Error: failed to create memory pool mapping on linux aarch64

This error was first discovered when I tried to compile and run the polkadot binary (https://github.com/paritytech/polkadot-sdk) on linux aarch64 native environment.
The binary won't be able to work unless I change --wasmtime-instantiation-strategy to a non-pooling option, i.e.:
these don't work

pooling-copy-on-write
pooling

only these work

recreate-instance-copy-on-write
recreate-instance
legacy-instance-reuse

Here is what the error looks like:
$ ./gear --tmp --wasmtime-instantiation-strategy pooling
2023-12-05 20:01:19 Gear Node
2023-12-05 20:01:19 ✌  version 1.0.3-b46adb6363f
2023-12-05 20:01:19 ❤  by Gear Technologies, 2021-2023
2023-12-05 20:01:19 📋 Chain specification: Vara Network Testnet
2023-12-05 20:01:19 🏷  Node name: ethereal-oranges-7690
2023-12-05 20:01:19 👤 Role: FULL
2023-12-05 20:01:19 💾 Database: RocksDb at /tmp/substratesSLmp4/chains/vara_network_testnet/db/full
2023-12-05 20:01:19 ⛓  Native runtime: vara-1030 (vara-1.tx1.au1)
2023-12-05 20:01:21 🔨 Initializing Genesis block/state (state: 0x174f…af08, header-hash: 0x5256…36d6)
2023-12-05 20:01:21 👴 Loading GRANDPA authority set from genesis on what appears to be first startup.
2023-12-05 20:01:21 Cannot create a runtime error=Other("cannot create the wasmtime engine: failed to create memory pool mapping: mmap failed to allocate 0x3080000000 bytes: Out of memory (os error 12)")
Error: Service(Client(VersionInvalid("cannot create the wasmtime engine: failed to create memory pool mapping: mmap failed to allocate 0x3080000000 bytes: Out of memory (os error 12)")))

(Using a binary from https://get.gear.rs/gear-nightly-aarch64-unknown-linux-musl.tar.xz here cuz polkadot doesn't provide an official build for linux/aarch64, but the error is the same for polkadot)
The wasmtime version used by substrate is 8.0.1, and I'm able to reproduce it under the latest 15.0.1 release, so it's reasonable to assume any version in between are also affected
Test Case
wasmtime version: 15.0.1
use wasmtime::{Config, Engine, Error, InstanceAllocationStrategy};

fn main() -> Result<(), Error> {
    let mut config = Config::new();

    let _engine_good = Engine::new(dbg!(&config))?; // ok for both amd64 and aarch64

    config.allocation_strategy(InstanceAllocationStrategy::pooling());

    let _engine_linux_aarch64_bad = Engine::new(dbg!(&config))?; // failed for aarch64, but ok for amd64

    Ok(())
}

Steps to Reproduce

clone https://github.com/btwiuse/wasmtime-linux-aarch64-dbg
cargo run under linux/amd64 environment, the program runs to completion
cargo run under linux/aarch64 environment, the program fails on the second Engine::new(...)?

Expected Results
the program runs to completion on both architectures
Actual Results
the program panics under linux/aarch64
Error: failed to create memory pool mapping

Caused by:
    0: mmap failed to reserve 0x5dc80000000 bytes
    1: Cannot allocate memory (os error 12)

Versions and Environment
Wasmtime version or commit: 8.0.1 & 15.0.1
Operating system: linux
Architecture: aarch64
Extra Info
If you don't have a aarch64 linux server, you can try it in a qemu virtual machine. I tested it under a aarch64 crostini vm on chromeos, and termux proot environment on a android 14 phone with 24 GB ram. I'm pretty sure the error isn't caused by insufficient memory.

Thanks for the detailed report! The error here though could mean a number of different things, however. The two primary reasons I can think of for this failing are:

ENOMEM indicates that the virtual address space was exhausted. This is unlikely given your small reproduction program but could theoretically be the case for the original program (although still unlikely).
ENOMEM can also indicate that the kernel ran out of memory allocating data structures tracking virtual memory usage. On Linux this can be affected by sudo sysctl vm.max_map_count. You can try raising that with sudo sysctl vm.max_map_count=N and see if that helps?

