[release/1.7 backport] update go to go1.20.5, go1.19.10

backport of https://github.com/containerd/containerd/pull/8714

go1.20.5 (released 2023-06-06) includes four security fixes to the cmd/go and runtime packages, as well as bug fixes to the compiler, the go command, the runtime, and the crypto/rsa, net, and os packages. See the Go 1.20.5 milestone on our issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.20.5+label%3ACherryPickApproved
full diff: https://github.com/golang/go/compare/go1.20.4...go1.20.5
These minor releases include 3 security fixes following the security policy:

cmd/go: cgo code injection The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo.
This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
Thanks to Juho Nurminen of Mattermost for reporting this issue.
This is CVE-2023-29402 and Go issue https://go.dev/issue/60167.

runtime: unexpected behavior of setuid/setgid binaries
The Go runtime didn't act any differently when a binary had the setuid/setgid bit set. On Unix platforms, if a setuid/setgid binary was executed with standard I/O file descriptors closed, opening any files could result in unexpected content being read/written with elevated prilieges. Similarly if a setuid/setgid program was terminated, either via panic or signal, it could leak the contents of its registers.
Thanks to Vincent Dehors from Synacktiv for reporting this issue.
This is CVE-2023-29403 and Go issue https://go.dev/issue/60272.

cmd/go: improper sanitization of LDFLAGS
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive.
Thanks to Juho Nurminen of Mattermost for reporting this issue.
This is CVE-2023-29404 and CVE-2023-29405 and Go issues https://go.dev/issue/60305 and https://go.dev/issue/60306.

(cherry picked from commit e9f63f64f55c07e71bf96f305219bcee2cdd6289)

rebased after https://github.com/containerd/containerd/pull/8772 was merged (which should hopefully make CI go green)
update the commit message to have the right cherry-pick commit, because https://github.com/containerd/containerd/pull/8714 was rebased as well)


WSAS-2257: Move shaded libs to a separate branch

Is it possible that we merge all data bridge related shaded libs together and make a single jar?


Define Colors for the Innovation Cup Token  template

Innovation Cup Color Token
Requirement
As a developer creating an Innovation Cup App
I want to be able to use the ODS tokens structure
So That I can select the innovation cup theme that will be applied to my App
General description
The Apps colors should be setup using tokens. These set of color tokens used to display an app is a theme.
The developer using the ODS library should be able to select a theme to build the app with either the Orange Theme or the Innovation cup theme.
The mobile app should be updated to be able to test the theme change. A proposition of Theme interaction change is to add About page of the app with the list of items present a theme  selector where you will be able to select from a list of themes.
Implementation Tasks

[ ] Define the Color Tokens - @mccart77
[ ] Allow the ODS Lybrary to support
[ ] Allow the demo app to be able to switch the color theme to test the full range of changes it generates

this issue has been replaced with issue #311


how do i run the code!! i'm new to this

how do i run the code? i'm new to this freaking thing , i installed the code but i couldn't find the setup file , i've tried clicking on  every file none of them worked! sorry for my tune but i've tried everything nothing worked , thank you in advance

I'm having trouble understanding what you mean by "installed the code but couldn't find the setup file".
This is a Python library that provides wrapped APIs, not an out-of-the-box program for end users.

I'm having trouble understanding what you mean by "installed the code but couldn't find the setup file".
This is a Python library that provides wrapped APIs, not an out-of-the-box program for end users.

installed as cloned the code  , and when you mean Python library do you mean it's just a bunch of code and not a finished project ? , because if it's a finished project or at least a project that works I want to know how to use it / Search by an image

installed as cloned the code , and when you mean Python library do you mean it's just a bunch of code and not a finished project ? , because if it's a finished project or at least a project that works I want to know how to use it / Search by an image

Let me be clear:
This is a production-ready Python library, not an unfinished project or executable program. There's a fundamental difference:

An executable program is something you click and run
A library is code that developers integrate into their own projects

To use this library:

Install Python
Install via pip: pip install PicImageSearch
Write Python code that imports and uses the library

The documentation and example code covers everything you need to know about usage.
If you're unfamiliar with how Python libraries work, I suggest learning Python basics first before attempting to use this library.


[Polymorphic] Sunset package :wave:

good riddance

Out of curiosity, why are you removing this package? It seems like it's related to #1329 but I can't tell the reason just from reading the React release note

Hey @ThangHuuVu, sorry for the confusion, it isn't related to React 18.
In fact that package had been deprecated and unused internally for about 6 months, when we replaced it with the asChild pattern in this release: https://www.radix-ui.com/docs/primitives/overview/releases#september-7-2021


Add example in documentation that show show to test Vuex Store

As in https://github.com/eddyerburgh/chapter-6/blob/master/src/store/tests/actions.spec.js , could you include a small use case/example on how to do simple Vuex store testing?

