulations etc. I believe it would be better to make it an option to include many of these small utilities as they already exist. Busybox utilities are tiny. But they do require more complete posix support to work. From there, the new functionality can be added to zephyr in ways that are compatible with already existing unix tools. I do not see this as a drawback. Zephyr is small, modular and clean kernel that can be used as basis for building more complex systems that do not require an mmu.


Upload linked files and directories content (first deployment for exemple)

Hi,
I just about testing your awesome role and I asking myself if there an implementation to upload shared files and directories content like this Capistrano extension does : https://github.com/runar/capistrano-linked-files ?
Best regards.
Mike

Maybe it's not planned to do it and I can just use an Ansible module to do it, right ?
(I just begin to use Ansible ;))

Hi, you should use hooks for this. Some minimal Ansible knowledge is expected to use Ansistrano.

OK right, I understand...I have all tools to do what I want. ;)
Thx for your answer.
Best regards.


⚠ Processors has degraded performance

In a15070a, Processors ($STATUS_URL) experienced degraded performance:

HTTP code: 200
Response time: 48 ms

Resolved: Processors performance has improved in 88b314b.


all LDAP users being logged in as "admin" in WebUI, 1.1.0

Using the "ldap_auth" backend, any LDAP user that authenticates gets logged in as the built in "admin" account.
Successful auth for LDAP user:
Apr 21 17:47:34 <IP_ADDRESS> ui[6016]: 2017-04-21T17:47:34Z [DEBUG] [authenticator.go:59]: Current AUTH_MODE is ldap_auth
Apr 21 17:47:34 <IP_ADDRESS> ui[6016]: 2017-04-21T17:47:34Z [DEBUG] [ldap.go:145]: one or more ldapFilter: (&(objectClass=*)(sAMAccountName=build))
Apr 21 17:47:34 <IP_ADDRESS> ui[6016]: 2017/04/21 17:47:34 #033[1;34m[router.go:829][D] | POST       | /login                                   | 62.183293ms      | match      | /login                                   | #033[0m

After authentication, the DEBUG messages in ui.log show this:
Apr 21 17:47:49 <IP_ADDRESS> ui[6016]: 2017-04-21T17:47:49Z [DEBUG] [base.go:132]: No valid user id in session.

and then:
Apr 21 17:47:49 <IP_ADDRESS> ui[6016]: 2017-04-21T17:47:49Z [DEBUG] [authutils.go:87]: user: admin, access: &{repository  test/delete [push * pull]}

perhaps this is related to #2034, and the lack of an allowance for sAMAccountName.  I notice all my LDAP (AD) users are showing up after logging in with no usernames listed

Hello,
Same issue and any valid user in my ldap scope gets loggued , even with a bad password.

@jaychris It should be caused by #2034 , and we will have a fix for this.

Closing this issue and tracking by #2034


Support self-install on Unix

Closes #10.

Closes #10!

I updated your description, but you need to put closing keywords in the main description in order for GitHub to pick them up. You can edit your PR at any time!

This PR appears to be taken verbatim from the Rustup source code. In the future, when contributing PRs to any project, you should include attribution for code that you did not write both in your PR body and in the source code, following the original code's license.
The upstream project, Rustup, is dual-licensed under the MIT and Apache-2.0 licenses. While it is possible to attribute this code to them and include an exception that some code in Aftman is owned by the authors of Rustup, I would rather keep this entire project under the same license.

Rustup's README says: "Licensed under either of Apache 2.0 or MIT at your option." so you can keep the MIT license, but I should indeed have added some attribution. Thanks!

Replaced by #16.


[SPARK-17005][SQL] fix method tpe in trait AnnotationApi is deprecated

https://issues.apache.org/jira/browse/SPARK-17005
What changes were proposed in this pull request?
Fix warning "method tpe in trait AnnotationApi is deprecated", replace tpe with tree.tpe
How was this patch tested?
Tested manually on local laptop

Test build #63569 has started for PR 14588 at commit 51eb810.

