flyway in Amazon ECR yields security vulnerability findings from CoreOS Clair

Which version and edition of Flyway are you using?
flyway/flyway:6.3 from docker hub.
If this is not the latest version, can you reproduce the issue with the latest one as well?
N/A
Which client are you using? (Command-line, Java API, Maven plugin, Gradle plugin)
N/A
Which database are you using (type & version)?
N/A
Which operating system are you using?
N/A
What did you do?
We are experimenting with using flyway in docker as an ECS service to manage database migration operations. With image scanning enabled the scanning engine is CoreOS Clair.
What did you expect to see?
No reported vulnerabilities.
What did you see instead?
ECR reports 17 Medium, 27 Low, and 12 Informational findings.
Vulnerabilities
{
    "imageScanFindings": {
        "findings": [
            {
                "name": "CVE-2018-11236",
                "description": "stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-11236",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "7.5"
                    }
                ]
            },
            {
                "name": "CVE-2018-11237",
                "description": "An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-11237",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.6"
                    }
                ]
            },
            {
                "name": "CVE-2018-19591",
                "description": "In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-19591",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2018-20217",
                "description": "A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20217",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.16-2ubuntu0.1"
                    },
                    {
                        "key": "package_name",
                        "value": "krb5"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:S/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "3.5"
                    }
                ]
            },
            {
                "name": "CVE-2019-9511",
                "description": "Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9511",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.30.0-1ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "nghttp2"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:C"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "7.8"
                    }
                ]
            },
            {
                "name": "CVE-2019-9513",
                "description": "Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9513",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.30.0-1ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "nghttp2"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:C"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "7.8"
                    }
                ]
            },
            {
                "name": "CVE-2019-19926",
                "description": "multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-19926",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2019-19923",
                "description": "flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-19923",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2019-13734",
                "description": "Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13734",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "6.8"
                    }
                ]
            },
            {
                "name": "CVE-2019-19925",
                "description": "zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-19925",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2019-19959",
                "description": "ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-19959",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2019-13750",
                "description": "Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13750",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.3"
                    }
                ]
            },
            {
                "name": "CVE-2019-13753",
                "description": "Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13753",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.3"
                    }
                ]
            },
            {
                "name": "CVE-2019-13751",
                "description": "Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13751",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.3"
                    }
                ]
            },
            {
                "name": "CVE-2019-13752",
                "description": "Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13752",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.3"
                    }
                ]
            },
            {
                "name": "CVE-2020-9327",
                "description": "In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-9327",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2018-20839",
                "description": "systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20839",
                "severity": "MEDIUM",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "237-3ubuntu10.39"
                    },
                    {
                        "key": "package_name",
                        "value": "systemd"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2019-18276",
                "description": "An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-18276",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "4.4.18-2ubuntu1.2"
                    },
                    {
                        "key": "package_name",
                        "value": "bash"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:L/Au:N/C:C/I:C/A:C"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "7.2"
                    }
                ]
            },
            {
                "name": "CVE-2016-2781",
                "description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2781",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "8.28-1ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "coreutils"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:L/Au:N/C:N/I:P/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "2.1"
                    }
                ]
            },
            {
                "name": "CVE-2009-5155",
                "description": "In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2009-5155",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2015-8985",
                "description": "The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-8985",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.3"
                    }
                ]
            },
            {
                "name": "CVE-2016-10739",
                "description": "In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-10739",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.6"
                    }
                ]
            },
            {
                "name": "CVE-2019-9169",
                "description": "In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9169",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "7.5"
                    }
                ]
            },
            {
                "name": "CVE-2019-13050",
                "description": "Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13050",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.2.4-1ubuntu1.2"
                    },
                    {
                        "key": "package_name",
                        "value": "gnupg2"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2019-14855",
                "description": "Web of Trust forgeries using collisions in SHA-1 signatures.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-14855",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.2.4-1ubuntu1.2"
                    },
                    {
                        "key": "package_name",
                        "value": "gnupg2"
                    }
                ]
            },
            {
                "name": "CVE-2018-16868",
                "description": "A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16868",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.5.18-1ubuntu1.3"
                    },
                    {
                        "key": "package_name",
                        "value": "gnutls28"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "3.3"
                    }
                ]
            },
            {
                "name": "CVE-2019-12098",
                "description": "In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-12098",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "7.5.0+dfsg-1"
                    },
                    {
                        "key": "package_name",
                        "value": "heimdal"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:P/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5.8"
                    }
                ]
            },
            {
                "name": "CVE-2019-12904",
                "description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-12904",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.8.1-4ubuntu1.2"
                    },
                    {
                        "key": "package_name",
                        "value": "libgcrypt20"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.3"
                    }
                ]
            },
            {
                "name": "CVE-2018-14048",
                "description": "An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-14048",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.6.34-1ubuntu<IP_ADDRESS>"
                    },
                    {
                        "key": "package_name",
                        "value": "libpng1.6"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.3"
                    }
                ]
            },
            {
                "name": "CVE-2019-17543",
                "description": "LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-17543",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "0.0~r131-2ubuntu3"
                    },
                    {
                        "key": "package_name",
                        "value": "lz4"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "6.8"
                    }
                ]
            },
            {
                "name": "CVE-2018-16869",
                "description": "A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16869",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.4-1"
                    },
                    {
                        "key": "package_name",
                        "value": "nettle"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "3.3"
