Switching to eBPF results in calico-kube-controller not being able to reach datastore - localhost:6443 - connection refused

Expected Behavior
I believe the expected behaviour is that the calico-kube-controllers (single pod but that's the name it has) should be able to contact the Kubernetes API Server in the same way that calico-node pods can.
Current Behavior
calico-node and calico-typha pods can connect to the kubernetes API via localhost:6443 successfully, but calico-kube-controllers (the name of a singular pod in this case) gets connection refused for reasons not yet clear.
Possible Solution
I am not sure what the solution is just yet as I have been following the documentation
Steps to Reproduce (for bugs)
Following documentation here: https://docs.tigera.io/calico/3.27/operations/ebpf/enabling-ebpf#configure-calico-to-talk-directly-to-the-api-server
And using the Calico provisioned by Rancher when creating the cluster, self-hosted, RKE2, on Ubuntu VMs, no public cloud present at all.

Disable kube-proxy before following the eBPF documentation linked above. On each node in the cluster, use a daemonset to put a file (99-rke2-customisations.yaml) in /etc/rancher/rke2/config.yaml.d/ (documentation here: https://docs.rke2.io/install/configuration#configuration-file ), and in that daemonset remove the file "/var/lib/rancher/rke2/agent/pod-manifests/kube-proxy.yam" if detected so that the kube-proxy pods don't come back. The customisations file has the declaration of "disable-kube-proxy: "true"" as per RKE2 documentation.
Define the configmap as defined in the "Operator" step for preparing for eBPF Host=localhost, Port=6443. Watch all the calico-node pods reinit with the new API config environment variables, and work successfully.
Then patch "kind: Installation" with "name: default" to add spec.calicoNetwork: "linuxDataplane: BPF", which then gives us operational eBPF capabilitiesd (and in-turn correct SourceIP values)
Then patch "kind: FelixConfiguration" with "name: default" to add spec values "bpfKubeProxyIptablesCleanupEnabled: true", "featureDetectOverride: "ChecksumOffloadBroken=false"", "pfExternalServiceMode: "DSR"", & "xdpEnabled: true" (I have tried with and without these Felix customisations, it does not seem to impact the behaviour of calico-kube-controllers

Context
So when I look at the YAML for calico-kube-controllers it is given the same environment variables KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT that the calico-node & calico-typha pods are given. The calico-kube-controllers pod has an IP of 10.42.790.200 (and changes with re-init of course). And I am using all "default" CIDR configurations that RKE2 delivers. So no CIDR customsiations have been made by me. UFW and AppArmor are turned off on the Ubuntu hosts.
When I instead use the VIP of <IP_ADDRESS> for KUBERNETES_SERVICE_HOST this prevents a rebooted k8s node from fully recovering as nothing can actually talk to the cluster. Namely calico-node pods cannot reach that VIP after a node reboot, so nothing comes up. I was only able to correct this when using "localhost" or "<IP_ADDRESS>" (except localhost might be preferable due to contextual agility when used).
Your Environment

Rancher to help build/manage the cluster
ArgoCD for CD stuff (not inside this cluster but helps manage it)
3x RKE2 nodes, v1.26.15+rke2r1 (all nodes with all roles, this is for testing purposes)
Each node on Ubuntu 22.04 provisioned following the RKE2 documentation on requirements
MetalLB for Layer 2 ARP IP management and loadbalancer functions (single LAN IP outside the cluster for inbound traffic)
k8s team NGINX Ingress
Test deployment librespeed to validate SourceIP results (original driving goal around all this)
Calico v3.27.2

====
The error that calico-kube-controller spits out is:
[INFO][1] main.go 131: Ensuring Calico datastore is initialized 2024-08-16T16:09:33.924977314Z 2024-08-16 16:09:33.924 [ERROR][1] client.go 295: Error getting cluster information config ClusterInformation="default" error=Get "https://localhost:6443/apis/crd.projectcalico.org/v1/clusterinformations/default": dial tcp [::1]:6443: connect: connection refused 2024-08-16 16:09:33.924 [INFO][1] main.go 138: Failed to initialize datastore error=Get "https://localhost:6443/apis/crd.projectcalico.org/v1/clusterinformations/default": dial tcp [::1]:6443: connect: connection refused 2024-08-16T16:09:38.935878325Z 2024-08-16 16:09:38.934 [ERROR][1] client.go 295: Error getting cluster information config ClusterInformation="default" error=Get "https://localhost:6443/apis/crd.projectcalico.org/v1/clusterinformations/default": dial tcp [::1]:6443: connect: connection refused
====
I am unsure what I should be doing here as I have followed the documentation, and have not found any relevant resources online on what I can do about this. So I really would appreciate help on this matter.

Also this is what it looks like when I curl localhost:6443 on one of the nodes, at the Ubuntu OS level:
curl --insecure https://localhost:6443 {   "kind": "Status",   "apiVersion": "v1",   "metadata": {},   "status": "Failure",   "message": "Unauthorized",   "reason": "Unauthorized",   "code": 401 }
So I don't really believe any firewall aspects are blocking 6443 on the nodes.

but calico-kube-controllers (the name of a singular pod in this case)

Just as a side-note, this is because the single pod contains multiple distinct controllers running within it :smile:
I think the main issue here is that "localhost" resolves to a different address for different pods. calico/node and calico/typha run in the host network namespace, so localhost for them will resolve to the actual node's localhost.
However, kube-controllers runs with it's own network namespace (i.e., hostNetwork false) and so localhost within that pod will resolve to the pod's local IP, and traffic won't go to the node itself.
Do you have some sort of proxy running on localhost? Or is this just a single node cluster with the API server running on the node? In the latter case, you probably can just use the real IP of the node hosting the API server instead of using localhost.

but calico-kube-controllers (the name of a singular pod in this case)

Just as a side-note, this is because the single pod contains multiple distinct controllers running within it 😄
I think the main issue here is that "localhost" resolves to a different address for different pods. calico/node and calico/typha run in the host network namespace, so localhost for them will resolve to the actual node's localhost.
However, kube-controllers runs with it's own network namespace (i.e., hostNetwork false) and so localhost within that pod will resolve to the pod's local IP, and traffic won't go to the node itself.
Do you have some sort of proxy running on localhost? Or is this just a single node cluster with the API server running on the node? In the latter case, you probably can just use the real IP of the node hosting the API server instead of using localhost.

I'm going to do my best to answer these and future questions, but there may be areas where I think I know what's going on, but might not be 100% accurate. I am still pretty green behind the ears for k8s, and I am using Rancher (v2.7.6) to provision RKE2 nodes for this test cluster, just to be clear. So feel free to correct me wherever you see fit :) So much more to learn! But...

I used localhost because it seemed to get me the "farthest" vs the actual VIP for Kubernetes API (<IP_ADDRESS>), but I can completely appreciate "localhost" depends on context, and I don't YET have any worker-only nodes in said test cluster.
This cluster is 3x VMs running RKE2 on each, so 3x node cluster, all with etcd/control-plane/worker roles just to have all the quorums (bigger numbers of quorums is better, right? ;P)
So far as I KNOW I do not have any proxy on local host. What I can say is my desired intent is to have kube-proxy disabled (which I am successful at doing) and using eBPF in that mode. And in my testing (and referenced documentation) it seems disabling kube-proxy before defining the "name: kubernetes-services-endpoint" ConfigMap which sets the "localhost"/IP/port/whatever is the successful order of operations, suggesting no proxy is at play (I THINK???).
I believe I saw api-server pods on all 3x of the nodes in this cluster, but I don't know yet if that will be the case for any worker-only nodes I add in the future (haven't gotten that far in development yet, sorry!) So I have a hunch "localhost" might not be what I want in the long-term.
You might have missed me mentioning above that I've tried with the VIP for Kubernetes API (10.43.01) and that being very unsuccessful for me, for reasons I don't see why. (with and without kube-proxy present, by the way, if I remember accurately).
I do appreciate your engagement and help here, so thanks!
I am looking to upgrade my rancher to v2.8.5 and then the test k8s nodes to uhh... 1.28? (I forget the exact version right now) as I have whispers in the wind that might magically solve my "can't reach VIP" problem.

I used localhost because it seemed to get me the "farthest" vs the actual VIP for Kubernetes API

Gotcha, yep this makes sense but will break down even more once you add nodes that are worker-only (and in fact, breaks down even before that as evidenced by this issue!).

So far as I KNOW I do not have any proxy on local host

Yep, I think my question was answered - if you haven't set up anything explicitly to redirect localhost:6443->apiserver:6443 on another host, which is sounds like you haven't.

believe I saw api-server pods on all 3x of the nodes in this cluster, but I don't know yet if that will be the case for any worker-only nodes I add in the future

They won't be - the apiserver is a control-plane only component and won't run on worker nodes. However, services on the worker nodes (including kube-proxy when enabled, kubelet, and Calico) all need to communicate with the apiserver.

You might have missed me mentioning above that I've tried with the VIP for Kubernetes API

Yeah, I am not too surprised this doesn't work. Typically I would expect to point KUBERNETES_SERVICE_HOST to the address of a load balancer fronting the API server (I suspect you have one, e.g., the address your local kubectl uses to reach the apiservers?)

You can use one of the api server endpoints in kubectl get endpoints kubernetes

You can use one of the api server endpoints in kubectl get endpoints kubernetes

Yep, this is a decent stopgap but it won't provide redundancy in the event of that particular API server pod failing / being upgrade, nor will it handle the IP address of that particular node changing.

I used localhost because it seemed to get me the "farthest" vs the actual VIP for Kubernetes API

Gotcha, yep this makes sense but will break down even more once you add nodes that are worker-only (and in fact, breaks down even before that as evidenced by this issue!).

So far as I KNOW I do not have any proxy on local host

Yep, I think my question was answered - if you haven't set up anything explicitly to redirect localhost:6443->apiserver:6443 on another host, which is sounds like you haven't.

believe I saw api-server pods on all 3x of the nodes in this cluster, but I don't know yet if that will be the case for any worker-only nodes I add in the future

They won't be - the apiserver is a control-plane only component and won't run on worker nodes. However, services on the worker nodes (including kube-proxy when enabled, kubelet, and Calico) all need to communicate with the apiserver.

You might have missed me mentioning above that I've tried with the VIP for Kubernetes API

Yeah, I am not too surprised this doesn't work. Typically I would expect to point KUBERNETES_SERVICE_HOST to the address of a load balancer fronting the API server (I suspect you have one, e.g., the address your local kubectl uses to reach the apiservers?)