Actually.. I took a look for this as well before. It seems Annotation in Scala 2.10 does not have the tree function (see https://github.com/scala/scala/blob/2.10.x/src/reflect/scala/reflect/api/Annotations.scala#L72-L85) whereas Scala 2.11 does have https://github.com/scala/scala/blob/2.11.x/src/reflect/scala/reflect/api/Annotations.scala#L71.
Just to make sure, I tested this in a clean VM as below:
scala> import scala.reflect.runtime.universe._
import scala.reflect.runtime.universe._

scala> typeTag[String].tpe.typeSymbol.annotations.tree
<console>:14: error: value tree is not a member of List[reflect.runtime.universe.Annotation]
              typeTag[String].tpe.typeSymbol.annotations.tree

Test build #63569 has finished for PR 14588 at commit 51eb810.

This patch passes all tests.
This patch merges cleanly.
This patch adds no public classes.

Merged build finished. Test PASSed.

Test PASSed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/63569/
Test PASSed.

Please let me cc @srowen to make sure because I believe it is about building.

Oh I'm so sorry. It's breaking 2.10 anyway.
I'll double check scala version compatibility next time submitting a PR


Suggestion: Static modifiers for unique item

Right now all mods on unique lines are processed as ranged values. Most of the time, unique items have several static mods that do not change. This does not change any search results, but add to visual clutter.
Not something in need of urgent fix, but something to add to the agenda for polish.

This is related to #35


feat(ui): Theme builder render component in iframe

Description

Checklist

[ ] npm test runs as expected.
[ ] npm run build runs as expected.
[ ] (If applicable) JSDoc comments have been added or updated for any package exports
[ ] (If applicable) Documentation has been updated

Type of change

[ ] 🐛 Bug fix
[ ] 🌟 New feature
[ ] 🔨 Breaking change
[ ] 📖 Refactoring / dependency upgrade / documentation
[ ] other:

Closing for now, will revisit in the future. Would need to figure out how to get our components running in an iframe.


updateTimeDimension only works when layer is queryable

Hi, thanks for a great library! By looking at the source code, it seems like the updateTimeDimension = true will only work if the layer is set as queryable=1 in the getcapabilities. If it is set to 0, no times are returned. Is it somehow possible to bypass this and use updatetimedimension on non-queryable layers?

A hack/workaround would be to replace the parsing function.
This is a copy of the original without the 'queryable' requirement :
let parseTimeDimensionFromCapabilitiesFix =  function(xml) {

      //// old selector
      //// var layers = xml.querySelectorAll('Layer[queryable="1"]');

      //// new selector
        var layers = xml.querySelectorAll('Layer]');

        var layerName = this._baseLayer.wmsParams.layers;
        var layer = null, times = null;
        layers.forEach(function(current) {
            if (current.querySelector("Name").innerHTML === layerName)
                layer = current;
        })
        if (layer) {
            times = this._getTimesFromLayerCapabilities(layer);
            if (!times)
                times = this._getTimesFromLayerCapabilities(layer.parentNode);
        }
        return times;
}

Then replace the parser after creation :
let wmsTimeLayer = L.timeDimension.layer.wms( ... )
wmsTimeLayer._parseTimeDimensionFromCapabilities = parseTimeDimensionFromCapabilitiesFix;


Can't open edition after creation

Collection link link2
Testnet should be enabled.
Result:

Data:

It was possible to get to the page right after creation by clicking on the button, but after the refresh, it doesn't work anymore.

Temporary fixed with console log


Hello, @gabrieldemarmiesse.
First, thank you for this library. It looks awesome!
I have a use-case in which I need to build a docker image within a Python code, inside a Kubernetes cluster. I tried using DinD, but the node crashes and I found in the AKS that they don't support DinD and they suggest using buildx instead. So, I found you library and thought about using it to build the image with the buildx. I also noticed that downloads the docker binary, which is great. I was wondering if I could, within the Kubernetes cluster, call the docker.buildx.create() passing the driver="kubernetes" and build the image from there. I guess it would spawn a pod within the Kubernetes cluster that would handle the build, right?
I'm planning to try to do it soon, but I tried asking here first to see if I'm understanding things correctly. Thanks in advance.

Hello! This is a very technical question about buildx drivers. I've never used the buildx kubernetes driver myself. Python-on-whales is just a wrapper around the CLI, so anything the CLI can do, python-on-whales should be able to do it.
I think you should start by using the CLI and ask your question in the "docker/buildx" repo. If you manage to do what you want with bash, you should be able to do it with python-on-whales easily. Remove an abstraction layer first and see if it works. Then add python-on-whales on top of it.