                    }
                ]
            },
            {
                "name": "CVE-2017-14159",
                "description": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-14159",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.4.45+dfsg-1ubuntu1.4"
                    },
                    {
                        "key": "package_name",
                        "value": "openldap"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "1.9"
                    }
                ]
            },
            {
                "name": "CVE-2019-1549",
                "description": "OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1549",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.1.1-1ubuntu2.1~18.04.5"
                    },
                    {
                        "key": "package_name",
                        "value": "openssl"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2019-1563",
                "description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1563",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.1.1-1ubuntu2.1~18.04.5"
                    },
                    {
                        "key": "package_name",
                        "value": "openssl"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.3"
                    }
                ]
            },
            {
                "name": "CVE-2019-1547",
                "description": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1547",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.1.1-1ubuntu2.1~18.04.5"
                    },
                    {
                        "key": "package_name",
                        "value": "openssl"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:M/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "1.9"
                    }
                ]
            },
            {
                "name": "CVE-2019-1551",
                "description": "There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e-dev (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u-dev (Affected 1.0.2-1.0.2t).",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1551",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.1.1-1ubuntu2.1~18.04.5"
                    },
                    {
                        "key": "package_name",
                        "value": "openssl"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2017-11164",
                "description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-11164",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2:8.39-9"
                    },
                    {
                        "key": "package_name",
                        "value": "pcre3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:C"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "7.8"
                    }
                ]
            },
            {
                "name": "CVE-2018-7169",
                "description": "An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-7169",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1:4.5-1ubuntu2"
                    },
                    {
                        "key": "package_name",
                        "value": "shadow"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2013-4235",
                "description": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2013-4235",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1:4.5-1ubuntu2"
                    },
                    {
                        "key": "package_name",
                        "value": "shadow"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:M/Au:N/C:N/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "3.3"
                    }
                ]
            },
            {
                "name": "CVE-2019-19645",
                "description": "alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-19645",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "2.1"
                    }
                ]
            },
            {
                "name": "CVE-2019-20218",
                "description": "selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-20218",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2019-19603",
                "description": "SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-19603",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "3.22.0-1ubuntu0.2"
                    },
                    {
                        "key": "package_name",
                        "value": "sqlite3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2018-20482",
                "description": "GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20482",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.29b-2ubuntu0.1"
                    },
                    {
                        "key": "package_name",
                        "value": "tar"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "1.9"
                    }
                ]
            },
            {
                "name": "CVE-2019-9923",
                "description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9923",
                "severity": "LOW",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.29b-2ubuntu0.1"
                    },
                    {
                        "key": "package_name",
                        "value": "tar"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2017-8283",
                "description": "dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-8283",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "<IP_ADDRESS>ubuntu2.3"
                    },
                    {
                        "key": "package_name",
                        "value": "dpkg"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "7.5"
                    }
                ]
            },
            {
                "name": "CVE-2019-7309",
                "description": "In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-7309",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "2.1"
                    }
                ]
            },
            {
                "name": "CVE-2019-9192",
                "description": "** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2016-10228",
                "description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-10228",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.3"
                    }
                ]
            },
            {
                "name": "CVE-2018-20796",
                "description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.27-3ubuntu1"
                    },
                    {
                        "key": "package_name",
                        "value": "glibc"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2018-5709",
                "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "1.16-2ubuntu0.1"
                    },
                    {
                        "key": "package_name",
                        "value": "krb5"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5"
                    }
                ]
            },
            {
                "name": "CVE-2018-1000654",
                "description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-1000654",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "4.13-2"
                    },
                    {
                        "key": "package_name",
                        "value": "libtasn1-6"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:N/I:N/A:C"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "7.1"
                    }
                ]
            },
            {
                "name": "CVE-2019-17594",
                "description": "There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-17594",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "6.1-1ubuntu1.18.04"
                    },
                    {
                        "key": "package_name",
                        "value": "ncurses"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "4.6"
                    }
                ]
            },
            {
                "name": "CVE-2019-17595",
                "description": "There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-17595",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "6.1-1ubuntu1.18.04"
                    },
                    {
                        "key": "package_name",
                        "value": "ncurses"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "5.8"
                    }
                ]
            },
            {
                "name": "CVE-2017-7245",
                "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-7245",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2:8.39-9"
                    },
                    {
                        "key": "package_name",
                        "value": "pcre3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "6.8"
                    }
                ]
            },
            {
                "name": "CVE-2017-7246",
                "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-7246",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2:8.39-9"
                    },
                    {
                        "key": "package_name",
                        "value": "pcre3"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "6.8"
                    }
                ]
            },
            {
                "name": "CVE-2018-7738",
                "description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
                "uri": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-7738",
                "severity": "INFORMATIONAL",
                "attributes": [
                    {
                        "key": "package_version",
                        "value": "2.31.1-0.4ubuntu3.5"
                    },
                    {
                        "key": "package_name",
                        "value": "util-linux"
                    },
                    {
                        "key": "CVSS2_VECTOR",
                        "value": "AV:L/AC:L/Au:N/C:C/I:C/A:C"
                    },
                    {
                        "key": "CVSS2_SCORE",
                        "value": "7.2"
                    }
                ]
            }
        ],
        "imageScanCompletedAt": "2020-03-24T11:46:08-07:00",
        "vulnerabilitySourceUpdatedAt": "2020-03-24T04:52:28-07:00",
        "findingSeverityCounts": {
            "MEDIUM": 17,
            "INFORMATIONAL": 12,
            "LOW": 27
        }
    },
    "registryId": "REDACTED",
    "repositoryName": "REDACTED",
    "imageId": {
        "imageDigest": "REDACTED",
        "imageTag": "REDACTED"
    },
    "imageScanStatus": {
        "status": "COMPLETE",
        "description": "The scan was completed successfully."
    }
}