I'm interested in contributing to this. I've been doing a lot of testing stuff with Vuex lately (from methods, to mocks the responses and seeing how things change in components etc), do you have anything specific in mind?

Same here. I'm still not 100% confident I can document this as also the library is evolving but already I've built up some skills.

If you just want help testing your store let me know @gkatsanos , I have done a lot of this kind of thing lately. I will be writing more about this in the coming weeks too, you can see here  for more info or just get in touch and I can help you out.

I believe this is covered mostly in test-with-vuex. I think that section could be cleaned up though to be more clear


add Cloudflare API token for GVL domain and specify this token in hos…

…t_vars/dev.gvl.org.au.yml

added cloudflare API token for GVL domain to group_vars/VAULT and updated host_vars/dev.gvl.org.au.yml to use it.


SVG Export

It would be so awesome if this had a SVG export (or OA to SVG converter)
Most card cutting machines (e.g. Cricut/Scan-n-cut/etc.) can take SVG files, so this would let these machines cut the cards created in this software!

This program is so cool!!!
I second this; if it had an SVG tool, I could laser-cut cards like nobody's business!
But unfortunately I don't know anything about web development... Wish I could help!


fix utils.http_session creating multiple clients

ContextVar was OK is JobProcesses because we have one main task.
But this isn't true inside tests and maybe on usercode inside the main worker process

mmh may require some more work, each test has its own event loop?

seems like moving to global will be worse? i.e. multiple runloops sharing the same var?

http_session() ont its own now initialize nothing (we know have predictable path of where this should be used)
for now:

inside the usercb of jobs
tests


Allow empty resolver list for cares dns

For https://github.com/istio/istio/issues/53577
I'm trying to configure DNS resolvers (specifically CaresDnsResolverConfig.udp_max_queries) while using the default system resolvers. Right now, I need to add one resolver, otherwise I get a proto validation error.
Commit Message: Allow empty resolver list for cares dns
Additional Description:
Risk Level: low
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

I think you should set use_resolvers_as_fallback as true so it would only look /etc/resolv.conf and not worry about resolvers for such cases.

I think you should set use_resolvers_as_fallback as true so it would only look /etc/resolv.conf and not worry about resolvers for such cases.

Yes this is the exact behaviour I want, but even if I set use_resolvers_as_fallback to true, i still have to pass a nonempty resolvers list.
https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/network/dns_resolver/cares/v3/cares_dns_resolver.proto

@ramaraochavali Yeah you're right. resolvers can be empty. That being said, I still think we should get rid of the validator because we never check it. Further, it leads to inconsistent documentation

resolvers
(repeated config.core.v3.Address, REQUIRED) A list of dns resolver addresses. use_resolvers_as_fallback below dictates if the DNS client should override system defaults or only use the provided resolvers if the system defaults are not available, i.e., as a fallback.

The resolvers field is not required

/retest

I think in default mode, it uses the resolvers provided and they are needed. Did not look at the code in detail. But would leave it to @markdroth to decide

/lgtm api


Kotlin branch

What do you think about a Kotlin branch + CDK with Typescript? Is pull request welcome?

Pull requests are definitely welcome!  Happy to review a new branch that would use those Kotlin.


Create gloreix

confirmed:ID3
DocumentType:verified
Nationality:verified
DeviceDetails:verified
Experience:verified
Screenshot:verified

confirmed:ID3
DocumentType:verified
Nationality:verified
DeviceDetails:verified
Experience:verified
Screenshot:verified


Update RNodeInterface to add list of default setting parameters

This PR adds a list of default parameters for RNode devices that the user can select from. These parameters are the defaults  for LoRa and RNode devices.
RNode options:
Bandwidth (in hertz):
7800
10400
15600
20800
31250
41700
62500
125000
250000
500000

Coding rate:
4:5
4:6
4:7
4:8

Spreading factor (7 - 12):
7, 8, 9, 10, 11, 12
TX Power (in dBm):
1 - 14

Hey! Thanks for this :)
I was planning to do something along these lines, but had left it til later...
It seems I didn't have permission to push commits to your branch with edits, so I've merged this in and made my changes directly in my main branch.