Closing due to inactivity


Google analytics module not working on android, makes the app crash with  ti 3.5.1 sdk

[ERROR] : TiApplication: (KrollRuntimeThread) [29,111] Sending event: exception on thread: KrollRuntimeThread msg:java.lang.UnsatisfiedLinkError: Couldn't load analytics.google from loader dalvik.system.PathClassLoader[DexPathList[[zip file "/data/app/com.company.myapp-2.apk"],nativeLibraryDirectories=[/data/app-lib/com.company.myapp-2, /system/lib]]]: findLibrary returned null; Titanium 3.5.0,2015/01/12 15:33,0014f83
[ERROR] : TiApplication: java.lang.UnsatisfiedLinkError: Couldn't load analytics.google from loader dalvik.system.PathClassLoader[DexPathList[[zip file "/data/app/com.company.myapp-2.apk"],nativeLibraryDirectories=[/data/app-lib/com.company.myapp-2, /system/lib]]]: findLibrary returned null
[ERROR] : TiApplication: at java.lang.Runtime.loadLibrary(Runtime.java:358)
[ERROR] : TiApplication: at java.lang.System.loadLibrary(System.java:526)
[ERROR] : TiApplication: at org.appcelerator.kroll.runtime.v8.V8Runtime.loadExternalModules(V8Runtime.java:132)
[ERROR] : TiApplication: at org.appcelerator.kroll.runtime.v8.V8Runtime.initRuntime(V8Runtime.java:99)
[ERROR] : TiApplication: at org.appcelerator.kroll.KrollRuntime.doInit(KrollRuntime.java:185)
[ERROR] : TiApplication: at org.appcelerator.kroll.KrollRuntime$KrollRuntimeThread.run(KrollRuntime.java:109)
Also, If you can help us with the libs folder for android module ,as it is not available in this repository.Please help asap.Thanks in advance

Are you sure you're including the module properly. What does your modules folder look like?
I'm also not sure what you mean by the libs folder. Really, all you need to do is unzip the release zip file into the root of your project folder and make an entry in your tiapp.xml file.

@astjohn : thanks for quick reply.It's working well in iOS. But android version of the app is crashing. I have manually copied the modules folder to application support->titanium->android folder in mac.


fix the time of ca files are changed in make-ssl-etcd

Hi author,
The file time of ca.pem and ca-key.pem are always changed when running deployment every time, even if It does not produce new ca.
Because mv *.pem $SSLDIR}/ contains ca.pem and ca-key.pem,  the time of ca.pem and ca-key.pem in /etc/ssl/etcd/ssl are always changed. This may have other effects.
When $SSLDIR/ca-key.pem exists, we should rm ca.pem and ca-key.pem before mv operation.
Please review this bug fix and other bug fixes #2921 , #2918 , because I have no CI-auth.
Thanks!

ci check this

Thanks, ci is running.

Hi @riverzhang ,
ci has passed. Please check it.
Thanks!

ci has passed, but I haven't merging auth yet.

the time of ca.pem and ca-key.pem in /etc/ssl/etcd/ssl are always changed.  why?

althouth the content of these files are the same, but the time is different, because they are copied every time.

Is there any problem with the timing of the certificate?

maybe there are some problem, e.g. some programs should check certs status.
By the way, we should not copy certs everytime ,even if the certs are not changed.

https://github.com/kubernetes-incubator/kubespray/blob/master/roles/etcd/files/make-ssl-etcd.sh#L62  There is already a judgment , your changes have not changed anything.

no, this position that checking CA is about copy ca-certs to local, but the position before mv operation is about rm local certs, so that they are not copied to /etc/ssl/etc/ssl again.

If you copy to /etc/ssl, the time of the certificate and certificate does not change.

It does, I test it locally.

cc @mattymo

It's time to sleep. I'm sure that this place has problem, and I have already test it locally.
We should rm the front copied ca-certs before mv operation.
Please check it again.
Thanks!
See you next time.

@mattymo @riverzhang
Please review my issue #2936 Recover master cluster.
Thanks!


config_file_userdata and string_list are compiled twice

https://github.com/libretro/libretro-chailove/blob/ae27c0bc0a591653b8a8510f85801d536dc699ac/Makefile.common#L39-L49
This leads to multiple redefinition errors on Android.