Right now all 3x of the nodes in the cluster are etcd/control-plane/worker though. Just to clarify ;)

You can use one of the api server endpoints in kubectl get endpoints kubernetes

How do I:

Make it so that auto-updates as control-plane nodes are added/removed from a cluster?
Tolerant of any of the control-plane nodes eating dirt/rebooting/taking a lunch break/staring into an eclipse/something else?

(Directed at anyone:)
To me, the point of the <IP_ADDRESS> VIP... wasn't it supposed to be the logical "loadbalanced" IP meeting this function of tolerant of endpoint shenanigans? Which is why it seemed the logical IP to use, yet... doesn't work? (and I know this is a default-generated IP for my cluster, I'm not married to this specific IP but automation is nice)

To me, the point of the <IP_ADDRESS> VIP... wasn't it supposed to be the logical "loadbalanced" IP meeting this function of tolerant of endpoint shenanigans?

It is. However, when using eBPF Calico, Calico becomes responsible for programming that VIP so that it works. So, Calico can't rely on the VIP that it itself is programming.
Where are you running kubectl from? Are you accessing this cluster by SSHing into the nodes? Typically a cluster will have a public IP address associated with its API that is used for external access (i.e., a cloud LoadBalancer) - this should handle nodes being added/removed, as well as rolling updates, etc.

To me, the point of the <IP_ADDRESS> VIP... wasn't it supposed to be the logical "loadbalanced" IP meeting this function of tolerant of endpoint shenanigans?

It is. However, when using eBPF Calico, Calico becomes responsible for programming that VIP so that it works. So, Calico can't rely on the VIP that it itself is programming.
Where are you running kubectl from? Are you accessing this cluster by SSHing into the nodes? Typically a cluster will have a public IP address associated with its API that is used for external access (i.e., a cloud LoadBalancer) - this should handle nodes being added/removed, as well as rolling updates, etc.

I'm generally avoiding any sort of manual kubectl at all. I always try to seek a method that ArgoCD can apply via YAML manifests so that any changes I want to make are defined IaC-style. So disabling kube-proxy, for example, uses a daemonset that drops a yaml file in a location RKE2 looks for, which declares an Environment Variable to disable kube-proxy, and also removes another manifest file for kube-proxy in another folder.
As for the "name: kubernetes-services-endpoint" that's a "kind: ConfigMap" manifest that ArgoCD applies to the cluster.
ArgoCD compares running state to a GitLab repo, by the way.
I try to avoid getting manually onto the nodes, but for when I have to, it's via SSH. Or for kubectl stuff I use the Rancher's webGUI to get me to kubectl for the cluster (and I don't typically need to care where kubectl runs, so long as it can reach the relevant cluster, which it normally can).
This is all self-hosted by the way, and I do believe I have things configured to go through Rancher for when ArgoCD interacts with the cluster. I intentionally did not configure an endpoint (unsure if this is Kubernetes API or not, to be clear) as I wanted Rancher to manage that Access Control/RBAC stuff.
As for inbound traffic, I'm using MetalLB in Layer 2 ARP mode handling a single LAN IP for inbound traffic, but I'm quite confident that doesn't overlap with where I'm stuck.
So again, all on-prem, my infra, no hosted cloud, nothing like that. ;) This is by design and I have no interest in doing any of this in any hosted infra cloud or otherwise.

I'm generally avoiding any sort of manual kubectl at all.

Right - I was less interested in kubectl the tool in particular, and more interested in learning how entities outside of your cluster access the API (if at all).
Ultimately what you need is a stable IP address that routes to your API server pod(s).

Or if you have a way how to resolve DNS from the hosts, you can use a domain name in KUBERNETES_SERVICE_HOST that maps to multiple IPs for HA. I think Azure does it that way.

I'm generally avoiding any sort of manual kubectl at all.

Right - I was less interested in kubectl the tool in particular, and more interested in learning how entities outside of your cluster access the API (if at all).
Ultimately what you need is a stable IP address that routes to your API server pod(s).

Of course it's up top me, but I have no idea how I should configure it, as the official documentation for eBPF in Calico (specifically for RKE2 agnostic of where, by the way) isn't producing the results described in said documentation.
I do see that <IP_ADDRESS> exists in the cluster, but using that instead of localhost or <IP_ADDRESS> works "worse" as all Calico aspects fail to re-init when using <IP_ADDRESS>.
So I really do need more help on the matter.

Or if you have a way how to resolve DNS from the hosts, you can use a domain name in KUBERNETES_SERVICE_HOST that maps to multiple IPs for HA. I think Azure does it that way.

I'm not opposed to something like that, however I would want some sort of method that auto-updates itself with adding/removing nodes (in this case control-plane) to said DNS entry. Shouldn't some of the internal FQDNs work for this function?
It's also challenging for me to determine if the relevant pods care about internal (within the k8s cluster) DNS resolution for this aspect, or require external (outside the cluster, but on the VM itself maybe) resolution for such a method to work?
I'm trying to keep the cluster as self-sustaining, and automated, as possible.
And to be clear to both @caseydavenport and @tomastigera I do REALLY appreciate the engagement and help here, even if we haven't quite found a solution yet. So thank you for that ❤

Also, isn't Calico capable of doing this kube-apiserver loadbalancing internally or something that we "need" here? I'm trying to keep my details straight, but it is challenging...

Also, isn't Calico capable of doing this kube-apiserver loadbalancing internally

The problem here is bootstrapping - Calico needs to be able to talk to the apiserver in order to learn the necessary information in order to do this.
So, Calico can't just magically detect where the API server is when it doesn't have access to the API. Something needs to tell Calico where the API server is so that it can set up that load balancing for other pods.

Also, isn't Calico capable of doing this kube-apiserver loadbalancing internally

The problem here is bootstrapping - Calico needs to be able to talk to the apiserver in order to learn the necessary information in order to do this.
So, Calico can't just magically detect where the API server is when it doesn't have access to the API. Something needs to tell Calico where the API server is so that it can set up that load balancing for other pods.

And is this from an internal-to-cluster perspective, or external-to-cluster perspective? (as in where I "want" it connecting to).
I ask because a few things I've discovered may be relevant.

I tried setting KUBERNETES_SERVICE_HOST to "kubernetes.default.svc.cluster.local", and the cni-installer container for calico-node reached out to my internet gateway (way outside the k8s cluster) for DNS resolution and the logs produces "no such host" (mentioning the IP of the gateway:53). Soooo I'm not sure if this is demonstrating more of the catch22 stuff or what... How is it when I use <IP_ADDRESS>/localhost for KUBERNETES_SERVICE_HOST all the pods work (except calico-cube-controllers)? Is it because those working pods init from an external connection context?
A rando online solution in I think a similar scenario mentioned their solution was creating an Ingress object to the Kubernetes Service object. And considering I'm using MetalLB in Layer 2 ARP mode, I was seriously considering trying this method, and then stuffing whatever FQDN the Ingress would use in the KUBERNETES_SERVICE_HOST value. However I'm unsure what FQDN I should use, and how well this would behave when all nodes are rebooted (nicely or not).

I understand that it's far more typical to do k8s stuff on hosted/cloud infra, but self-hosted is really a requirement for the areas I work in, and hosted/cloud really isn't an acceptable option. So in my development of my whole cluster adventure, this last bit with Calico is like the last 1% remaining on the work.
I really hope we can figure something out, because I do quite like what I see in Calico, and I really am trying to do my best to read lots, and listen lots. And again thanks for responding and responding so rapidly. :) I apologise in advance if I come across as unappreciative or gruff in any way, past, present, or future. I'm both frustrated, and excited to get this sorted. ❤

Also... considering my circumstance... should I be enabling eBPF before (or in-parallel with) declaring the KUBERNETES_SERVICE_HOST and _PORT? (And what about disabling kube-proxy? the test above kube-proxy was running at the time)

Hey so some new information...

I thought it was a perfect time to try something really "stupid" because this is a testing cluster. So I started with KUBERNETES_SERVICE_HOST set to localhost, then I patched "kind: Installation"/"name: default" with "linuxDataplane: BPF" to enable eBPF, and patched "kind: FelixConfiguration" with cleaning up kube-proxy, the checmsumoffloadbroken=false flag, DSR, and enabling XDP. I then disabled kube-proxy (don't want to fully explain method in this response, sorry). Then everything was working, except calico-kube-controller was still unhappy (which I expected). I tried hard-resetting one of my nodes to see how recovery would work, and things came up "just fine" (again, except for calico-kube-controller). Once I felt like it was working "enough" I changed KUBERNETES_SERVICE_HOST to one of the LAN IPs for one of the k8s nodes (as in IP external to the cluster) and uhhhh.... EVERYTHING WORKED (including calico-kube-controller). I even tried brutally hard-restarting the same k8s node to see how recovery behaved and... uhhh... everything came back up, nothing is broken once init finished.... I don't think this is the "permanent" way I want this to run, but yeah pretty sure this falls in-line with what's been presented above. Yikes!
I'm probably going to try rolling out kube-vip for the external api-server VIP loadbalancing stuff, as the below referenced reddit thread has multiple people singing the praise in ways that look generally identical to what I'm doing.

Reddit thread: https://www.reddit.com/r/kubernetes/comments/1epn6jo/best_approach_to_expose_an_onpremise_k8s_cluster/
BloodyIron's optimism grows.

I tried setting KUBERNETES_SERVICE_HOST to "kubernetes.default.svc.cluster.local"

DNS resolution using cluster DNS won't work until Calico is running - another part of the "catch 22" situation. I think the CNI plugin is using your node's DNS configuration, which is how it ended up hitting your gateway.

How is it when I use <IP_ADDRESS>/localhost for KUBERNETES_SERVICE_HOST all the pods work (except calico-cube-controllers)? Is it because those working pods init from an external connection context?

calico-node, calico-typha and the CNI plugin all run on the host - localhost resolves to the IP address of the API server running on that node. You should see this if you kubectl get pods -o wide to view those pod's IP addresses - it should match the apiserver address.
calico-kube-controllers does not run in the host's network namespace. localhost resolves to its own IP address, which is not the same as the API server address.

And is this from an internal-to-cluster perspective, or external-to-cluster perspective? (as in where I "want" it connecting to).

I'm not entirely sure I understand this question, but Calico wants to connect to an IP address or domain name that can successfully reach the API server without relying on cluster networking being up (i.e., cluster DNS, cluster service implementation, etc), because Calico is responsible for bootstrapping all of those things.