Bandwidth labels are shown in KHz
Reverted transmit power field back to using text input as the slider felt a bit annoying, and the limits wouldn't work in cases where someone makes hardware that allows for higher power levels.


Updated cors options and readme file

Milestone 4: Updated cors options
In this PR, I have successfully update the cors options and Readme file.
I have done the following:

[x] Change from local host to deployed link
[x] Update readme file

I have ensured that:

There are no linter errors in the project.
Used Correct git-flow.
Documented my work in a professional manner according to Professional code documenting requirement
Included a descriptive Readme file.
Used descriptive commit messages

Best regards
Asum Victor

Hi @AsumVictor,
Your project is complete!  There is nothing else to say other than... it's time to merge it :shipit:
Congratulations! 🎉

Highlights
ES6 syntax ✅
ES6 modules ✅
Correct use of GitHub Flow ✅
Well-structured files ✅
Descriptive PR title with a great summary ✅
Optional suggestions
Every comment with the [OPTIONAL] prefix won't stop the approval of this PR. However, I strongly recommend you to take them into account as they can make your code better. Some of them were simply missed by the previous reviewer and addressing them will really improve your application.
Cheers and Happy coding!👏👏👏
Feel free to leave any questions or comments in the PR thread if something is not 100% clear.
Please, remember to tag me in your question so I can receive the notification.

As described in the Code reviews limits policy  you have a limited number of reviews per project (check the exact number in your Dashboard). If you think that the code review was not fair, you can request a second opinion using this form.


Outdated data

The dataset looks promising for an application i am working on - sadly its outdated.
Would it be possible for you to update it for the newest version from march 2019?
Or alternately publish the script / code used to parse the pdf?

I'll try and get it update shortly.

That would be awesome - thanks a lot!

@neilcrookes, I guess you have some script for extracting this data from PDF... can you share it?

2020 Data would be great. Quite incredible that DHL doesn't offer this list in any usable format...

@neilcrookes Would appreciate an update of the data, thanks a lot! :-)

DHL updated the list the 12th April 2020
https://www.dhl.com/content/dam/downloads/g0/express/services/surcharges/dhl_express_remote_areas_id_id.pdf

Many thanks to @zenekp for updating data to April 2020

i guess we have a new dataset https://www.dhl.de/content/dam/images/Express/downloads/dhl-express-remote-areas-service.pdf - from Jan 2021


Max speed and other info display in metric

Although my metric toggle is turned off in Toggles menu, the max speed and other info display in metric on c3 driving screen, although the car current speed shows correct MPH speed on driving screen, so I have a mix of imperial & metric speed display.

Although my metric toggle is turned off in Toggles menu, the max speed and other info display in metric on c3 driving screen, although the car current speed shows correct MPH speed on driving screen, so I have a mix of imperial & metric speed display.

I just made a modification to c3-master related to this.
I don't have much experience with testing, so I'll give it a try and hope for some feedback.


[DebugInfo] Improve documentation & Fix discovered bugs

Adds more documentation about updating debug values, and debug value expressions.
Fixes a few bugs: undef debug values being removed, constant debug values not working, arithmetic without a deref not working.
Add support for salvaging integer literals.
This increases the number of debug variables in the standard library by 1.7%
The biggest improvements in the amount of lost variables are: constant propagation (-81%), sil combine (-50%), dead code elimination (-31%), copy propagation (-59%), common subexpression elimination (-24%)

@swift-ci please test

@swift-ci please test source compatibility

@swift-ci please test

@swift-ci please test


Refactor stringification

So StringMaker and StringStream act as a pretty much completely parallel structure. This structure will be eradicated.
For the first draft I have simply removed the StringMaker's body, attaching it's head to StringStream's body.
The customization points are broken, as well as a few other features, namely raw memory stringification likely among others.
This (hopefully) finally fixes #571 for good!

Some thoughts about the situation with stringification. Imho first of all, missing unit tests should be added. Either tests for full output with -s (covering all stringification cases) or for output of toString functions for unknown types and for supported types. If doctest have it already, then the whole issue with stringification would non exist.
Also, at least such tests (if not all of them) should be added several times in different configuration matrix:

main function in the separate cpp / main function  in the same cpp as tests
with and without DOCTEST_CONFIG_USE_STD_HEADERS
other similar options that can break the things

Valgrind and sanitiser configuration should be added on CI if they are not. At least they would have detected the overflow problem if they existed. Or doctest just lack of tests that fail under them.
I think that at least part of the problem is
    // cppcheck-suppress noExplicitConstructor
    String(const char* in);

It's a landmine waiting to explode. And it explodes in 2.4.7 and 2.4.8.