AH!!!! That'd do it. Good eye, thanks so much!


samples: Bluetooth: mesh_demo: Increase ISR_STACK_SIZE value

Split Link Layer implementation uses 80 bytes more ISR stack
in comparison to Legacy Link Layer, hence increase the
required ISR_STACK_SIZE for the BBB micro:bit mesh_demo
sample.
Fixes #20414.
Signed-off-by: Vinayak Kariappa Chettimada<EMAIL_ADDRESS>

@WilliamGFish FYI, fixes #20414

Wouldn't it make more sense to increase the default for the SoC/board so that any app using it gets the right value? Or is there something special about this particular app that makes for a unique requirement?

The required max ISR stack size is 424 bytes for peripheral and central, which dont use other peripherals ISRs.
The default ISR_STACK_SIZE is 2048 for the ARM arch, which was being overridden for BBC micro:bit to 640 bytes.
As ISR stack size is dependent on applications use of nested IRQ priorities and implementation inside such ISR callbacks (in mesh_demo, the button_pressed), the total stack size is best defined by samples.

I forgot to ask: is this something we'd want to backport to 2.1.1?


"System.AggregateException" Error

Acknowledgement of preliminary instructions

[X] I have read the preliminary instructions, and I am certain that my problem has not already been addressed.
[X] I have thoroughly looked through the available Wiki articles and could not find a solution to my problem.
[X] I am using the latest version of Bloxstrap.
[ ] I did not answer truthfully to all the above checkboxes.

What problem did you encounter?
I was trying to log on to a game as usual but then I've shown this error

I took a look at the logs and apparently it had to do with my fastflags or something, I'm still new to this.
This never happened before even after I put my desired fastflags months ago until now. I have searched in the Wiki to see if there's any relevant issues, the closest thing I found is the page about TaskCanceledException error but I have checked my internet connection and disabled any antivirus I had.
Bloxstrap Log
Bloxstrap_20241009T072131Z.log

I have this exact issue, it just fine yesterday evening

https://github.com/bloxstraplabs/bloxstrap/wiki/"Deserialised-application-settings-is-null!"-when-launching-Roblox


template for managing unresponsive data source on the web

Is your feature request related to a problem? Please describe.
Most of the component are searching data on Internet. Suggesting in the blueprint a best practice to manage when the data source is unresponsive to avoid WARNINGS or ERROR could help the newcomer in plugin development.
Describe the solution you'd like
Open to best practices.
Additional context
N/A

Can you elaborate?
If the service is not responsive the data is not updated, and an error should be thrown.
By using the current example, that will happen.
https://github.com/custom-components/blueprint/blob/a7d67066d474109c535b9a495b08288dd0e04081/custom_components/blueprint/__init__.py#L196-L200

In the Integration Quality Scale we can read for silver level:

Handles internet unavailable. Log a warning once when unavailable, log once when reconnected.

So I imagine the best practice should be: if the remote data source is unavailable or return an unexpected answer, the python module can raise an error but the component should:

catch it,
set the entity to unavailable or keep the previous state only if consistent (keeping weather forecast is consistent, keeping open/close door sensor state is not according to me),
raise a warning in HA logs
test regularly if the remote data source issue is solved
when solved, log it (warning or info level ?), update the entity and resume normal behavior

Does it make sense ?

DataUpdateCoordinator Does that, which is now implemented in this project


Documentation for Silent Flow (readme.md)

Core Library
MSAL Node (@azure/msal-node)
Wrapper Library
Not Applicable
Public or Confidential Client?
Confidential
Documentation Location
https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-node-samples/silent-flow
Description
The landing page for the Silent Flow is absent in the repository, there is one for the Refresh Token. This would be useful to have here as well.
In addition, after I've been a bit frustrated around not being able to easily access the refresh token and basically being left with using the silent flow, I've started thinking how to best leverage this.
The issue is around the in-memory cache and that the entire refresh process is done for me, however this becomes a problem if I horizontally scale my application as the cache is not distributed and I have to manually manage this. Initially I thought about a centralized cache that would get updated on each request (in case of a token refresh).
Afterwards I thought about initializing the related objects for each request and to serialize/deserialize the cache per account and maintain that somewhere (Azure Table Storage, Blob Storage, Redis Cache, whichever works as they associated a key (the account unique ID) and a string value which is the serialized cache just for that account). With this approach MSAL Node can do its job and not have to deal conflicting cache changes and so on as it would be spread per account. On logout I would clear the MSAL cache specific to that account.
There probably are other approaches to this, I would like to have this documented and have the horizontal scaling taken into consideration as it can become a problem. Another alternative is to provide a way to plug into the cache for a particular account thus allowing for account-specific actions before and after accessing the cache. Currently, this can only be done at the cache level. This would allow for a configuration at the application level, but the approach I thought about can create closures around the account ID and retrieve that through the current plugin mechanism since each request instantiates the related objects.