All these vulnerabilities are coming from the ubuntu image the java image we use pulls in. Once that java image updates, we will pull in the latest version, hopefully removing all these vulnerabilities.

This should be resolved as we have updated the ubuntu image.


Instance: SlicerMorph 101, Cristina Cox

Cloud Computing Instance Flavor
g3.xl - GPU instance (32 CPUs, 125 GB RAM and A100 GPU)
Description
Attending the SlicerMorph 101 short course December 2nd to 5th
ORCID
0000-0002-9670-8198
Email
U2FsdGVkX18GeulrzgY0dkFax2Qqm6YeBX2+si4iCPmG/kEh1jxfHosh3o680k26
Confirm Email
U2FsdGVkX18GeulrzgY0dkFax2Qqm6YeBX2+si4iCPmG/kEh1jxfHosh3o680k26

/create

/UNSHELVE
On Sat, Nov 30, 2024 at 10:02 AM github-actions[bot] <
@.***> wrote:

Command Results ✅
encode_email command successfully applied to this issue.
—
Reply to this email directly, view it on GitHub
https://github.com/MorphoCloud/MorphoCloudInstances/issues/84#issuecomment-2508988234,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/BNLCOVRKXJZ5JM6HCATZH2T2DHHP7AVCNFSM6AAAAABSYTQPM6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMBYHE4DQMRTGQ
.
You are receiving this because you authored the thread.Message ID:
@.***>

--
Cristina Cox Fernandes, Ph.D.
Adjunct Research Associate Professor
Biology Department
University of Massachusetts, Amherst
MA 01003-0000
Fish Curator
http://onlinelibrary.wiley.com/journal/10.1002/(ISSN)1520-6505UMass
Natural History Collections
https://sites.google.com/view/umassnhc/home
PPG-Biologia de Água Doce e Pesca Interior, Docente
Instituto Nacional de Pesquisas da Amazônia
Av. André Araújo Nº 2936, Cep 69067-375. Manaus, Brasil
https://w2.solucaoatrio.net.br/somos/inpa-badpi/index.php/pt/

/unshelve

/unshelve
On Tue, Dec 3, 2024 at 8:33 PM github-actions[bot] @.***>
wrote:

Command Results ✅
shelve command successfully applied to instance-84 instance.
See details at
https://github.com/MorphoCloud/MorphoCloudInstances/actions/runs/12151095044
—
Reply to this email directly, view it on GitHub
https://github.com/MorphoCloud/MorphoCloudInstances/issues/84#issuecomment-2515969637,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/BNLCOVWQNOCSYP2PL637CD32DZLXPAVCNFSM6AAAAABSYTQPM6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMJVHE3DSNRTG4
.
You are receiving this because you authored the thread.Message ID:
@.***>

--
Cristina Cox Fernandes, Ph.D.
Adjunct Research Associate Professor
Biology Department
University of Massachusetts, Amherst
MA 01003-0000
Fish Curator
http://onlinelibrary.wiley.com/journal/10.1002/(ISSN)1520-6505UMass
Natural History Collections
https://sites.google.com/view/umassnhc/home
PPG-Biologia de Água Doce e Pesca Interior, Docente
Instituto Nacional de Pesquisas da Amazônia
Av. André Araújo Nº 2936, Cep 69067-375. Manaus, Brasil
https://w2.solucaoatrio.net.br/somos/inpa-badpi/index.php/pt/


[Bug]: Kubernetes API call failed: aws-iam-authenticator failed with exit code 1

What happened?
Hi all, I am getting the following error when deploying a EKS cluster with Flux v2:
2023-07-22 15:14:01 [ℹ]  gitops configuration detected, setting installer to Flux v2
2023-07-22 15:14:01 [ℹ]  ensuring v1 repo components not installed
2023-07-22 15:14:01 [ℹ]  running pre-flight checks
► checking prerequisites
Assume Role MFA token code: could not get token: EOF
✗ Kubernetes API call failed: Get "https://5A859C6D442D2404A238FE3125FD2398.gr7.us-east-1.eks.amazonaws.com/version": getting credentials: exec: executable aws-iam-authenticator failed with exit code 1
Error: running Flux pre-flight checks: exit status 1

The command I am using to deploy it is:
❯ eksctl create cluster --config-file eks-cluster.yaml --profile integration
The block I am using to install Flux v2 in the eks-cluster.yaml file is:
gitops:
  flux:
    gitProvider: github
    flags:
      owner: "mycompany"
      repository: "appv1"
      private: "true"
      branch: "dev"
      namespace: "flux-system"
      read-write-key: "true"
      path: "clusters/dev"