I apologise in advance if I come across as unappreciative or gruff in any way, past, present, or future. I'm both frustrated, and excited to get this sorted.

Not at all :)

Also... considering my circumstance... should I be enabling eBPF before (or in-parallel with) declaring the KUBERNETES_SERVICE_HOST and _PORT? (And what about disabling kube-proxy? the test above kube-proxy was running at the time)

I would configure the env vars, and disable kube-proxy prior to launching Calico altogether.
To the best of my knowledge, you want something like one of the below options:

A DNS record that is resolvable by your hosts and returns the IP address(es) of your control-plane nodes.
A reverse proxy with a stable IP that can perform load balancing to one or more control-plane nodes.
A network load balancer that can perform the load balancing at the IP layer.

I don't think this is the "permanent" way I want this to run, but yeah pretty sure this falls in-line with what's been presented above. Yikes!

Glad you got something working!
I think the main takeaway here is using KUBERNETES_SERVICE_HOST=<real IP of control-plane node> works because your nodes can reach that address even before Calico is installed.
And frankly, this should be fine - the only downside really is that you're not getting the full benefit of running multiple API servers (i.e., if you need to do a rolling update, there won't be failover and clients will just wait for the node you specified to come back online).
You probably don't need to go through the intermediate steps of using localhost and restarting things, though.

Thanks for clarifying on the network namespace aspect for calico-kube-controllers. I suspected it was something like that, but wasn't having a good time finding consistent evidence to support/refute that.
I'm using Rancher to provision and manage the RKE2-based clusters, so there's really no state where I am "prior to launching Calico altogether". As for specific order-of-operations in provisioning the cluster and such, well I think I have an idea how that might look, but I'm not yet sure, and that's why I'm taking far too many notes and leveraging Argo+GitLab so I can go forwards/backwards in time to work towards having that fully known (order of operations for provisioning, etc). The "localhost" aspect I wasn't really considering as intermediary for provisioning, but more for the purpose of experimentation and learning. Trying that value, watching the outcome, poking the things in sensitive spots with pointy things and going "ooo" and "ahhh" then jotting notes down. It never seemed sustainable.
Yeah you are confirming what I suspected in terms of why it is succeeding, and I already anticipated the limitations of using only one control-plane assigned node's IP. I more did it to see if it would break in ways I didn't anticipate (and it didn't). I really do think the kube-vip thing has a substantially high probability of success for solving the matter we're talking about here, considering that's what it says on the tin as a solution multiple times (and who doesn't love tinned food?).
Maybe if I figure this out, it might be prudent for the Calico documentation to include said solution to help $futureHumans? But saying that not trying to put the egg before the horse's cart.

Would love to have better documentation on this! Especially if kube-vip is a viable option, documenting the steps you took to integrate with that would be awesome.

Would love to have better documentation on this! Especially if kube-vip is a viable option, documenting the steps you took to integrate with that would be awesome.

I already am aspiring to do my best on documenting such things! Once I figure out this last bit I am probably going to do a yuge publication (or multiples?) on my own personal bloggy/articley site to get eCred hehe. But I do suspect that the Calico docs (and Rancher/RKE2 docs?) would probably benefit from such insights too :D Yay!


Add node selector and tolerations to learning deployment

We are provisioning open-appsec through a custom Terraform module and use a helm_release block to pass in custom helm values. We wanted to control what nodes the learning and shared storage deployment pods were scheduled onto but it seems those fields are missing from the template files: https://github.com/openappsec/openappsec/blob/main/build_system/charts/open-appsec-k8s-nginx-ingress/templates/learning-deployment.yaml#L19-L72
Can nodeSelector and tolerations be added to the template file so they can be passed in through values file? To maintain full IaC, we had to create a solution using provisioners which seemed extremely counterproductive given the nature of helm charts.
This already exists for appsec deployment: https://github.com/openappsec/openappsec/blob/main/build_system/charts/open-appsec-k8s-nginx-ingress/templates/appsec.yaml#L292-L297

Hi @hspinos,
Thank you for the suggestion! We'll look into adding this to our next versions.

Hi, this was added as part of our 1.1.13 release


Support offline petitions

See:
https://petitions.moveon.org/sign/nra-board-member-rep
looks like

The petitions api has a property petitions.online -- when that is === 0 or false then we should display this instead.  Furthermore, besides name, id, etc, no other petition data should be expected to exist.

Note also, this doesn't currently work, because on prod we are preloading.  however this should also be shown when it hits the API for the sign data and gets:
{"response_code":404,"error_code":"petition_unavailable","description":"This petition has been taken down."}

Sorry, I get it now. I should handle offline petitions in different ways whether they are preloaded or fetched with ajax.

Will look like this on giraffe.


Server app accepts multi-admin commissioning with two identities on the same fabric

Problem
I was able to use multi-admin to commission a node with a second identity onto a single fabric.  This is against spec and will break the sdk.
Proposed Solution
Commissionees need to reject commissioning with a new identity for a fabric to which they are already a member.  Else, the sdk will definitely break.

@msandstedt What SDK version (SHA) is this?  What are the steps to reproduce?
I thought I had fixed this in https://github.com/project-chip/connectedhomeip/pull/16404 but if you're on a SHA after that then clearly something is broken somewhere...

@bzbarsky-apple,
This was at this rev in the all-clusters-app running on an m5stack:
commit 4967c0e0a51e3e0f0216c551d35b4cbde5aea7e4
Author: Yufeng Wang<EMAIL_ADDRESS>Date:   Fri Apr 15 10:24:06 2022 -0700

    [FanControl cluster] Add missing definitions for Fan Control cluster (#17416)

This was accomplished by:

commissioning
open commissioning window
commissioning again onto the same fabric

This was with a slightly modified chip-tool, but that shouldn't matter.  The commissionee needs to enforce this for itself.
I can check again.  Indeed, this hash is later than your fix.

So I just tried the following steps:

git checkout 4967c0e0a51e3e0f0216c551d35b4cbde5aea7e4
scripts/examples/gn_build_example.sh examples/chip-tool out/debug/standalone/
Build and flash m5stack
./out/debug/standalone/chip-tool pairing ble-wifi 17 ${SSID} ${PASSWD} 20202021 3840
./out/debug/standalone/chip-tool pairing open-commissioning-window 17 0 180 1000 1234
./out/debug/standalone/chip-tool pairing onnetwork 18 20202021

The chip-tool log has:
...
[1651698546317] [54195:40837545] CHIP: [CTL] Add NOC failed with error ../../../examples/chip-tool/third_party/connectedhomeip/src/controller/CHIPDeviceController.cpp:1213: CHIP Error 0x0000007E: Trying to add a NOC for a fabric that already exists
[1651698546317] [54195:40837545] CHIP: [CTL] Error on commissioning step 'SendNOC': '../../../examples/chip-tool/third_party/connectedhomeip/src/controller/CHIPDeviceController.cpp:1213: CHIP Error 0x0000007E: Trying to add a NOC for a fabric that already
[1651698546317] [54195:40837545] CHIP: [CTL] Failed to perform commissioning step 13
[1651698546317] [54195:40837545] CHIP: [CTL] Going from commissioning step 'SendNOC' with lastErr = '../../../examples/chip-tool/third_party/connectedhomeip/src/controller/CHIPDeviceController.cpp:1213: CHIP Error 0x0000007E: Trying to add a NOC for a fab
[1651698546317] [54195:40837545] CHIP: [CTL] Performing next commissioning step 'Cleanup' with completion status = '../../../examples/chip-tool/third_party/connectedhomeip/src/controller/CHIPDeviceController.cpp:1213: CHIP Error 0x0000007E: Trying to add
...
[1651698546364] [54195:40837540] CHIP: [TOO] Run command failure: ../../../examples/chip-tool/third_party/connectedhomeip/src/controller/CHIPDeviceController.cpp:1213: CHIP Error 0x0000007E: Trying to add a NOC for a fabric that already exists

And on the server side:
[1651697614231] [46172:40803622] CHIP: [ZCL] OpCreds: Received AddNOC command
[1651697614231] [46172:40803622] CHIP: [DMG] ICR moving to [ Preparing]
[1651697614231] [46172:40803622] CHIP: [DMG] ICR moving to [AddingComm]
[1651697614231] [46172:40803622] CHIP: [DMG] ICR moving to [AddedComma]
[1651697614231] [46172:40803622] CHIP: [ZCL] OpCreds: Failed AddNOC request. Status 9

@msandstedt I would really like steps to reproduce here....


Fix regression when matching containerID to Pod due to runtime prefixes

What does this PR do?
Currently due to the runtime prefix, we are never matching containers in the tagger's force refresh flow.
Issue was likely introduced by https://github.com/DataDog/datadog-agent/pull/3821
Proposed solution is to match only on container id (without runtime prefix).
Motivation
Fixing the issue with missing tags on logs sent really quick by newly created containers.
Additional Notes
Fix has been tested locally and on GKE, however it does not completely solve the issue we have internally.

@vboulineau could you add a release note?


Add Postal

A swift framework for working with emails.
Project URL
https://github.com/snipsco/Postal
Description
A swift framework providing simple access to common email providers.
Checklist

[x] Only one project is in this pull request
[x] Addition in chronological order (bottom of category)
[x] Supports iOS 7 or later
[x] Has a commit from less than 2 years ago
[x] Has a clear README in English
[x] Travis CI pass

Hey @havthgem, thanks for contributing! 😄

I just did what I should do. 😄


MacOS: Problem getting numpy include path.