Hi @Andrei15193, can you give us more details about your scenario? Are you using a web site (AcquireTokenByAuthorizationCode) or a web api (AcquireTokenOnBehalfOf) ?

Hi @bgavrilMS @derisen,
I'm using a web site, it's basically a classic multi-page web application and I'm using the confidential application to authorize by code (acquireTokenByCode) and afterwards I ended up using acquireTokenSilent to recheck the user.
After thinking more about it I think this is the way it is meant to be used actually, please correct me if I am wrong. acquireTokenSilent handles the authentication checks and refreshes making it the one stop for all private routes/endpoints. It checks the validity of the token as well as refreshing it if it expired. If a token cannot be (re)acquired, then you know the user no longer has access to that page/endpoint.
The other methods, such as acquireTokenByCode, are used exclusively for beginning an authenticated user session (up until that point they are a guest since we don't really know who they are) and similarly we have the logout flow that ends the authenticated user session.
In my case, each time a route is hit I use acquireTokenSilent to check if the user is authenticated. The issue comes if I want to horizontally scale my application because in that case an in-memory cache will not do unless I turn ARR affinity on. If I use a distributed cache that holds all the information in a single blob then I end up with concurrency issues as theoretically multiple requests can access the same resource (cache) and potentially update it, I'd need to lock the resource to ensure it remains consistent.
What I ended up doing is something similar to what you have linked. I stored userId and sessionId (generated upon successful authentication) pairs into Azure Table Storage (I'm already using this service, Redis cache would do the trick but at this point I'd need to create an instance) and basically serialize the cache just for that authenticated user session. Before I call acquireTokenSilent I retrieve the cache information and deserialize and afterwards I serialize and save it back to Azure Table Storage. This ensures I can horizontally scale the application and that the risk of conflicting cache changes is almost non-existent. If there is a conflict, it's for that particular authenticated user session only and all other users are not affected. It should work for all normal scenarios even under high stress (I'm not really expecting this, the initial design challenge came from being able to horizontally scale the application without having to turn on ARR affinity).
The userId and sessionId are passed to the browser through HTTP only, signed, secure, and same site lax cookies (should provide plenty of security, the tokenId and token claims never get to the browser). I get that information back whenever I call acquireTokenSilent.
I haven't pushed the code yet to showcase exactly how I approached this; I'm still working on some finishing touches. But what I described above is the approach I've picked in the end. Please let me know if you have any inputs about it, it's greatly appreciated 🙂

Hi @Andrei15193 -a couple of remarks:

Hi @bgavrilMS @derisen,
I'm using a web site, it's basically a classic multi-page web application and I'm using the confidential application to authorize by code (acquireTokenByCode) and afterwards I ended up using acquireTokenSilent to recheck the user.
After thinking more about it I think this is the way it is meant to be used actually, please correct me if I am wrong. acquireTokenSilent handles the authentication checks and refreshes making it the one stop for all private routes/endpoints. It checks the validity of the token as well as refreshing it if it expired. If a token cannot be (re)acquired, then you know the user no longer has access to that page/endpoint.

Using acquireTokenSilent to check authentication status in your app's routes doesn't strike me as correct usage of this API. acquireToken* APIs are primarily for acquiring an access token for some other resource, such as a web API that your web app calls (although acquireToken* also happen to return you an ID token). It would work, but I don't think it's efficient. Protocol-wise, the ID token is the proof that your user has authenticated to your app (i.e. your app has information about who this user is). I would instead rely on a session cookie for authentication status checks in routes (which, in a horizontal scaling scenario, should be saved either client side or in a shared store like Redis etc.), and set an expiry for the cookie based on the ID token expiry. When the session expires, the user should be taken to Azure AD to re-establish a user session (which would return you a new ID token).

The other methods, such as acquireTokenByCode, are used exclusively for beginning an authenticated user session (up until that point they are a guest since we don't really know who they are) and similarly we have the logout flow that ends the authenticated user session.

acquireTokenByCode acquires you an access token (and an ID token) by exchanging an authorization code. By the time you would use acquireTokenByCode, you would already have an established session with Azure AD (this is what the first leg of this flow, getAuthCodeUrl > navigate to that auth code url does). Also, when you are using acquireTokenBySilent, you should always handle any interactionRequiredAuthError exceptions with acquireTokenByCode (just in case).