NOTE: If I remove the Flux block from the eks-cluster.yaml file, the cluster deploys without issue. And if I then run the following command to install Flux v2, it installs without issue:
❯ flux bootstrap github --owner=mycompany --repository=appv1 --branch=dev --path=clusters/dev
So, It seems then that the issue is in eksctl (or I am doing something wrong) and not with flux.
My question is, why does it fail with the gitops block that is inside the eks-cluster.yaml file?
I appreciate any help in this regard.
Thanks,
Julian
What you expected to happen?
I was hoping that there was no error or that it would ask me for the authentication token again.
Anything else we need to know?
No response
Installation tooling
homebrew
AWS IAM Authenticator client version
{"Version":"0.6.10","Commit":"ea9bcaeb5e62c110fe326d1db58b03a782d4bdd6"}
Client information
MacOS Ventura 13.5 Intel
eksctl v0.150.0-dev+cdcf906b7.2023-07-20T12
aws-cli/2.13.5

Kubernetes API Version
kubectl v1.27.4
kubeconfig user
[
    {
        "name"<EMAIL_ADDRESS>        "user": {
            "exec": {
                "apiVersion": "client.authentication.k8s.io/v1beta1",
                "args": [
                    "token",
                    "-i",
                    "turbonomic-xl-integration"
                ],
                "command": "aws-iam-authenticator",
                "env": [
                    {
                        "name": "AWS_STS_REGIONAL_ENDPOINTS",
                        "value": "regional"
                    },
                    {
                        "name": "AWS_DEFAULT_REGION",
                        "value": "us-east-1"
                    },
                    {
                        "name": "AWS_PROFILE",
                        "value": "route105"
                    }
                ],
                "interactiveMode": "IfAvailable",
                "provideClusterInfo": false
            }
        }
    }
]

@jfacevedo you may want to open an issue in eksctl repo and cross link it to this one. I don't think this is solvable just by folks working on this repo (it's about how eksctl uses this binary i think)

Hi @dims, I opened a case on eksctl a week ago, but I have not received any response. I thought it might be an issue with aws-iam-authenticator as well. https://github.com/eksctl-io/eksctl/issues/6843


[BUG]AttributeError: module 'transformer_engine' has no attribute 'pytorch'

Has anyone encountered this error? when doing huggingface to megatron-lm model convert.

The issue probably dues to the execution environment where TransformerEngine/PyTorch are not built from source. You could pull the docker image as instructed in https://github.com/alibaba/ChatLearn/blob/main/docs/en/installation.md. :)


About deleted soft and hard deletions

1. What version of Go and system type/arch are you using?
go version go1.14.14 darwin/amd64
2. What version of GoFrame are you using?
github.com/gogf/gf v1.15.3
3. Can this issue be reproduced with the latest release?
yes
4. What did you do?
nil
5. What did you expect to see?
I want to delete a piece of data by passing parameters of the function or calling another method chained when I use Delete () to delete a piece of data when using gf's orm.
6. What did you see instead?
nil
7. Working with scen

On a model object, there is a deleted_at field. The object can only be deleted softly by using the `delete 'function, but there is no api to call if you want to delete hard, and the document cannot be found.

package model

import (
	"gorm.io/gorm"
	"time"
)

type Authority struct {
	CreatedAt time.Time      `orm:"created_at" json:"CreatedAt"`
	UpdatedAt time.Time      `orm:"updated_at" json:"UpdatedAt"`
	DeletedAt gorm.DeletedAt `orm:"deleted_at" json:"-" gorm:"index"`

	ParentId      string `json:"parentId" gorm:"comment:父角色ID"`
	AuthorityId   string `json:"authorityId" gorm:"not null;unique;primary_key;comment:角色ID;size:90"`
	AuthorityName string `json:"authorityName" gorm:"comment:角色名"`
	DefaultRouter string `json:"defaultRouter" gorm:"comment:默认菜单;default:dashboard"`

	Menus         []Menu      `orm:"-" json:"menus" gorm:"many2many:authorities_menus;foreignKey:AuthorityId;joinForeignKey:AuthorityId;References:ID;JoinReferences:MenuID"`
	Children      []Authority `orm:"-" json:"children" gorm:"-"`
	DataAuthority []Authority `orm:"-" json:"dataAuthorityId" gorm:"many2many:data_authorities;foreignKey:AuthorityId;joinForeignKey:AuthorityId;References:AuthorityId;JoinReferences:DataAuthority"`
}

8. Suggestion

You can refer to gorm's idea of soft and hard deletion. delete

@SliverHorn https://goframe.org/pages/viewpage.action?pageId=1114139#ORM链式操作时间维护-Unscoped忽略时间特性

@SliverHorn https://goframe.org/pages/viewpage.action?pageId=1114139#ORM链式操作时间维护-Unscoped忽略时间特性

think you!