Please make sure that this is a bug. As per our
Describe the current behavior
I am able to build on my development Mac. However, running on the CI Mac node, we get an error that looks like this:
2021-12-17T01:27:56.6979400Z Analyzing: target //tensorflow/lite/ios:TensorFlowLiteC_static_framework (1 packages loaded, 0 targets configured)
2021-12-17T01:27:58.6232140Z Analyzing: target //tensorflow/lite/ios:TensorFlowLiteC_static_framework (21 packages loaded, 10 targets configured)
2021-12-17T01:27:58.8729360Z INFO: Repository local_execution_config_python instantiated at:
2021-12-17T01:27:58.8731780Z   /Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/WORKSPACE:15:14: in <toplevel>
2021-12-17T01:27:58.8734480Z   /Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/tensorflow/workspace2.bzl:1108:19: in workspace
2021-12-17T01:27:58.8737750Z   /Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/tensorflow/workspace2.bzl:84:27: in _tf_toolchains
2021-12-17T01:27:58.8739200Z   /private/var/tmp/_bazel_runner2/14b6f7e45d646cdf7b1c6e3a405fb4ce/external/tf_toolchains/toolchains/remote_config/configs.bzl:6:28: in initialize_rbe_configs
2021-12-17T01:27:58.8740200Z   /private/var/tmp/_bazel_runner2/14b6f7e45d646cdf7b1c6e3a405fb4ce/external/tf_toolchains/toolchains/remote_config/rbe_config.bzl:158:27: in _tensorflow_local_config
2021-12-17T01:27:58.8740920Z Repository rule local_python_configure defined at:
2021-12-17T01:27:58.8742180Z   /Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/third_party/py/python_configure.bzl:275:41: in <toplevel>
2021-12-17T01:27:58.8812530Z INFO: Repository local_config_python instantiated at:
2021-12-17T01:27:58.8814680Z   /Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/WORKSPACE:15:14: in <toplevel>
2021-12-17T01:27:58.8816660Z   /Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/tensorflow/workspace2.bzl:1108:19: in workspace
2021-12-17T01:27:58.8818170Z   /Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/tensorflow/workspace2.bzl:94:21: in _tf_toolchains
2021-12-17T01:27:58.8818980Z Repository rule python_configure defined at:
2021-12-17T01:27:58.8820110Z   /Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/third_party/py/python_configure.bzl:294:35: in <toplevel>
2021-12-17T01:27:58.8864240Z ERROR: An error occurred during the fetch of repository 'local_execution_config_python':
2021-12-17T01:27:58.8865240Z    Traceback (most recent call last):
2021-12-17T01:27:58.8867660Z 	File "/Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/third_party/py/python_configure.bzl", line 213, column 39, in _create_local_python_repository
2021-12-17T01:27:58.8869530Z 		numpy_include = _get_numpy_include(repository_ctx, python_bin) + "/numpy"
2021-12-17T01:27:58.8870840Z 	File "/Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/third_party/py/python_configure.bzl", line 187, column 19, in _get_numpy_include
2021-12-17T01:27:58.8871650Z 		return execute(
2021-12-17T01:27:58.8872840Z 	File "/Users/runner2/.conan/data/tensorflow-lite/<IP_ADDRESS>+5089e313/ci/branch_feat_2.7.0/build/3b95326f653baf403ae4d70dae74814d9c4fef8a/tensorflow/third_party/remote_config/common.bzl", line 219, column 13, in execute
2021-12-17T01:27:58.8873970Z 		fail(
2021-12-17T01:27:58.8874300Z Error in fail: Problem getting numpy include path.
2021-12-17T01:27:58.8874970Z Traceback (most recent call last):
2021-12-17T01:27:58.8875640Z   File "<string>", line 1, in <module>
2021-12-17T01:27:58.8876820Z ModuleNotFoundError: No module named 'numpy'
2021-12-17T01:27:58.8877460Z Is numpy installed?

The only difference is, CI node uses Homebrew python 3.8, while the dev system is using system python.
I've tried using venv on both machines, which doesn't change the outcome.
I've also attempted setting PYTHON_BIN_PATH and PYTHON_LIB_PATH (for both venv and direct Homebrew python scenario) with no luck.
Describe the expected behavior
I'd expect it to build no matter which python is being used.
Contributing

Do you want to contribute a PR? (yes/no):
Briefly describe your candidate solution(if contributing):

Standalone code to reproduce the issue
Provide a reproducible test case that is the bare minimum necessary to generate
the problem. If possible, please share a link to Colab/Jupyter/any notebook.
Other info / logs Include any logs or source code that would be helpful to
diagnose the problem. If including tracebacks, please include the full
traceback. Large logs and files should be attached.

@w3sip ,
Can you please take a look at this SO link 1,2 and issue with the similar error.It helps.Thanks


Move Active negotiation selector to the Outlet iframe/tab

Currently user decide what token to use in the own page, where user have access to everyhting and webster can easy collect use tokens data by set mode to "passive" and track user for ads etc.
its not secure.
I suggest to move active negotiation token selector to the Outlet page.
In this case user always have to approve tokens to share, so webster cant silently track tokens where active negotiation set for Outlet.
It adds some challenge , because some browsers can force to show full size tabs, but Outlet page styles are separated from webster page and will look exact as we design it, no way to style overlap.
@nicktaras , @micwallace , @weiwu-zhang , what do you think?

Agreed. I did a basic proof of concept for how this might work: http://tnwebster.tk/
Let me know if you want me to link the repo so you can play around with some ideas.
Do you reckon we need token-level approval? For instance if the Outlet hosts tickets for multiple events or vendors? This isn't possible with the current TN outlet code, but I could see how it could be useful.

@micwallace , correct, this is what I mean.
also Outlet page can display switch/radio and allow user to select specific tokens to share (similar to the current token selector popup)
about option to read multiple tokens: no problem to open iframes with multiple Outlets. no need to make things more complicated. we can open Token1 Client with iframe to some.domain.com/token1.html(Token1 Outlet embedded) and Token2 Client with iframe to some.domain.com/token2.html(Token2 Outlet embedded)
In this case we have to add token name as param for all postMessages to avoid postMessages collisions between different tokens.

Let’s look into a solution to address this Oleh, Miccy. I Agree, really good points made.
Here are thoughts based the issue and ideas shared.
At this time in our current solution:

token meta is not learnt by the website until they connect to an off chain issuer for active.

For passive as you mentioned Oleh, tokens are learnt without user permission given.

Here are ideas towards a solution:

One idea is that we restrict passive negotiation to issuer websites. This would reduce complexity for general consumers of the token negotiator. It may have some restrictions depending on future use case needs.

Building upon your suggestion Oleh, by moving the overlay to an issuers outlet won’t work when there are multiple off chain tokens. I think this is an issue to restrict scalability of using more than one off chain token. However we could make an adjustment adding another Iframe like this:

Client > Main Iframe > Outlet A (attestations)
> Outlet B (attestations)
> Outlet C (attestations)
(Main Iframe would contain the overlay)
On 2 May 2022, at 11:26 pm, oleggrib @.***> wrote:

@micwallacehttps://github.com/micwallace , correct, this is what I mean.
also Outlet page can display switch/radio and allow user to select specific tokens to share (similar to the current token selector popup)
about option to read multiple tokens: no problem to open iframes with multiple Outlets. no need to make things more complicated. we can open Token1 Client with iframe to some.domain.com/token1.html(Token1 Outlet embedded) and Token2 Client with iframe to some.domain.com/token2.html(Token2 Outlet embedded)
In this case we have to add token name as param for all postMessages to avoid postMessages collisions between different tokens.
—
Reply to this email directly, view it on GitHubhttps://github.com/TokenScript/token-negotiator/issues/183#issuecomment-1115430668, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ABT6J4MCD3XJ2DMOWCD5LY3VIBI7ZANCNFSM5U3YRCLA.
You are receiving this because you were mentioned.Message ID: @.***>

@micwallace @nicktaras
is any page can request and receive all user tokens though hidden iframe?
I can see in examples that popup dont use iframe, but receive all tokens and request to select token on hotelBogota page. Right?

Hi @oleggrib, @micwallace,
Do we see any changes required to the management of attestations via this issue? This based on our current roadmap with regards to off chain technology.


Error parsing WSDL

Using the following WSDL: https://ics2wstest.ic3.com/commerce/1.x/transactionProcessor/CyberSourceTransaction_1.26.wsdl
I get the following error:
TypeError: Cannot read property 'elements' of undefined
at [object Object].postProcess (node_modules/soap/lib/wsdl.js:328:66)
at [object Object].postProcess (node_modules/soap/lib/wsdl.js:361:17)
at [object Object].postProcess (node_modules/soap/lib/wsdl.js:377:15)
at [object Object].postProcess (node_modules/soap/lib/wsdl.js:390:14)
at [object Object].postProcess (node_modules/soap/lib/wsdl.js:422:21)
at node_modules/soap/lib/wsdl.js:555:36
at [object Object].processIncludes (node_modules/soap/lib/wsdl.js:597:9)
at Array.1 (node_modules/soap/lib/wsdl.js:550:14)
at EventEmitter._tickCallback (node.js:192:40)
(That was by running a simple soap.createClient with the given URL.)

+1! same problem of turbogeek with Oracle-WebLogic


Markdown characters are too faint on the live preview

Context https://expensify.slack.com/archives/C03U7DCU4/p1707425947365449
Examples:

Problem
Markdown characters are too faint on the live preview
Solution
Change the color, maybe to our supporting text like so:

@tomekzaw please comment here so I can assign this issue to you - thanks!

commenting

Updated the image assets

Thanks, now I see it, I agree that Markdown syntax characters are too faint indeed.
Currently, we're using colors.productLight600 / colors.productDark600 (see here, here and here).
Sounds like an easy fix, will submit a PR with more visible colors.

Should be fixed with https://github.com/Expensify/App/pull/36320


[Snyk] Security upgrade scikit-learn from 1.0.2 to 1.5.0

This PR was automatically created by Snyk using the credentials of a real user.![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123)
Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):