In my case, each time a route is hit I use acquireTokenSilent to check if the user is authenticated. The issue comes if I want to horizontally scale my application because in that case an in-memory cache will not do unless I turn ARR affinity on. If I use a distributed cache that holds all the information in a single blob then I end up with concurrency issues as theoretically multiple requests can access the same resource (cache) and potentially update it, I'd need to lock the resource to ensure it remains consistent.
What I ended up doing is something similar to what you have linked. I stored userId and sessionId (generated upon successful authentication) pairs into Azure Table Storage (I'm already using this service, Redis cache would do the trick but at this point I'd need to create an instance) and basically serialize the cache just for that authenticated user session. Before I call acquireTokenSilent I retrieve the cache information and deserialize and afterwards I serialize and save it back to Azure Table Storage. This ensures I can horizontally scale the application and that the risk of conflicting cache changes is almost non-existent. If there is a conflict, it's for that particular authenticated user session only and all other users are not affected. It should work for all normal scenarios even under high stress (I'm not really expecting this, the initial design challenge came from being able to horizontally scale the application without having to turn on ARR affinity).

That's pretty much what we did in the distributed caching sample with Redis: RedisTestApp. Feel free to let us know your experience and findings -we would really appreciate input on scaling scenarios!

Hi @Andrei15193 -a couple of remarks:

Hi @bgavrilMS @derisen,
I'm using a web site, it's basically a classic multi-page web application and I'm using the confidential application to authorize by code (acquireTokenByCode) and afterwards I ended up using acquireTokenSilent to recheck the user.
After thinking more about it I think this is the way it is meant to be used actually, please correct me if I am wrong. acquireTokenSilent handles the authentication checks and refreshes making it the one stop for all private routes/endpoints. It checks the validity of the token as well as refreshing it if it expired. If a token cannot be (re)acquired, then you know the user no longer has access to that page/endpoint.

Using acquireTokenSilent to check authentication status in your app's routes doesn't strike me as correct usage of this API. acquireToken* APIs are primarily for acquiring an access token for some other resource, such as a web API that your web app calls (although acquireToken* also happen to return you an ID token). It would work, but I don't think it's efficient. Protocol-wise, the ID token is the proof that your user has authenticated to your app (i.e. your app has information about who this user is). I would instead rely on a session cookie for authentication status checks in routes (which, in a horizontal scaling scenario, should be saved either client side or in a shared store like Redis etc.), and set an expiry for the cookie based on the ID token expiry. When the session expires, the user should be taken to Azure AD to re-establish a user session (which would return you a new ID token).

This makes sense. I have not thought about this.
The issue I was trying to resolve with acquireTokenSilent is to ensure the user session is active with Azure AD and get a new token (cached or refreshed) to check this. Basically, as long as the user is active on the web site clicking on things and making requests just by navigating then I don't want to redirect them to a login page even if they have been doing this for 3 hours. If they remain inactive for 1 hour, or 30 minutes even, then their session has expired and need to reauthenticate.
But since using a session cookie to check the authentication status of the user is required in any approach then at the application level having that session ID is proof of authentication by extension, it only gets generated when I get a favourable response from acquireTokenByCode and it gets cleared on sign out (both from the cache service and cookie + the call to Azure AD).
While the user is active on the web site, I can keep resetting the session cookie expiration so it will always be 30 minutes since the last interaction which will in turn be able to keep the session active for 3 hours if the user keeps clicking on stuff. I'm already keeping track of user session in Azure Table Storage, I can basically dump any information about the user that I get from Azure AD when I call acquireTokenByCode and not have to worry about getting more information from the token itself. If it was issued, then the user can use the app for as long as the session cookie is kept active and there is a corresponding entity in Azure Table Storage for that session in particular (admins may be able to log people out just by removing that entity).
In this case I don't need to use acquireTokenSilent at all, and the entire cache serialization/deserialization doesn't need to happen. Simplifies things quite a bit actually now that I think more about it. I was fixated on the refresh token.