If sysctl fixes things then either that's the fix or Wasmtime's memory pool should be configured with fewer slots. That would likely be done through the embedding that's using Wasmtime as it seems like you're probably not configuring Wasmtime directly but rather indirectly.
Also, FWIW, this isn't failing locally for me on arm64 Linux, so my best guess is that it's a difference in sysctl vm.max_map_count settings. That being said locally I had to turn that setting into the ~2k range to get failures which is well below the default 65k, so I'm not 100% sure about this.
Can you paste the output of sysctl vm.max_map_count and also provide more kernel/OS information?

On my crostini vm, it shows
$ sudo sysctl vm.max_map_count
vm.max_map_count = 262144

Unfortunately I can't change it because I don't have root permission on the vm host
$ sudo sysctl vm.max_map_count=333333
sysctl: permission denied on key "vm.max_map_count"

Here is the system info:
btwiuse@penguin:~/wasmtime-dbg$ lscpu
Architecture:                       aarch64
CPU op-mode(s):                     32-bit, 64-bit
Byte Order:                         Little Endian
CPU(s):                             8
On-line CPU(s) list:                0-7
Thread(s) per core:                 1
Core(s) per socket:                 8
Socket(s):                          1
Vendor ID:                          ARM
Model:                              4
Model name:                         Cortex-A53
Stepping:                           r0p4
BogoMIPS:                           26.00
Vulnerability Gather data sampling: Not affected
Vulnerability Itlb multihit:        Not affected
Vulnerability L1tf:                 Not affected
Vulnerability Mds:                  Not affected
Vulnerability Meltdown:             Not affected
Vulnerability Mmio stale data:      Not affected
Vulnerability Retbleed:             Not affected
Vulnerability Spec rstack overflow: Not affected
Vulnerability Spec store bypass:    Not affected
Vulnerability Spectre v1:           Mitigation; __user pointer sanitization
Vulnerability Spectre v2:           Mitigation; Branch predictor hardening, but not BHB
Vulnerability Srbds:                Not affected
Vulnerability Tsx async abort:      Not affected
Flags:                              fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
btwiuse@penguin:~/wasmtime-dbg$ uname -a
Linux penguin 6.1.60-08585-g3c866855af53 #1 SMP PREEMPT Sun Nov  5 17:38:41 PST 2023 aarch64 GNU/Linux

My phone is not rooted, so can't get the max_map_count:
$ sysctl vm.max_map_count
sysctl: cannot stat /proc/sys/vm/max_map_count: Permission denied

[alarm@localhost wasmtime-dbg]$ uname -a
Linux localhost 6.2.1-PRoot-Distro #1 SMP PREEMPT Wed Oct  4 10:42:48 UTC 2023 aarch64 GNU/Linux
[alarm@localhost wasmtime-dbg]$ lscpu
Architecture:           aarch64
  CPU op-mode(s):       64-bit
  Byte Order:           Little Endian
CPU(s):                 8
  On-line CPU(s) list:  0-7
Vendor ID:              ARM
  Model name:           Cortex-A520
    Model:              1
    Thread(s) per core: 1
    Core(s) per socket: 2
    Socket(s):          1
    Stepping:           r0p1
    Frequency boost:    enabled
    CPU(s) scaling MHz: 25%
    CPU max MHz:        2265.6001
    CPU min MHz:        364.8000
    BogoMIPS:           38.40
    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 s
                        m3 sm4 asimddp sha512 asimdfhm dit uscat ilrcpc flagm ssbs sb paca pacg dcpodp flagm2 frint i8mm bf16 dgh bt
                        i ecv afp
  Model name:           Cortex-A720
    Model:              1
    Thread(s) per core: 1
    Core(s) per socket: 5
    Socket(s):          1
    Stepping:           r0p1
    CPU(s) scaling MHz: 20%
    CPU max MHz:        3148.8000
    CPU min MHz:        499.2000
    BogoMIPS:           38.40
    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 s
                        m3 sm4 asimddp sha512 asimdfhm dit uscat ilrcpc flagm ssbs sb paca pacg dcpodp flagm2 frint i8mm bf16 dgh bt
                        i ecv afp
  Model name:           -
    Model:              1
    Thread(s) per core: 1
    Core(s) per socket: 1
    Socket(s):          1
    CPU(s) scaling MHz: 20%
    CPU max MHz:        3302.3999
    CPU min MHz:        480.0000
Vulnerabilities:
  Itlb multihit:        Not affected
  L1tf:                 Not affected
  Mds:                  Not affected
  Meltdown:             Not affected
  Mmio stale data:      Not affected
  Retbleed:             Not affected
  Spec store bypass:    Mitigation; Speculative Store Bypass disabled via prctl
  Spectre v1:           Mitigation; __user pointer sanitization
  Spectre v2:           Not affected
  Srbds:                Not affected
  Tsx async abort:      Not affected