cmd/suggestion/hyperband/v1beta1/requirements.txt

⚠ Warning
```
scikit-learn 1.0.2 requires scipy, which is not installed.
</details>

---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - Max score is 1000. Note that the real score may have changed since the PR was raised.
> - This PR was automatically created by Snyk using the credentials of a real user.
> - Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._

For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJlZTI4Mjg0Yi1lM2NkLTRhYWQtYTY4Zi01NTNiNmE1NjViZTEiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImVlMjgyODRiLWUzY2QtNGFhZC1hNjhmLTU1M2I2YTU2NWJlMSJ9fQ==" width="0" height="0"/>
🧐 [View latest project report](https://app.snyk.io/org/ryanhammerdick/project/a379a07b-de58-4296-8aa2-153be19dc8c3?utm_source=github&utm_medium=referral&page=fix-pr)
📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates)
🛠 [Adjust project settings](https://app.snyk.io/org/ryanhammerdick/project/a379a07b-de58-4296-8aa2-153be19dc8c3?utm_source=github&utm_medium=referral&page=fix-pr/settings)
📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities)

---

**Learn how to fix vulnerabilities with free interactive lessons:**

🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io/?loc=fix-pr)

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"scikit-learn","from":"1.0.2","to":"1.5.0"}],"env":"prod","issuesToFix":[{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-SCIKITLEARN-7217830","priority_score":658,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"freshness","label":true,"score":71},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Storage of Sensitive Data in a Mechanism without Access Control"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-SCIKITLEARN-7217830","priority_score":658,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"freshness","label":true,"score":71},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Storage of Sensitive Data in a Mechanism without Access Control"}],"prId":"ee28284b-e3cd-4aad-a68f-553b6a565be1","prPublicId":"ee28284b-e3cd-4aad-a68f-553b6a565be1","packageManager":"pip","priorityScoreList":[658],"projectPublicId":"a379a07b-de58-4296-8aa2-153be19dc8c3","projectUrl":"https://app.snyk.io/org/ryanhammerdick/project/a379a07b-de58-4296-8aa2-153be19dc8c3?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","pr-warning-shown","priorityScore"],"type":"auto","upgrade":[],"vulns":["SNYK-PYTHON-SCIKITLEARN-7217830"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

Pull Request Test Coverage Report for Build<PHONE_NUMBER>
Details

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage increased (+0.1%) to 72.974%

Totals

Change from base Build<PHONE_NUMBER>:
0.1%

Covered Lines:
3116

Relevant Lines:
4270

💛  - Coveralls


set default LLM to new registered user

What problem does this PR solve?
Type of change

[x] Bug Fix (non-breaking change which fixes an issue)

Azure-OpenAI has different API URLs, API Keys, and API Versions for different models. Is it possible for new users to use system-specified settings without needing to configure them separately?

Not supported yet.


VSCode doesn't show anything when Marketplace is offline

Issue Type: Bug
VS Marketplace is offline right now, when you try to find some extension it does not show anything.
I've tried reinstalling VSCode, removing all files from %user% folder, I've lost so many time before I saw that the marketplace is offline! It should have some error handling at least!
VS Code version: Code 1.26.1 (493869ee8e8a846b0855873886fc79d480d342de, 2018-08-16T18:38:57.434Z)
OS version: Windows_NT x64 10.0.17134

System Info

Item
Value

CPUs
Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz (8 x 2395)

GPU Status
2d_canvas: enabledchecker_imaging: disabled_offflash_3d: enabledflash_stage3d: enabledflash_stage3d_baseline: enabledgpu_compositing: enabledmultiple_raster_threads: enabled_onnative_gpu_memory_buffers: disabled_softwarerasterization: enabledvideo_decode: enabledvideo_encode: enabledwebgl: enabledwebgl2: enabled

Memory (System)
15.89GB (11.40GB free)

Process Argv
C:\Users\davic\AppData\Local\Programs\Microsoft VS Code\Code.exe

Screen Reader
no

VM
0%

Extensions: none

Marketplace issues are tracked by #57851
Keeping this issue open to track improving the user experience when the marketplace is down

@mjbvz How about a more useful error message that is returned if it detects it can't connect to the Marketplace like:
Unfortunately, we cannot seem to connect to the Marketplace at this time, please check back later and perhaps add a link to a Marketplace status monitor of some sorts, or integrate it right into the message itself?

@beastdestroyer That is a good idea.
Updated to show We cannot connect to the Extensions Marketplace at this time, please try again later. when the request to connect to the Marketplace fails
Will show the existing No extensions found. when the request is successful, but no results were found indeed.
Additional info from the http request status text will show up in the console (Help -> Toggle Developer Tools -> Console) as before.


feat: Add character link in moderation message

Fixes #75

#80  👈
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @aMediocreDad and the rest of your teammates on  Graphite


Description
dev branch contains important fixes of Kotlin Multiplatform memory leaks.
How to test
Integrate pre-release artifacts into a KMP sample/app and run it with a memory profiler.
Types of changes
See the changed files
Checklist

[x] Create pull request as draft initially, unless its complete.
[x] Add tests to cover changes as needed.
[x] Update documentation as needed.
[x] If there is a related Issue, mention it in the description.

If you're adding a new blockchain

[x] I have read the guidelines for adding a new blockchain.

Hi @satoshiotomakan, I hope you're ready for some holiday magic. Is there any chance we could sprinkle some Christmas cheer by merging this PR into the master branch before Christmas Day? It would be a fantastic gift for our project!

Hey @10gic, I would merge right now, but I have to wait for the security audit. Requested one more round one week ago, really hope to give an update ASAP.
If no update next week, I'll push them so to merge it before Christmas Day :facepunch:
Wish we all can sleep well soon :)


Remove an out of date reference to RT

Checklist

[x] documentation is added or updated
[ ] tests are added or updated

but not the boringssl directory.  +1

Gah. How did that get in there!!

Pushed. Thanks.


Feat(eos_cli_config_gen): Add multiple dot1x features

Change Summary
Adding multiple dot1x features to support the following cli lines:
dot1x authentication failure action traffic allow vlan 800
dot1x host-mode multi-host authenticated
dot1x mac based authentication
dot1x timeout tx-period 3
dot1x timeout reauth-period server
dot1x reauthorization request limit 3

Related Issue(s)
n/a
Component(s) name
arista.avd.eos_cli_config_gen
Proposed changes
Data Model additions are as follows:
dot1x:
  authentication_failure:
    action: < "allow" | "drop" >
    allow_vlan: < 1-4094 >
  host_mode:
    mode: < "multi-host" | "single-host" >
    multi_host_authenticated: < true | false >
  mac_based_authentication:
    enabled: < true | false >
    always: < true | false >
    host_mode_common: < true | false >
  timeout:
    idle_host: < 10-65535 >
    quiet_period: < 1-65535 >
    reauth_period: < 60-4294967295 | server >
    reauth_timeout_ignore: < true | false >
    tx_period: < 1-65535 >
  reauthorization_request_limit: < 1-10 >

How to test
Will add molecule test ethernet-interfaces and run the following test:
molecule converge -s eos_cli_config_gen -- --limit ethernet-interfaces

Checklist
User Checklist

N/A

Repository Checklist

[x] My code has been rebased from devel before I start
[x] I have read the CONTRIBUTING document.
[x] My change requires a change to the documentation and documentation have been updated accordingly.
[ ] I have updated molecule CI testing accordingly. (check the box if not applicable)

Looking for approval on this data model before coding the Jinja templates.

@mthiel117 looks fine.

Thanks @ClausHolbechArista
I will get started on this next week.

Since dot1x has so many features, it will be hard to note all possible features and values in a markdown table for documentation.  Any ideas on how to handle this?

Since dot1x has so many features, it will be hard to note all possible features and values in a markdown table for documentation. Any ideas on how to handle this?

If the features are in the "nerd knob" category, you can skip the table for those, but for widely used features, we should include them in an overview.

Looking forward to feedback/suggestions.


Support multiple markup languages in inventory

The inventory only support YAML right now, but it would be cool to add support for TOML, JSON and XML (would have to serialize back to YAML to feed into reclass).

Hello @adrianchifor. I would like to work on this issue for Gsoc. Adding multiple markup lang gives flexibility to the tool and to the users. I feel this is a good issue for me to work on this project.

Hey @adrianchifor , I was exploring this issue and found out that in our current implementation, we have used reclass API by supplying with paths of yaml files only (in the function inventory_reclass) to generate "reclass inventory".
I am thinking for in memory serialization of above formats into yaml but the object supplied to reclass is storage(which essentialy contains reclass_config with appropriate paths of yaml). Is there some other API of feeding into reclass as well ? because generating corresponding yaml files for above formats is probably not a good idea.

That's a good question. We use storage_type: yaml_fs right now but as far as I'm aware there isn't a way at the moment to use memory for reclass. This change is quite tricky, high risk as it can easily break current functionality and low reward in terms of features and productivity, so I wouldn't worry too much about it.
Another thing we can look at is supporting more outputs like toml and xml, in addition to yaml and json.
Will close this issue for now in favor of https://github.com/deepmind/kapitan/issues/256


[ONNX][frontend] support gridsample for onnx frontend

This PR supports gridsample op for onnx frontend, and change the rounding method in topi in order to fit onnx. Test data from ONNX opset is also adding in this PR.

@Mousius, kindly review, please.

Thanks for your contribution! However this was done already in another PR. This can be closed now.


Team 17

glhf

Your build is currently failing.
./run.py:2:1: F401 'os' imported but unused
./run.py:3:1: I100 Import statements are in the wrong order. 'import json' should be before 'import os'
./bot/cogs/snakes.py:4:1: F401 'bs4.BeautifulSoup' imported but unused
./bot/cogs/snakes.py:4:1: I201 Missing newline between import groups. 'from bs4 import BeautifulSoup' is identified as Third Party and 'from typing import Any, Dict' is identified as Stdlib.
./bot/cogs/snakes.py:5:1: I201 Missing newline between import groups. 'from discord.ext.commands import AutoShardedBot, Context, command' is identified as Third Party and 'from bs4 import BeautifulSoup' is identified as Third Party.


Wrap with div (Shft-Alt-W) doesn't work inside Razor code blocks

Describe the bug:
VS 2022 17.2 reintroduced the Shft-Alt-W shortcut to wrap the selected code in a
 in the Razor editor. This works fine for code that's not inside a Razor code block, but doesn't do anything otherwise.
Version used:
VS2022 17.2.0, 7.8.04084
To reproduce:
Add a string variable called _name to a Razor page, then add the following markup...