The other methods, such as acquireTokenByCode, are used exclusively for beginning an authenticated user session (up until that point they are a guest since we don't really know who they are) and similarly we have the logout flow that ends the authenticated user session.

acquireTokenByCode acquires you an access token (and an ID token) by exchanging an authorization code. By the time you would use acquireTokenByCode, you would already have an established session with Azure AD (this is what the first leg of this flow, getAuthCodeUrl > navigate to that auth code url does). Also, when you are using acquireTokenBySilent, you should always handle any interactionRequiredAuthError exceptions with acquireTokenByCode (just in case).

I have not thought about interactionRequiredAuthError and didn't cover it. With the initial approach it would be the same as not finding a serialized cache for that session, still had to cover the case though.

In my case, each time a route is hit I use acquireTokenSilent to check if the user is authenticated. The issue comes if I want to horizontally scale my application because in that case an in-memory cache will not do unless I turn ARR affinity on. If I use a distributed cache that holds all the information in a single blob then I end up with concurrency issues as theoretically multiple requests can access the same resource (cache) and potentially update it, I'd need to lock the resource to ensure it remains consistent.
What I ended up doing is something similar to what you have linked. I stored userId and sessionId (generated upon successful authentication) pairs into Azure Table Storage (I'm already using this service, Redis cache would do the trick but at this point I'd need to create an instance) and basically serialize the cache just for that authenticated user session. Before I call acquireTokenSilent I retrieve the cache information and deserialize and afterwards I serialize and save it back to Azure Table Storage. This ensures I can horizontally scale the application and that the risk of conflicting cache changes is almost non-existent. If there is a conflict, it's for that particular authenticated user session only and all other users are not affected. It should work for all normal scenarios even under high stress (I'm not really expecting this, the initial design challenge came from being able to horizontally scale the application without having to turn on ARR affinity).

That's pretty much what we did in the distributed caching sample with Redis: RedisTestApp. Feel free to let us know your experience and findings -we would really appreciate input on scaling scenarios!

Some of it I did get right, hehe 🙂

This makes sense. I have not thought about this.
The issue I was trying to resolve with acquireTokenSilent is to ensure the user session is active with Azure AD and get a new token (cached or refreshed) to check this. Basically, as long as the user is active on the web site clicking on things and making requests just by navigating then I don't want to redirect them to a login page even if they have been doing this for 3 hours. If they remain inactive for 1 hour, or 30 minutes even, then their session has expired and need to reauthenticate.
But since using a session cookie to check the authentication status of the user is required in any approach then at the application level having that session ID is proof of authentication by extension, it only gets generated when I get a favourable response from acquireTokenByCode and it gets cleared on sign out (both from the cache service and cookie + the call to Azure AD).
While the user is active on the web site, I can keep resetting the session cookie expiration so it will always be 30 minutes since the last interaction which will in turn be able to keep the session active for 3 hours if the user keeps clicking on stuff. I'm already keeping track of user session in Azure Table Storage, I can basically dump any information about the user that I get from Azure AD when I call acquireTokenByCode and not have to worry about getting more information from the token itself. If it was issued, then the user can use the app for as long as the session cookie is kept active and there is a corresponding entity in Azure Table Storage for that session in particular (admins may be able to log people out just by removing that entity).

More or less, but in general I would recommend not to go beyond the ID token expiry time, since there could be changes to user's status,  account info or tenant's policies and your app might be out of sync with that. I would also not expire the session too soon -since its bad user experience and unnecessary load on Azure AD. Probably best to be selective about it -certain pages may contain sensitive info and may require re-authentication, while others can be more lax about it. There are also other Azure AD mechanisms like step-up authentication and the OIDC max_age request parameter that gives you more fine-grained control over this.

More or less, but in general I would recommend not to go beyond the ID token expiry time, since there could be changes to user's status, account info or tenant's policies and your app might be out of sync with that. I would also not expire the session too soon -since its bad user experience and unnecessary load on Azure AD. Probably best to be selective about it -certain pages may contain sensitive info and may require re-authentication, while others can be more lax about it. There are also other Azure AD mechanisms like step-up authentication and the OIDC max_age request parameter that gives you more fine-grained control over this.

Makes sense, in this case I could still use acquireTokenByCode and force a token refresh when the session is close to expire so the user would be prompted to re-authenticate only if it is necessary.