Totally agreed, it's quite ironic that a unit testing library does not utilize unit tests to test itself!
Valgrind is already being used and sanitizers already managed to catch an issue when the appropriate tests are used!
From the many stringification issues I don't think that that String constructor is one, I don't even think String constructors are at all considered on stringification, although I'm not sure.

TODO:

[ ] More regression tests
[ ] See if we can somehow get toStream working in MessageBuilder
[ ] Test treating char star as string

Here's a diagram of the current stringification process, green representing customization points.

This branch has crashed in case of pointer stringification (invalid pointer actually).
https://godbolt.org/z/jW7sbj6T7
Previous releases work fine
https://godbolt.org/z/1dKozvq7T

Also, my stringification test points me to some improvements:
Fundamental types:
    float:                          1.1f
    double:                         2.2
    long double:                    3.3
С arrays:
    const char[]:                   foo
    char[]:                         bar
    const int[]:                    123
    int[]:                          456

=>
Fundamental types:
    float:                          1.1f
    double:                         2.2
    long double:                    3.3L
С arrays:
    const char[]:                   foo
    char[]:                         bar
    const int[]:                    [1, 2, 3]
    int[]:                          [4, 5, 6]

Great work, I almost reported strange stringification of non-char arrays 👍

toString ignored overloaded ostream operator for enum class values.
https://godbolt.org/z/sYPEb3Y1h

Call docstring::toString with pointer types spoils internal tloss. Reproducible in 2.4.8 and in dev, fixed in this PR. Great work!
https://godbolt.org/z/fc4cfMj3K

I think that define to disable tloss optimization is very desirable. It's unstable feature that causes too much problems. Imho it should be disabled by default and switched on manually if someone really wants it to speed up tests runtime.

Yet another find. The toString output of wchar_t, char16_t and char32_t depend on the cxx standard. It outputs integer representation until c++17, but in c++20 it becomes unknown for doctest.
https://godbolt.org/z/7axaaoTKx
Tested both on GCC and clang.

This branch has crashed in case of pointer stringification (invalid pointer actually). https://godbolt.org/z/jW7sbj6T7
Previous releases work fine https://godbolt.org/z/1dKozvq7T
It crashed in
    template <typename T>
    String rawMemoryToString(const T& object) {
        return rawMemoryToString(&object, sizeof(object));
    }

It seems that the presumption that not null pointer points to valid data is principally incorrect.
My example is kind of syntetic, but for example there is such thing as an end iterator for std::array or C array. It points past the array data so, dereferencing of it, it is an error.
int a[] = { 1, 2, 3 };
auto it = std::find( std::begin(a), std::end(a), 2 );
CHECK( it != std::end(a) ); // both it and end can point at the invalid memory past the buffer

This is really weird because I didn't really change anything about the stringification of pointers.. Good catch!

I've made stringify test or more or less sandbox where it can be easily checked
https://github.com/YarikTH/doctest_stringify_test
It uses doctest itself and ApprovalTests.cpp to continuously compare differences in outputs. Test contains all fundamental types, custom classes and most of container and utility std classes. It optionally uses stl_stringifier.h to check how it does its work.
All of the finds were done in the process of developing it.

About pointer stringification. There is already ostream operator for pointer types. But doctest uses its own approach to their stringification. And this approach is not consistent with stringification of shared_prt and unique_ptr because doctest doesn't handle them)
https://godbolt.org/z/dfxsW5jG4

Honestly the rat's tail of this is unimaginable, I am almost certain there is more weird and broken stuff waiting in the nooks and crannies here, but at some point we'll just have to bite the bullet and go through with it. Can't have people waiting on 2.4.9 forever!


Switch to Binder?

Should we switch to Binder?
I think the environment is much faster to setup...
https://github.com/binder-examples/conda

https://mybinder.org/v2/gh/festim-dev/FESTIM-workshop/HEAD
This seems to be working fine @jhdark tested it. We should switch to this and provide the steps to launch a binder


Fixed assertion in foonathan library on Debug. [6903]

This PR fixes a failed assertion in foonathan library:
[foonathan::memory] Assertion failure in function insert_impl (/home/ricardo/workspace/eprosima/fastrtps/master/build/Debug/foonathan_memory_vendor/foo_mem-ext-prefix/src/foo_mem-ext/src/detail/free_list.cpp:239): Assertion "no_nodes > 0" failed.

The reason is memory_pool needs more space because foonathan uses space for debug purposes.

Build status:

Linux
Mac
Windows
Performance