Hello @_name

Select this code and press Shft-Alt-W. VS wraps it in a
, resulting in the following...

Hello @_name

Now change the code to look like this...
@if (string.IsNullOrWhiteSpace(_name)) {

Who are you?

} else {

Hello @_name

}

Select one of the HTML blocks inside the curly braces and press Shft-Alt-W. Nothing happens.
Expected behavior:
I would expect the selected code to be wrapped in a
, irrespective of whether or not it's inside a Razor code block.
Actual behavior:
Nothing happens.

I have the same issue

As a workaround, the feature seems to work fine if you have the cursor inside either of the
 tags, rather than selecting the whole region. I understand that might not work in your real world repro.

@davidwengier Thanks, that does seem to do the trick, although it's a shame it doesn't work the way you'd expect.

@davidwengier This doesn't seem to work for self closing Blazor components.
Also this is only an issue inside a @if code block. Whereas within @foreach it has slightly different results, it works even with self closing components, but only built in HTML components. Blazor components say <ValidationMessage /> don't work.

Thanks for the feedback @aryehsilver, will see what I can do to address those in #6431 too.
To set your expectations though, until we can make razor compiler updates in this area, there will probably always be some edge cases.


No longer works (because node_modules inaccessible)

https://tools.wmflabs.org/oojs-ui/oojs-ui/demos/ no longer works, throwing cryptic errors.
We're now pulling jQuery and stuff from node_modules directory, which is not accessible: https://tools.wmflabs.org/oojs-ui/oojs-ui/node_modules/jquery/dist/jquery.js redirects to main page.

@MatmaRex Please let me know if everything you need works now. And if you have spare time, watch out whether the 7zips are properly created. Thanks :)

https://tools.wmflabs.org/oojs-ui/oojs-ui/demos/ is operational again. Thank you!


[BUG] Rendering a sheet with editable: false doesn't make its activities read-only

My module opens a preview of an item, a clone that has some settings altered, so the player/gm can see how this will look like before committing.
I do this by calling:
item.sheet.render(true, {editable: false});

Although this makes everything on the item's sheet read-only, it does not do so for the activities. Those can still be opened and edited.
I expect that this is a bug. It does work as expected when opening an item from a locked compendium, as I see that it only checks for being in a compendium or whether the user has edit permissions.
FoundryVTT: v12.331
dnd5e: v4.03

would the bug you are reporting have this behavior when we try to create or edit a sheet?

@Garnuth That doesn't look anything like what I'm seeing. I'm talking about item sheets, not actor sheets.
Although I don't recognize the dialog you posted. D&D Beyond is not part of this repo, thus I suspect your bug is related to the module that added that dialog.

@morepurplemorebetter thank you for your guidance :-)


win-19 is dead.

Type of Request
bug
Infrastructure Environment
LUCI, Github, Cocoon scheduler, Autosubmit, etc...
What is happening?
win-19 is dead.

Steps to reproduce
Step 1:
Step 2:
..
Step n:
Expected results
I expect to see X when Y is finished.

win-19 network adapter went offline by itself, rebooting machine to restart network service.


Cannot call Path.transform with internal Float64List

It looks like Path.transform cannot accept an internal Float64List as its argument. I've done a little digging and I think what happens is the following:
First we invoke this method:
static void Path_transform(Dart_NativeArguments args) {
  DartCall(&CanvasPath::transform, args);
}

In return, this converts the Float64List argument to a tonic::Float64List. This ends up calling Dart_TypedDataAcquireData and when the argument is a Float64List allocated internally (not an external one), then the VM disallows using any part of its API that might lead to garbage collections until Dart_TypedDataReleaseData has been called.
I think the issue is that the tonic::Float64List deconstructor hasn't been called when we need to create the Dart wrapper for the result of calling CanvasPath::transform. That means that we have a need to call into the VM before Dart_TypedDataReleaseData has been called. That breaks.
Maybe this issue can be worked around at the tonic level. Right now, hidden in sea of templates, it appears that the DartCall in Path_transform unfolds to something like this:
static void Path_transform(Dart_NativeArguments args) {
  DartConverter<ftl::RefPtr<CanvasPath>>::SetReturnValue(args,
     ... // call CanvasPath::transform with the right receiver an this argument:
     DartConverter<const tonic::Float64List&>::FromArguments(args, 1)
     ...
  );
}

Maybe that could be changed to something like this to allow the tonic:Float64List to be destroyed before we need to set the return value?
static void Path_transform(Dart_NativeArguments args) {
  ftl::RefPtr<CanvasPath> result =
     ... // call CanvasPath::transform with the right receiver an this argument:
     DartConverter<const tonic::Float64List&>::FromArguments(args, 1)
     ...
  ;
  DartConverter<ftl::RefPtr<CanvasPath>>::SetReturnValue(args, result);
}

Steps to Reproduce
Run the following program:
import 'dart:ui' show Path;
import 'dart:typed_data' show Float64List;

main() {
  new Path().transform(new Float64List(16));
}

Logs
[FATAL:../../lib/tonic/dart_class_provider.cc(24)] Check failed: !Dart_IsError(class_handle). Path: Internal Dart data pointers have been acquired, please release them using Dart_TypedDataReleaseData.

Flutter Doctor
[✓] Flutter (on Linux, channel master)
• Flutter at /usr/local/google/home/kasperl/Dart/flutter
• Framework revision b00e6cda66 (2 weeks ago), 2016-10-04 20:29:10
• Engine revision 27d012a790
• Tools Dart version 1.20.0-dev.5.0
[✓] Android toolchain - develop for Android devices (Android SDK 24.0.3)
• Android SDK at /usr/local/google/home/kasperl/Android/Sdk
• Platform android-24, build-tools 24.0.3
• OpenJDK Runtime Environment (build 1.8.0-google-v7-132676107-132666263)
[✓] Atom - a lightweight development environment for Flutter
• flutter plugin version 0.2.1
• dartlang plugin version 0.6.6
[✓] Connected devices
• None

Yeah, maybe something like this:
diff --git a/dart_args.h b/dart_args.h
index 190fcdc..379eb0a 100644
--- a/dart_args.h
+++ b/dart_args.h
@@ -121,8 +121,9 @@ struct DartDispatcher<IndicesHolder<indices...>, ResultType (*)(ArgTypes...)>
       : DartArgHolder<indices, ArgTypes>(it)..., it_(it) {}

   void Dispatch(FunctionPtr func) {
-    DartReturn((*func)(DartArgHolder<indices, ArgTypes>::value...),
-               it_->args());
+    ResultType result = (*func)(
+        DartArgHolder<indices, ArgTypes>::value...), it_->args();
+    DartReturn(std::move(result));
   }

   ResultType DispatchCtor(FunctionPtr func) {
@@ -160,9 +161,9 @@ struct DartDispatcher<IndicesHolder<indices...>, ResultType (C::*)(ArgTypes...)>
       : DartArgHolder<indices, ArgTypes>(it)..., it_(it) {}

   void Dispatch(FunctionPtr func) {
-    DartReturn((GetReceiver<C>(it_->args())->*func)(
-                   DartArgHolder<indices, ArgTypes>::value...),
-               it_->args());
+    ResultType result = (GetReceiver<C>(it_->args())->*func)(
+        DartArgHolder<indices, ArgTypes>::value...), it_->args();
+    DartReturn(std::move(result));
   }
 };

That trick didn't help

I haz a fix.


Add Home Assistant Add-ons

Our dataset is missing several Home Assistant extensions that we could include in the new Building Energy Monitoring section and others. Here are some examples we would like to list. Some projects may already be listed:
https://github.com/klaasnicolaas/home-assistant-glow
https://github.com/KartoffelToby/better_thermostat
https://github.com/StephanJoubert/home_assistant_solarman
https://github.com/flixlix/power-flow-card-plus
https://github.com/MindFreeze/ha-sankey-chart
https://github.com/Pirate-Weather/pirate-weather-ha
https://github.com/davidusb-geek/emhass
https://github.com/reptilex/tesla-style-solar-power-card
https://github.com/FL550/dwd_weather
https://github.com/CJNE/ha-myenergi
https://github.com/flixlix/energy-flow-card-plus
https://github.com/hif2k1/battery_sim
https://github.com/radical-squared/aquatemp
https://github.com/macxq/foxess-ha
https://github.com/jmcollin78/solar_optimizer
https://github.com/patman15/BMS_BLE-HA
https://github.com/klaasnicolaas/home-assistant-glow
Do you know of more projects that are relevant for environmental sustainability as part of Home Assistant? @balloob

There is also: https://github.com/jpbede/aioelectricitymaps which is added as a core integration in Home Assistant.

Thanks for the tip! @VIKTORVAV99 Do you want to add this to the dataset? If not, I will do it next week.

I'm planning on adding Electricity Maps (the data provider) so I can take a look at adding the add-on as well!

@VIKTORVAV99 Electricity Maps is one of the most popular projects in this entire open source ecosystem and is therefore already listed. :stuck_out_tongue_winking_eye:

@VIKTORVAV99 Electricity Maps is one of the most popular projects in this entire open source ecosystem and is therefore already listed. :stuck_out_tongue_winking_eye:

Oh nice! I didn't see it when I skimmed through them all but happy to hear that!

All project reviewed.


Jekyll not picking up include on pages with "allowed_hashes"

On pages like those linked below (which have the allowed_hashes key in the YAML header -- maybe the clue) adding an include to the page only works if you click the tabs into the "right-most" option.
https://github.com/cockroachdb/docs/blob/master/v2.0/install-cockroachdb.html is a good example, because in order to see the included content (which you can replicate using the patch at the bottom of this comment), you need to click the Windows tab, and then the Use Docker tab.
This issue also affects https://github.com/cockroachdb/docs/tree/master/v2.0/start-a-local-cluster-in-docker.md, which prompted me to file the issue.  In that case I was trying to add the note, but it would only appear when I clicked the Windows tab.
diff --git a/v2.0/install-cockroachdb.html b/v2.0/install-cockroachdb.html
index 1f449f7c..c0a94bed 100644
--- a/v2.0/install-cockroachdb.html
+++ b/v2.0/install-cockroachdb.html
@@ -563,6 +563,10 @@ $(document).ready(function(){

What's Next?

Quick start a multi-node cluster across multiple Docker containers on a single host, using Docker volumes to persist node data, or explore running a physically distributed cluster in containers using orchestration tools.

+{{site.data.alerts.callout_info}}
+{% include available-capacity-metric.md %}
+{{site.data.alerts.end}}
+
 {% include diagnostics-callout.html %}

@rmloveland, I don't think this is an issue anymore, but please open if you disagree.


mbtileserver: 0.8.0 → 0.8.1

Motivation for this change
Changelog
Things done

Built on platform(s)

[x] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

[ ] For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[x] Tested basic functionality of all binary files (usually in ./result/bin/)
22.05 Release Notes (or backporting 21.11 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module
[ ] (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes

[x] Fits CONTRIBUTING.md.

Please drop the unused stdenv from args (on line 1).

Please drop the unused stdenv from args (on line 1).

Removed.

@ofborg build mbtileserver


How to include fatfs component

Hello,
I am trying to;
#include <esp_vfs_fat.h>

However, the compiler complains with:
esp_vfs_fat.h: No such file or directory