@Andrei15193 You can use the forceRefresh parameter in the request object to skip a cached token and go to the service to renew them. In general try to follow the pattern:
try {
      // attempt silent
      const response = await msal.acquireTokenSilent(request)
} catch(error) {
      if (error instanceof InteractionRequiredAuthError) {
              // acquire token interactively
      }

     // handle other errors
}

Make sure to get yourself familar with this doc (this is for msal-browser, but mostly applies to msal-node as well).
Closing this, but feel free to raise another issue if you have other questions!


Update packaging with Poetry

Really looks cool !

Finally i am not that convinced. I won't use it for this package.


CVE-2021-35065 High) detected in glob-parent

Title:
glob-parent before 6.0.1 and 5.1.2 vulnerable to Regular Expression Denial of Service (ReDoS)
Inefficient Regular Expression Complexity
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service
Description:
glob-parent before 6.0.1 and 5.1.2 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1 and 5.1.2.
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
glob-parent 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1.
This vulnerability is separate from GHSA-ww39-953v-wcq6.
https://advisories.aws.barahmand.com/advisory/CVE-2021-35065

need to update to 6.0.2 https://nvd.nist.gov/vuln/detail/CVE-2021-35065

resolved in https://github.com/opensearch-project/dashboards-search-relevance/pull/107


[type:feature] Make Maven CI Friendly Versions

// Describe your PR here; eg. Fixes #issueNo
Currently version segment is defined in every pom.xml.
Every version segment should be synchronized if there is any change.
This PR has resolved it, by defined a properties '' in the pom.xml of parent module 'shenyu'. like following image:

Make sure that:

[x] You have read the contribution guidelines.
[x] Your local test passed mvn clean install -Dmaven.javadoc.skip=true.

Codecov Report

Merging #2784 (113e3fd) into master (5f4aacb) will decrease coverage by 0.14%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##             master    #2784      +/-   ##
============================================
- Coverage     60.03%   59.89%   -0.15%
+ Complexity     4418     4413       -5
============================================
  Files           685      685
  Lines         19697    19695       -2
  Branches       1748     1748
============================================
- Hits          11826    11797      -29
- Misses         6873     6896      +23
- Partials        998     1002       +4

Impacted Files
Coverage Δ

...che/shenyu/sync/data/http/HttpSyncDataService.java
63.23% <0.00%> (-14.71%)
:arrow_down:

...a/org/apache/shenyu/common/utils/VersionUtils.java
67.85% <0.00%> (-10.72%)
:arrow_down:

...apache/shenyu/admin/utils/ShenyuDictH2Trigger.java
63.63% <0.00%> (-9.10%)
:arrow_down:

...ache/shenyu/admin/utils/PluginHandleH2Trigger.java
63.63% <0.00%> (-9.10%)
:arrow_down:

...in/response/strategy/NettyClientMessageWriter.java
69.56% <0.00%> (-4.35%)
:arrow_down:

...henyu/plugin/httpclient/NettyHttpClientPlugin.java
53.84% <0.00%> (-1.93%)
:arrow_down:

...pache/shenyu/agent/core/yaml/ShenyuYamlEngine.java
92.85% <0.00%> (-0.90%)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5f4aacb...113e3fd. Read the comment docs.

find has already some other way to update version plugin ‘versions-maven-plugin’，so close this PR


Wordpress Fatal Error when editing or adding a new WooCommerce Coupon (marketing->coupon)

For some reason I get this when trying to add or edit Coupons. Any ideas?
Fatal error: Uncaught Error: Call to undefined method WP_Post::get_payment_method() in /..../wp-content/plugins/swedbank-pay-checkout/includes/class-wc-swedbank-admin.php:69 Stack trace: #0 /...../wp-includes/class-wp-hook.php(308): SwedbankPay\Checkout\WooCommerce\WC_Swedbank_Admin::add_meta_boxes() #1 /....../wp-includes/class-wp-hook.php(332): WP_Hook->apply_filters() #2 /....../wp-includes/plugin.php(517): WP_Hook->do_action() #3 /......./wp-admin/includes/meta-boxes.php(1599): do_action() #4 /......./wp-admin/edit-form-advanced.php(271): register_and_do_post_meta_boxes() #5 /..../wp-admin/post.php(206): require('/.....') #6 {main} thrown in /...../wp-content/plugins/swedbank-pay-checkout/includes/class-wc-swedbank-admin.php on line 69

Please send access details by email<EMAIL_ADDRESS>

Confirming fix - now working fine. Thank you!