Feature proposal: make it easier to customize screenshot names and paths

Hi!
I'm wondering if anyone is interested in making it easier to customize screenshot names and paths, and if my idea fits the project at all or should I make my own gem.
So here is my problem:
I've noticed that I occasionally want to see how UI of a Rails app I'm working on looked at some particular revision, or which revision changed how the UI looks.
So I thought that I can utilize a CI service that I'm already using to make screenshots on each revision. I can make a small set of tests that would do nothing except visit particular pages that I care about, do some actions and make screenshots.
I could use regular save_screenshot method for that, but I have to give it a full path, which is a bit annoying. And also, it looks like some Capybara drivers have different methods for making screenshots, so if I want to switch to different driver then I would have to change my code. It might also be useful to save HTML as well as an image.
So I though that I could probably use capbara-screenshot.
There are a few problems though:

I can't provide a custom screenshot name to
screenshot_and_save_page method.
I can't (?) use a different directory for my screenshot-making tests to avoid mixing up my failure screenshots with the screenshots from the screenshot-making tests.

So I can work on making that use case possible with capybara-screenshot if maintainers and users think it's not a bad idea.
Another idea
And while I'm at it, I think it might be (not sure though) more convenient to make folders in the screenshot directory for each RSpec example group.
For example if I have these specs:
describe "this" do
  describe "that" do
    it "does whatever"
  end
end

Then save screenshots in this/that/does_whatever.  Optionally of course.
Whould it be more convenient or not?
What do you think?
In short
I'd like to know if it's useful to anybody (and appropriate in this gem) to implement these features:

Optional name argument for screenshot_and_save_page.
Make it easier to change screenshot path for particular tests.
(maybe, and optionally) Make the path reflect RSpec's example group
structure.

I'd love to hear some feedback and contribute if it's useful.

This is a nice idea indeed.  I'd find this useful and would be happy to review your PR and help answer any questions you have.

Thanks, @mattheworiordan! I don't have too much free time right now, so I've forked the project and made an issue there so I don't forget about it and this issue is not cluttering the list of open issues here.

Can we re-open this?  It's still an issue - and I would love to have this feature!

@ssnyder sure, have reopened.  Happy to review PRs / suggestions for this.


Java import directives shown with package names as keywords

When editing Java in Visual Studio Code, import directives are shown with the package names in blue as if they were keywords.  They should be shown in black because they are identifiers.

The Java tokenizer marks the import identifiers with the scope storage.modifier. It does the same for modifiers like private and public
We are using the tokenizer from https://github.com/textmate/java.tmbundle. A change request would have to be made there.

This issue was moved to textmate/java.tmbundle#41


Instead of enforcing Typebox, let the user choose

Maybe build upon typeschema so feTS become validation-agnostic ?

Also, idk if this package must be included in fets, it increases the bundle size by a lot!
<EMAIL_ADDRESS>it feels weird that TRPC with the packages server and client combined gets only ~10kb minified and fets it's over 60kb.

feTS relies on JSON Schema not typebox actually. Technically you can use any library that supports JSON Schemas for validation. By default, the schemas created by typebox are detected but that doesn't mean you cannot use any other libraries that are compatible with JSON Schemas.
Bundle size results might not be accurate since it doesn't get the optional dependencies that are tree-shaken in most cases such as ponyfills etc.
However, entire feTS library is tree-shakable so if you don't use typebox, you won't have it in your bundle so it means -10kb :)
Same for ponyfills... If they are not used, they won't be added to the bundle.


lol bot

Hi i can't make the bot work. I have downloaded the latest release. I change the config.txt to where i have my LoL and started the program. A command promt pop up and said starting LeagueClient and then it disappeared and then League started. i don't know how to code so could you help me?

Hi i can't make the bot work. I have downloaded the latest release. I change the config.txt to where i have my LoL and started the program. A command promt pop up and said starting LeagueClient and then it disappeared and then League started. i don't know how to code so could you help me?

Try opening a PowerShell window in the directory where main.exe is located or navigate there using the cd command and run it from the command prompt. Make sure that all the files are extracted. Also, the location of your League of Legends client install in the config should point directly to the launcher exe, for example: C:/Riot Games/League of Legends/LeagueClient.exe not just the folder where it is located. Please include a screenshot or paste in the command prompt when you open an issue if you have any bugs.
Link to the file to download and extract:
https://github.com/AnakinTrotter/League-Bot/releases/download/2021.3.27/bot.zip
Change directory:
cd [directory of main.exe]
Run the exe:
.\main.exe


fix(ses): remove code that failed to add species

Fixes #239
The existing code attempted to set the species of the tamedRegExp constructor, but failed to. This removes the useless attempt. Were it to successfully set species, another test would already fail because it would fall outside that test's whitelist. Thus, no additional test was needed. Just removing useless code.

Closing this in favor of new PR with the same code


Refactor audioBasicIO function code

The changes are mostly related to pep8 compliance and readability, the most significant change is the that read_audio_file function returns and empty numpy array and -1 on error,

Nice job @dsgou


LoadConfiguration now returns errors when the config is missing values

Configurations now receive some rudimentary checks to ensure they are valid. Missing access tokens or shop domain will now cause an error indicating what environment failed and what key is missing.
Fixes #119  (hopefully)
@chrisbutcher

LGTM!