I have been trying for some time to include this into the CMakeLists.txt file but to no avail. How do I add this component to my project ?
This is what I have tried:
get_filename_component(
    EXTRA_COMPONENT_DIRS
    "amazon-freertos/vendors/espressif/esp-idf/components/fatfs" ABSOLUTE
)

list(APPEND IDF_EXTRA_COMPONENT_DIRS ${EXTRA_COMPONENT_DIRS})

Thanks

Hi @taherrera
The following should work
diff --git a/vendors/espressif/boards/esp32/CMakeLists.txt b/vendors/espressif/boards/esp32/CMakeLists.txt
index 11d77e4ad..d5e9b1ea1 100644
--- a/vendors/espressif/boards/esp32/CMakeLists.txt
+++ b/vendors/espressif/boards/esp32/CMakeLists.txt
@@ -440,6 +440,7 @@ target_include_directories(
     ${IDF_PROJECT_EXECUTABLE}
     PUBLIC
         "${esp_idf_dir}/components/esp_ringbuf/include"
+        "${esp_idf_dir}/components/fatfs"
         $<TARGET_PROPERTY:AFR::kernel,INTERFACE_INCLUDE_DIRECTORIES>
         $<TARGET_PROPERTY:AFR::ble_hal::mcu_port,INTERFACE_INCLUDE_DIRECTORIES>
         $<TARGET_PROPERTY:AFR::wifi::mcu_port,INTERFACE_INCLUDE_DIRECTORIES>
@@ -452,6 +453,8 @@ target_link_libraries(
         AFR::utils
         AFR::ble
         AFR::common_io
+    PUBLIC
+        idf::fatfs
 )

 if(AFR_METADATA_MODE)
diff --git a/vendors/espressif/boards/esp32/aws_demos/application_code/main.c b/vendors/espressif/boards/esp32/aws_demos/application_code/main.c
index 617a99e61..325bbc230 100644
--- a/vendors/espressif/boards/esp32/aws_demos/application_code/main.c
+++ b/vendors/espressif/boards/esp32/aws_demos/application_code/main.c
@@ -74,6 +74,8 @@
     #include "iot_ble_numericComparison.h"
 #endif

+#include "vfs/esp_vfs_fat.h"
+
 /* Logging Task Defines. */
 #define mainLOGGING_MESSAGE_QUEUE_LENGTH    ( 32 )
 #define mainLOGGING_TASK_STACK_SIZE         ( configMINIMAL_STACK_SIZE * 4 )
@@ -136,6 +138,7 @@ int app_main( void )
     /* Perform any hardware initialization that does not require the RTOS to be
      * running.  */

+    esp_vfs_fat_rawflash_unmount("test", "test");
     prvMiscInitialization();

     if( SYSTEM_Init() == pdPASS )

Thanks, now it isn't complaining about not finding the directory.
Is this procedure something I should do on all native IDF components that seem not to be found ? Has this component been ever used on amazon-freertos? I would like to know in case I get some strange errors while using the component..
Is changing vendors/espressif/boards/esp32/aws_demos/application_code/main.c mandatory for this to work on a custom application or is it just to prove its working?
Thanks

Hi @taherrera
The change to main.c was to verify that it linked correctly, and that the change works. You can omit these changes to main.c and use the esp_vfs_fat.h as you please.
If you want to add more components, you can follow the same process, including that component's includes, and linking in a similar fashion with idf::<component> syntax.


feat: add action placeholder in actions scorer

Add placeholder when the actions list is empty in a train dialog. Similar to the other lists on entities, actions, dialogs page etc.
The case would only occur if someone creates new train dialog with no actions, but that's what I usually do as I create new models by starting from train dialogs and creating actions as I go.
We already have a + Actions button so it doesn't change much but I thought the user might feel lost and wonder if the list is broken since there are no items for any of the columns.
Before:

After:

Unrelated but as I was testing there is bug with Score Actions button when there is no actions.

Hmm, now this PR is stuck. Dang

:tada: This PR is included in version 0.349.0 :tada:
The release is available on:

npm package (@next dist-tag)
GitHub release

Your semantic-release bot :package::rocket:


[docs] use correct json mime type in example

If it's not application/json, some servers will not parse it properly into json (as in my case, the nodejs express.json() middleware)
Checklist
Not all of these might apply to your change but the more you are able to check
the easier it will be to get your contribution merged.

[x] CI passes
[x] Description of proposed change
[x] Documentation (README, code doc blocks, etc) is updated
[ ] Existing issue is referenced if there is one
[ ] Unit tests for the proposed change

thanks for taking the time to contribute!


Incredible slow mathbb rendering

A page with simply {\mathbb{R}} as its full content takes about 10 seconds (!!!) to render.
This happens not only the first time I open the page but after each reloading, it doesn't seem to be a matter of font caching but I can't say for sure.
I'm using the the TeX-AMS_HTML config.

Indeed everything seems to be cached the second time I load the page:

Anyway I have to wait about 10 seconds to get the R correctly rendered. Is that normal? Something like $x^2$ renders instantaneously, everything else being the same.

Another fact: the last two lines in the screenshot above, while they say "cached", appear once the final render is done, that is about 10 seconds later than the rest of the above lines.

This sounds like the standard 15s timeout with a bad loadComplete call. But without a live page, its hard to tell.

Could you check how much this take to produce a correctly rendered font for you?
<html>
<head>
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.5/MathJax.js?config=TeX-AMS_HTML"></script>
</head>
<body>
<div style="display:none">
\[ \newcommand{\R}{\mathbb{R}} \]
</div>
\( \R \)
</body>
</html>

Thanks.

Around 1.71s from a clean browser cache, about 0.2s between the last part of MathJax's parts arriving and the final rendering.

The page loads quickly for me as well.  Peter is right that this sounds like the 10 second timeout that MathJax uses while waiting for a file that is not loading.
Try entering MathJax.Message.Log() in the browser's console window and see if there is anything there about files not being able to be loaded.

There seems to be a problem loading fonts, indeed.
MathJax.Message.Log()

Loading [MathJax]/config/TeX-AMS_HTML.js
Loading [MathJax]/extensions/TeX/newcommand.js
Loading [MathJax]/jax/output/HTML-CSS/jax.js
Loading [MathJax]/jax/output/HTML-CSS/fonts/TeX/fontdata.js
Loading [MathJax]/jax/output/HTML-CSS/fonts/TeX/AMS/Regular/Main.js
Loading [MathJax]/jax/output/HTML-CSS/fonts/TeX/AMS/Regular/BBBold.js
Loading web-font TeX/AMS/Regular
Can't load web font TeX/AMS/Regular
Firefox can't load web fonts from a remote host
Web-Fonts not available -- using image fonts instead
Loading [MathJax]/jax/output/HTML-CSS/imageFonts.js
Loading [MathJax]/fonts/HTML-CSS/TeX/png/imagedata.js"

Sounds like an installation issue. Are the fonts at those locations? If they are not on the same domain, have you set access control headers for the fonts? Cf. https://docs.mathjax.org/en/latest/installation.html#notes-about-shared-installations

Ok, thanks. I don't think this is my case:

There is a solution to this, however, if you manage the server where MathJax is installed, and if that server is running the Apache web server.

Short of this, can I reduce the timeout at least?
OTOH I assume this is working for me despite not being able to download web fonts because I've the right fonts locally installed. Now, supposing that anyone else is accessing my page from firefox and not being able to download the web fonts, what would be the consequence? No latex rendering at all? Or just some broken parts  here and there?

There are a number of reasons why MathJax might be having trouble with the fonts.  One is Peter's suggestion that you have an installation issue.  Are you using MathJax from a CDN, or from your own server?
Another is that the fonts actually are getting through, but that MathJax is having trouble detecting that.  The mechanism used to detect when a web font has arrived is rather fragile, and can be affected by the CSS on your page.  Did the test page that you listed above also show the delay?
A third possibility is that you have disabled page-specified font in your browser, which would prevent MathJax from changing to the web fonts at all, and that would certainly cause the problem you are having.

I assume this is working for me despite not being able to download web fonts because I've the right fonts locally installed.

No, MathJax is not using locally installed fonts for you because it is trying to load the web-based fonts.  If it had detected the local fonts, it would not be trying to load web versions. The reason it works for you is because it has switched to images rather than true fonts as a fallback to get you something that works.  You can see this in the last lines of the message log:
Web-Fonts not available -- using image fonts instead
Loading [MathJax]/jax/output/HTML-CSS/imageFonts.js
Loading [MathJax]/fonts/HTML-CSS/TeX/png/imagedata.js"

So the result for others using your site when this happens to them should be the same result as you are seeing.

Short of this, can I reduce the timeout at least?

You can, but I wouldn't recommend it.  It would be better to figure out why the fonts are not arriving (or why they aren't being detected).  Also, if you set it too short, you might end up incorrectly thinking the font isn't arriving when you actually haven't waited long enough.  The default is 8 seconds for a desktop computer and 15 for a mobile device (since they tend to have slower connections).  If you must, you could change these using something like
<script type="text/x-mathjax-config">
MathJax.Hub.Register.StartupHook("HTML-CSS Jax Startup") {
    var HTMLCSS = MathJax.OutputJax["HTML-CSS"];
    HTMLCSS.Font.timout = (MathJax.Hub.Browser.isMobile ? 10 : 4) * 1000;
}
</script>

just before the script that loads MathJax.js itself.  This should reduce the delay to 10 seconds for mobile and 4 for desktop, but I wouldn't go any lower than that.

Ok, thanks again.

It would be better to figure out why the fonts are not arriving (or why they aren't being detected).

Fine. I'm answering your questions below. Please let me know if you need additional debugging from my side.

Are you using MathJax from a CDN, or from your own server?

Just the snippet I shared above. Besides cloudflare I tested rawgit but the results were the same.

Did the test page that you listed above also show the delay?

Yes, the delay was reported for that page, the reported logs are also from loading that page from my local file system.

A third possibility is that you have disabled page-specified font in your browser

Doesn't seem to be the case:

Are there any plugins the might be interfering with the fonts?  Have you tried starting Firefox without plugins (see these instructions)?

Still getting the same noticeable delay with no addon enabled.

Do you have a minimum font size set?
I'm running out of ideas for what might be the problem.   It might be that the CDN edge-node that is closest to you is having a problem and isn't serving the font, but the fact that you had the same problem with rawgit would tend to preclude that.  I suppose there might be some issue with a firewall or router that is configured to not forward the fonts; do you see web fonts on other pages?
My only other suggestion would be to switch from the HTML-CSS output to CommonHTML or SVG output (neither of which have to wait for fonts, and so have no font delays).  Use TeX-AMS_CHTML or TeX-AMS_SVG instead of TeX-AMS_HTML.

I suppose there might be some issue with a firewall or router

I don't think so but anyway I'll try connecting from another place later and report the outcome here.

Use TeX-AMS_CHTML or TeX-AMS_SVG instead of TeX-AMS_HTML

Both of these worked as a charmed. I don't even know what Common HTML is, will have to research this. Is there any drawback with these backends that I should worry about?