Support always building -SNAPSHOT versions when not building with a special flag

My workflow is as follows:

Start with branches release/xyz and develop.
Branch off of develop to feature/xyz.
Complete development of the feature, merge feature/xyz into develop.
Possibly repeat 2-3 multiple times.
When it's time for a release (large enough changes, finished with changes for now), merge develop into release/xyz.

I already publish builds from release/xyz branches to various maven repos and Github Releases using the Shipkit plugins.
I would like to expose snapshot builds from develop and feature/xyz branches somewhere (Maven, Github Actions build artifacts, etc.). Additionally, local builds (potentially having non-committed changes) should by default be marked as snapshots to distinguish them from reproducible builds on CI. I personally like having Git tree status included in the version like is done here: https://github.com/CaffeineMC/sodium-fabric/blob/68ca12bcbd57eddfaf47aa66492464540c2c7581/build.gradle#L75-L97
This would be extremely useful for simply linking development builds to users in order to get feedback on issue fixes quickly. Examples of this workflow can be found in one of my repos here: https://github.com/magneticflux-/fabric-tree-chopper
#37 and #77 are similar to this, but #37 requires an override for snapshot builds rather than the reverse and #77 requires -SNAPSHOT in the version property to be set (if I'm reading the PR's code correctly: https://github.com/shipkit/shipkit-auto-version/pull/78/files#diff-b565cb97994bdd103d4038e053277da3b27f44237fcc958388e286ec930caa1aR112-R114)

Interesting. Can you describe the the requested feature in the form of current vs requested behavior? I want to make sure I understand it. Thanks for reporting!

Sorry about the ramble, I wrote this just before going to bed 😄.
What currently happens:
Local builds on feature/xyz and develop branches get versioned n patch versions ahead of the last version where n is the number of commits since last tagged release.
What I would like to happen:
Whenever a build is run anywhere, it should be suffixed with -SNAPSHOT and be one patch version ahead of the last tagged release UNLESS a special flag (for CI runs) is set somewhere.

Hey @magneticflux-
Interesting use case. I think the -SNAPSHOT part is fairly easy to solve and I don't think it requires changing the plugin. You could just if () { version += "-SNAPSHOT" }
The incrementing bit is a little tricky. Some options:

do nothing, be happy with patch version incremented by n
do nothing, the customer can hack the version in the build file, previous version is available at ext.'shipkit-auto-version.previous-version'

expose ext.'shipkit-auto-version.previous-version.patch'. It's a variant of above, just making "hacking" a little easier.
expose ext.'shipkit-auto-version.previous-semver'. Another variant, we would expose jsemver object that has cool methods like incrementPatchVersion(). This would make it really easy for customers to increment the version in any way they want. The downside is leaking 3rd party API.

expose new incrementStrategy configuration setting with values: incrementStrategy=default or incrementStrategy=simple. In your case, you'd just pick "simple". This adds complexity (Axiom plugin has tons of configuration settings).
expose an API where the customer can register a callback/Groovy closure to "hook up" to version selection logic in the core plugin. Feels like adding more complexity.

Thoughts? Other options?

I think incrementStrategy is the way to go, but I also think there's an underlying issue in the selection of next version that my workflow exposes:
When building a version on a feature branch, the patch number is incremented for each commit. However, as soon as that feature branch is merged, the patch number goes back to +1 for the merge commit. An example:

main just built and tagged v1.0.0
feature/abc branches off and adds 3 new commits, it builds v1.0.3
feature/abc merges (via PR or otherwise) into main
main builds and tags v1.0.1.
Problem! v1.0.1 can be built after checking out main OR after checking out the first commit of feature/abc; these two artifacts are different but have the same version.

If I'm understanding the plugin behavior correctly, this leads to situations where a feature branch from the past could have built a version that a different branch now builds, and there's no way to tell which branch a given version was built from. I think this could be a big problem down the road if someone were to just discover a jar file somewhere and not know where it was built from.
To resolve this, I think the plugin needs some understanding of if it's on a feature branch or on the main branch. A regex match on a branch name could indicate being on a "main" branch (for me release/.+, for a simple branching model main or master). Being on a non-main branch would just build a snapshot version of what would be released if it were merged: the last tag +1 patch version.

If I'm understanding the plugin behavior correctly

The reason we count the commits is to allow "concurrent PR merges" that trigger releases. If you close 3 PRs at the same time, you'll get 1.0.1, 1.0.2, 1.0.3 (assuming that previous was 1.0.0).

there's no way to tell which branch a given version was built from

I think that's normal ;-) Version number does not contain this information. (you could add it will little effort version = version + 'branch'). Have you seen Axion plugin? (it has features that you might like)

The reason we count the commits is to allow "concurrent PR merges" that trigger releases. If you close 3 PRs at the same time, you'll get 1.0.1, 1.0.2, 1.0.3 (assuming that previous was 1.0.0).