Ok, this settles the question for me

The CommonHTML output processor produces high-quality output in all modern browsers, with results that are consistent across browsers and operating systems. This is MathJax’s primary output mode since MathJax v2.6. Its major advantage is its quality, consistency, and speed as well as support for server-side generation.

If you are still interested in finding the underlying issue I've no problem in further debugging. But from a practical perspective I'm ok with CHTML, I was just using what I used for a long time without thinking about it.

What is strange though is that both CHTML and HTML-CSS are announced as

uses web-based fonts so that users don’t have to...

but, nevertheless, the delay is not happening here for CHTML. That discards the firewall hypothesis, I guess.

Yes, both HTML-CSS and CommonHTML use web fonts.  But CommonHTML doesn't try to detect their presence, while HTML-CSS does, and it is that detection that is probably going wrong for some reason (I did say it was fragile).  HTML-CSS needed to wait for the fonts to arrive because (in the old days before browsers were more consistent with each other), MathJax had to measure the actual displayed subexpressions in order to determine their size, and that meant the font had to be the right one.  CommonHTML doesn't have to do that because modern browsers are more consistent about their layout (thanks to better standards and better adherence to them).
One last thing to check:  did you change the default font in your browser, or have you set a default stylesheet that is not the standard one?  It is possible this could cause the detection to fail, though it is unlikely you have changed either of those.

That discards the firewall hypothesis, I guess.

Yes, that does seem to be the case.  It was a longshot idea in any case.

did you change the default font in your browser

Some of them, but still a rather standard setting:

have you set a default stylesheet that is not the standard one?

No, I haven't. I try not to do fancy things with my browser.

OK, I don't think those fonts should be any problem.  I'm stumped.  But at least you can use CommonHTML instead.

Yes, it's ok for me. In fact, I'm better than before in that I learned I was using an somewhat outdated backend. Close this if you want. Thank you very much!

I think you'll find that CommonHTML is faster at rendering the math, so you should like that.
Good luck!


Fixing CI build error

use yarn instead of npm install for installation

Codecov Report

:exclamation: No coverage uploaded for pull request base (master@c3cf35a). Click here to learn what that means.
The diff coverage is n/a.

@@            Coverage Diff            @@
##             master       #5   +/-   ##
=========================================
  Coverage          ?   49.36%
=========================================
  Files             ?        6
  Lines             ?       79
  Branches          ?        8
=========================================
  Hits              ?       39
  Misses            ?       34
  Partials          ?        6

:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more

 Quality gate: NA
Details


Fix unit test

Codecov Report

Merging #443 (6b8ef8f) into main (1a456b1) will increase coverage by 0.93%.
The diff coverage is 91.66%.

:exclamation: Current head 6b8ef8f differs from pull request most recent head 051dbe4. Consider uploading reports for the commit 051dbe4 to get more accurate results

:exclamation: Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more.
@@            Coverage Diff             @@
##             main     #443      +/-   ##
==========================================
+ Coverage   95.02%   95.95%   +0.93%
==========================================
  Files          57       57
  Lines        4182     4181       -1
==========================================
+ Hits         3974     4012      +38
+ Misses        163      122      -41
- Partials       45       47       +2

Impacted Files
Coverage Δ

dtmsvr/storage/boltdb/boltdb.go
95.57% <0.00%> (+2.54%)
:arrow_up:

dtmsvr/storage/trans.go
100.00% <ø> (ø)

dtmsvr/cron.go
93.18% <100.00%> (ø)

dtmsvr/storage/redis/redis.go
98.71% <100.00%> (+1.83%)
:arrow_up:

dtmsvr/storage/sql/sql.go
98.63% <100.00%> (+5.35%)
:arrow_up:

... and 3 files with indirect coverage changes
:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more


Backend use okay?

It says not to use it in production with authorization issues, but what if I just use it on backend so as to avoid having to learn joins and unions and etc?

I'm also doing it on Cloudflare d1 that doesn't charge by the usage, so an ORM optimized for performance isn't important.


feat: add bun related docs

@KnorpelSenf The issue of adding Bun is becoming more and more pressing. At the moment even plugin conversation, which could throw errors before, is working more and more stable.
+1 from me for adding documentation for Bun
Btw, many users from Russian-speaking chat also actively use it.

@winstxnhdw can you confirm that they have fixed their support for conversations, i18n, etc?

@winstxnhdw can you confirm that they have fixed their support for conversations, i18n, etc?

Was i18n ever an issue?

conversations

I think all plugins compiled with dnt were, but I have never used bun, it's only what people reported

So they finally fixed it? That's pretty good!

Actually, that section is pretty outdated anyway. Neither the part about Node nor the part about Deno are accurate anymore. I will fix things up in a subsequent PQ. We can keep this as-is for now.

@stonega what about https://grammy.dev/guide/api#type-definitions-for-the-bot-api?

Closing due to inactivity.


Fullscreen crashes

Geode Issue

[x] I confirm that this crash is NOT related to a mod but directly to Geode Loader itself.

Platform
Windows
Geode Version
v3.0.0
Mods Installed
No response
Steps to Reproduce

Have 2.206 (Fullscreen has problems in this version)
Toggle fullscreen

Crash Report
No response
Additional Information
Note: I don't know if this happens with borderless mode

cant reproduce, what mods do you have?

cant reproduce, what mods do you have?

I don't know what mods I had at the time, but it doesn't happen to me anymore. I know I had BetterEdit, BetterInfo, and I don't know if I had BetterMenu or not.


Summary based data flow analysis...

Hello!
A little background
I am writing a framework to launch android static security implementations. I want to include Argus-SAF
Issue
I have a (small) test apk, to see if my framework is handling everything correctly.
The test apk is malware, confirmed by multiple other implementations in my framework.
While testing this app on Argus-SAF, the following appeared on my terminal:
Starting analysis of adsvr.soporteweb.es.apk
Total apks: 1
Analyzing #1:file:/home/s1810979/testset/androzoo/apk/adsvr.soporteweb.es.apk
Dedexing... Total: 15
[==================================================] 100.00% 1s580ms ETA: 0ms
Collecting information from adsvr.soporteweb.es.apk...
Read AndroidManifest.
Read ARSC.
Read Layout files.
Start reachabilityAnalysis...
Building Signature Based Call Graph... Total: 30
[==================================================] 100.00% 1s346ms Left: 0
CHA done with method size 41.
ReachabilityAnalysis done.
Analyzing callbacks...
Collecting callback methods in layout mappings...
Collecting callback methods in app source...
Collecting XML based callback methods...
Callback collection done.
Generate environment for 1 components.
Info collection done.
Processing 1/1: Ladsvr/soporteweb/es/MainActivity;.envMain:(Landroid/content/Int
ent;)V
Building Signature Based Call Graph... Total: 1
[==================================================] 100.00% 405ms Left: 0
CHA done with method size 62.
Summary based data flow analysis... Total: 229
[==================================================] 100.00% 2m43s618ms Left: 0

Everything went pretty fast (as you can see from time output), but now:
Nothing has happened for at least 20 minutes. Summary based data flow analysis... remains at 100% (of course), and Left remains at 0.
Question
It does seem Argus-SAF is doing nothing at the moment. Is this correct?
If so, why is Argus-SAF busy with doing nothing and how to fix it?
If not, perhaps it would be wise to print something to let users of your tool know stuff might take a while, or maybe even produce another percentage bar!
Some more info
My framework also has implemented Amandroid, which is predecessor/part of this tool. Amandroid analyzed my apk in<PHONE_NUMBER>3244629 seconds. Since Argus-SAF probably uses (maybe modified) Amandroid codebase, how can Argus-SAF take more than 1200 seconds (aka twelve times more time)?
I use this Argus-SAF (the CLI-tool), and I use taint analysis, data leakage options
Edit
Wow, it is still busy. It has been busy for over 3 hours now, with something which should take maybe a few minutes. What's going on?

Maybe this is bug #29 being unfixed after 2 years

Could you provide me that APK to test?

I cannot give you the APK, as this one belongs to androzoo malware dataset (which you might have access to too, considering this framework you are/were building). Here are the details:
sha256: 20BD4735D2E3F1FBDFAE196FECB00A80E7258C7A84785ED92FEC2C019B0AF76F
sha1: C0F7A50701E06D94BCF2309221E2AD2A4B938147
md5: F77D96EA77AD481630A3C3C2717BF83D
dex_date: 2018-06-06 23:37:14
apk_size: 182484
pkg_name: "adsvr.soporteweb.es"
vercode: 2
vt_detection: 15
vt_scan_date: 2018-11-19 06:38:00
dex_size: 21704
markets: play.google.com

With this info you can identify uniquely which exact apk I used for this test.
Maybe you can fix your bug with it.
Good luck!


feat(connector): add discord connector (logto-io/logto#1876)

Summary
Add Discord connector (https://github.com/logto-io/logto/issues/1876)
Testing
UT and Locally Tested

@darcyYe ,thanks for re-approving the workflows.
Should i add an eslint disable complexity comment, keeps trowing that because of the discord avatar url xD, if i remove it it passes locally, can u look into it? Is there a better way i can do that. Discord doesn't pass an url for the avatar..
Thanks again

Hi @FlurryNight, you may disable the complexity lint rule to make it pass the check as it should not be a blocker.

No worries!
Let me try the Discord connector's functionality (can not test it yesterday due to some minor bugs).
The code looks good 😄

Hi @FlurryNight, I've tried the connector and it worked smoothly!
You may disable the complexity lint rule, or I can do that for you. I'll double-check the version of the dependencies and some other details before approving, cheers!

no worries, after an offline discussion with @charIeszhao, we may keep both email and verified for future use. Would you mind me making the change to your code? @FlurryNight

@FlurryNight can we temporarily hold this PR for a few days until early next week?
The change I intended to make depends on the @logto/connector-core package, which shares the same version as @logto/core repo does. We need to update @logto/connector-core before making changes to your code. We may find a temporary solution if you want to merge this PR ASAP. Let me know what you would like 😃

@FlurryNight , we have @logto/connector-core published and made the change to expose email_verified as UserInfoResponse. I'll have this PR merged, and Logto Team will release a new version of @logto/connectors this weekend, cheers!
Great thanks for building the Discord connector!


Add attribution to static map

Add attribution to comply with Mapbox's terms.
Closes https://github.com/lonelyplanet/destinations-next/issues/1073

👍