I totally agree, this works great for counting merge commits! I just don't think it makes sense to count non-merge commits on non-release branches the same way. I'm also skeptical if people actually use the generated version numbers on non-release branches (this project at least doesn't do anything with them since releases are only pushed on master)
My idea still doesn't solve the problem of two concurrent feature branches building the same snapshot versions, but it would prevent feature branches with dozens of commits from (IMO confusingly) "blowing up" the patch version +N before the merge takes it down to just +1 again.
I've looked at Axion, but it seems to have pretty poor support for Kotlin DSL which is a personal must for my new projects (https://github.com/allegro/axion-release-plugin/issues/285). I also feel it's a little further from the "sensible defaults, batteries included" approach that I like with this plugin (of course, I'm biased by my own opinions of "sensible" 😉).

there's no way to tell which branch a given version was built from

I think that's normal ;-)

I also agree with this to some extent: it's definitely not expected to be able to pinpoint what branch, commit, and VCS history went into an artifact. However, in this instance I think it's really useful to be able to immediately see -SNAPSHOT and know it was built on a non-release branch and based on a certain previously released version.

@magneticflux-, it's been long, I'll close the ticket. Reopen if needed!


silent refresh creates a new persistent websocket connection per refresh

When running my Angular app with the silent refresh mode. I get a new WS connection each time a new refresh occurs. The connection is not destroyed upon subsequent auth refreshes, meaning I have a new websocket client connection per silent refresh.
Do we not destroy the iframe upon successful refresh?

Interesting, I'm not seeing the behavior you describe at all, and if I peek in the relevant source it seems at first glance that the old iframe is killed.
Could you make a minimal repro that demonstrates the bug?

Thanks for the quick reply. Will do that shortly

Do you have a recommended oidc mock server that you use with your library? You mention there is one in the samples but I haven't been able to find it.

The project maintainer has graciously provided a test server (based on IdentityServer3, I think), the details are in the READM.md file.

I'm putting together an example. Could be my implementation that is the issue.
Looks like I am getting iframes being created recursively because my app is bootstrapping within the iframe, and bootstrapping more inside itself.

My app.module
import { BrowserModule } from '@angular/platform-browser';
import { HttpClientModule } from '@angular/common/http';
import { NgModule } from '@angular/core';
import { Router, RouterModule } from '@angular/router';
import { OAuthModule, OAuthService, JwksValidationHandler } from 'angular-oauth2-oidc';

import { AppComponent } from './app.component';
import { HomeComponent } from './home/home.component';

@NgModule({
  declarations: [
    AppComponent,
    HomeComponent
  ],
  imports: [
    BrowserModule,
    HttpClientModule,
    OAuthModule.forRoot(),
    RouterModule.forRoot([
      {
        path: '',
        component: HomeComponent
      }
    ], {
      initialNavigation: false
    })
  ],
  providers: [],
  bootstrap: [AppComponent]
})
export class AppModule {
  constructor(
    private oAuthService: OAuthService,
    private router: Router
  ) {
    this.init()
  }

  async init() {
    this.oAuthService.configure(config);
    this.oAuthService.setStorage(localStorage);
    this.oAuthService.tokenValidationHandler = new JwksValidationHandler();
    await this.oAuthService.loadDiscoveryDocumentAndTryLogin();
    this.oAuthService.setupAutomaticSilentRefresh();
    this.router.initialNavigation();
  }
}

Oh damn, this was an implementation issue. I should have read your documentation closer! My bad!

Good to hear you found the root cause!
For others landing here, this issue (recursively loaded iframes) typically occurs when your ng serve setup will not serve silent-refresh.html (e.g. because you didn't add it as an asset yet).
Feel free to close the issue yourself if there no longer is a problem.


Custom stickiniess flexiblerollout

Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Comparison is base (23bf404) 97.33% compared to head (8c3210c) 97.61%.

:exclamation: Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files
@@            Coverage Diff             @@
##             main      #26      +/-   ##
==========================================
+ Coverage   97.33%   97.61%   +0.28%
==========================================
  Files          18       18
  Lines         375      378       +3
==========================================
+ Hits          365      369       +4
+ Misses         10        9       -1

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


nvm 1.1.2

Sorry for the previous typo and bad markdown formatting.
Thanks @viktorbenei for improving the quality of the description!
New Pull Request Checklist
Please mark the points which you did / accept.

[x] I read the Step Development Guideline
[x] I have a test for my Step, which can be run with bitrise run test (in the step's repository)
[ ] I did run bitrise run audit-this-step (I ran stepman audit --step-yml ./step.yml instead`)
[x] I read and accept the Abandoned Step policy

No problem at all, and thanks again for the updates! ;)


should konw whether we had handled current url (ios)

we had app_link and other share plugin, the problem is that app_link can't know whether url had handled.
refer issue:
1.https://github.com/llfbandit/app_links/issues/17
2.https://github.com/RxReader/weibo_kit/issues/46
please check it if you have a time, maybe we can improve it, thanks

Any Update on this?


10-Codes only display first 10 entries

What version of Node.js are you using?
16.14.0
What version of npm are you using?
8.3.1
What operating system are you using?
Ubuntu Server
Describe the Bug
After 10 or so 10-codes, the system stops displaying the rest.  The new code gets placed at the top of the list, then everything gets shifted down, and one code gets shifted out of frame
Expected Behavior
The list should just continue iterating through the entries
To Reproduce
Keep adding 10-codes

Should be fixed now! Didn't realize it was broken lol. Thanks for reporting!


Upload transcript page functions + modal

Description
BIG IDEA: After a user successfully uploads a transcript on the upload transcript screen, have a modal pop-up on clicking the "Begin Session" button that allows users to enter their desired flow name which leads to the starting intent screen (if successful).
ADDED FUNCTIONALITIES:

Made modals a generic component

Allows users to upload transcripts: If the file isn't a JSON file/not in the correct format, prompts alert on the screen asking for a valid file. If it's a duplicate, prompts alert pop-up saying it has already been uploaded.

On clicking "Begin Session", opens the modal for users to enter the flow name. This also stores the response id of createTranscript after uploading the transcript to use in other functions later on (like deleting the transcript). This is done by updating sessionProvider.js for transcript ID state.

On the modal:
PRESSING CONTINUE: If no flow name has been entered, prompts alert pop-up. Otherwise, stores the flow name that user entered with the transcript file onto DB. Then, it takes us to starting intent page.
PRESSING CANCEL: delete the transcript uploaded onto the DB and allow users to select different file (or keep the same one if they changed their minds).

Fixes # (issue)

transcripts.js file promises correctly returns desired variables now
Uploading the flow correctly passes in a JSON file now instead of a string
Error with button height size changing on upload transcript page fixed
Modified test transcript file to only go into 3 depths (4 depths makes transcript file too long to upload onto the DB since we are using a free version)

Please delete options that are not relevant.

[x] Bug fix (non-breaking change which fixes an issue)
[x] New feature (non-breaking change which adds functionality)

How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

[x] Checking MongoDB to see if objects are added and deleted when desired
[x] Using console.log to see if certain functions and variables are the values we want
[x] Running it on localhost and clicking certain buttons to make sure everything shows up on the UI as intended

Checklist:

[x] I have performed a self-review of my own code
[x] I have commented my code, particularly in hard-to-understand areas
[x] My changes generate no new warnings
[x] I have added tests that prove my fix is effective or that my feature works
[x] New and existing unit tests pass locally with my changes

just waiting until i get a chance to communicate with group members --- i have never encountered a merge conflict but should i just resolve it like it tells me to above?
git pull origin integration
git checkout lucy/upload-transcript-page-functions
git merge integration
git push -u origin lucy/upload-transcript-page-functions

Just commenting that the "fixing CSS styling" branch was made off of this branch so it had most of my changes written in the description of this PR. This PR will be a really quick review if anyone can just look at it for 5 min.


Please can we get Wallpanel to work with the HA Stream Component?

Please can we get Wallpanel to work with the HA Stream Component?
https://www.home-assistant.io/components/stream
Many Thanks

What does that even mean?   The application is meant to show a website or home automation platform, its up to you to configure what you show on your platform webpage.

I think a cooler tone may be a better approach to making friends, at the moment, you are not approachable and frankly quite rude.
But I was thinking that maybe the cameras part of the app could be adapted to stream HLS or a suitable format for HA.
It could even broadcast a url/path using MQTT.
I'll leave this up to you and your "creativity"

I think a cooler tone may be a better approach to making friends, at the moment, you are not approachable and frankly quite rude.

I didn't notice any particular rudeness in this case (maybe I'm a rude person myself?), but in general I do agree with the second part of your statement ;)
Actually, after getting a few similar responses to my issues recently and stumbling upon your response I thought "Maybe it's time to make move?"
Fortunately, there are other similar projects out there, much more popular - have a look.
One of my HA friends uses it and quite happy with it.
I haven't tried it yet, but the topic speaks of itself - it's well alive and well supported.
Rant over ;)

There is a set way to file a feature request.  The application is not a replacement for Home Assistant. It’s for displaying home platform websites.
If there is a feature that you think you would like, then you also have the option to do a pull request for that feature.   It’s an open source project and that is the best way to contribute.
If you feel that your feature isn’t getting the attention you think it deserves, again the way to contribute is to do a pull request and contribute your time and code to the project.
I’d you don’t agree with the way the project is progressing  or feel that your contributions to the project are not respected, you have the option to fork the project and make your own .
The contributions people make the most often are feature requests  and bugs.   Those are fine as well, but try to follow the project guidelines for submitting them.
Nobody should feel that they are not heard but ultimately it’s me doing the work on this project and it’s my choice what requests I feel should be on the road map.
There are also other projects available for HA and home automation platforms, there are also paid applications that have similar functionality to this application like Fully Kiosk Browser.  This application is not in competition with other projects, it’s a contribution to the IoT community which I’ve taken upon myself to do.  The project is itself a fork of another project.
Don’t confuse free open source software with some paid services or purchased product.  It’s run completely by volunteers and this project page isn’t a customer service portal for complaints or rants.  There is no place for that behavior.  It’s not a social media platform it’s a project platform.  Contribute in a constructive way, follow the guidelines and when ever possible contribute with code.
There are plenty of projects that will not even accept a sing feature request or even comment without completing the proper form and adherence to the project guidelines.  I may have been to lax and the amount of features and “me too” comments have piles up.
I will do better to make requests follow the guidelines so that users can contribute without feeling unheard or me having to do follow up questions.

@MikeMannox file a new feature request with the information. Thanks

But I was thinking that maybe the cameras part of the app could be adapted to stream HLS or a suitable format for HA.
It could even broadcast a url/path using MQTT.
I'll leave this up to you and your "creativity"