Oh, I forgot the ChromeOS itself is based on Linux and I have developer mode turned on.
My device is Lenovo Chromebook Duet 10.1 inch with 4GB of ram.
I still get the same error if I execute the binary on chromeos
the default value is
vm.max_map_count = 65530

and the error persists even after I change it to 99999999
krane-rev4 /mnt/stateful_partition/dev_image # sysctl vm.max_map_count=99999999
vm.max_map_count = 99999999

krane-rev4 /mnt/stateful_partition/dev_image # ./w
[main.rs:6] &config = Config {
    debug_info: false,
    parse_wasm_debuginfo: false,
    wasm_threads: true,
    wasm_reference_types: true,
    wasm_function_references: false,
    wasm_bulk_memory: true,
    wasm_simd: true,
    wasm_relaxed_simd: true,
    wasm_multi_value: true,
    static_memory_maximum_size:<PHONE_NUMBER>,
    static_memory_guard_size:<PHONE_NUMBER>,
    dynamic_memory_guard_size: 65536,
    guard_before_linear_memory: true,
    parallel_compilation: true,
    compiler_config: CompilerConfig {
        strategy: Auto,
        target: None,
        settings: {
            "enable_verifier": "false",
            "opt_level": "speed",
        },
        flags: {},
        cache_store: None,
        clif_dir: None,
        wmemcheck: false,
    },
}
[main.rs:10] &config = Config {
    debug_info: false,
    parse_wasm_debuginfo: false,
    wasm_threads: true,
    wasm_reference_types: true,
    wasm_function_references: false,
    wasm_bulk_memory: true,
    wasm_simd: true,
    wasm_relaxed_simd: true,
    wasm_multi_value: true,
    static_memory_maximum_size:<PHONE_NUMBER>,
    static_memory_guard_size:<PHONE_NUMBER>,
    dynamic_memory_guard_size: 65536,
    guard_before_linear_memory: true,
    parallel_compilation: true,
    compiler_config: CompilerConfig {
        strategy: Auto,
        target: None,
        settings: {
            "enable_verifier": "false",
            "opt_level": "speed",
        },
        flags: {},
        cache_store: None,
        clif_dir: None,
        wmemcheck: false,
    },
}
Error: failed to create memory pool mapping

Caused by:
    0: mmap failed to reserve 0x5dc80000000 bytes
    1: Out of memory (os error 12)

system info:
krane-rev4 /mnt/stateful_partition/dev_image # uname -a
Linux localhost 5.10.199-23580-g85923a9daa67 #1 SMP PREEMPT Mon Nov 6 18:56:13 PST 2023 aarch64 GNU/Linux
krane-rev4 /mnt/stateful_partition/dev_image # lscpu
Architecture:           aarch64
  Byte Order:           Little Endian
CPU(s):                 8
  On-line CPU(s) list:  0-7
Vendor ID:              ARM
  Model name:           Cortex-A53
    Model:              4
    Thread(s) per core: 1
    Core(s) per socket: 4
    Socket(s):          1
    Stepping:           r0p4
    CPU(s) scaling MHz: 87%
    CPU max MHz:        1989.0000
    CPU min MHz:        793.0000
    BogoMIPS:           26.00
    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
  Model name:           Cortex-A73
    Model:              2
    Thread(s) per core: 1
    Core(s) per socket: 4
    Socket(s):          1
    Stepping:           r0p2
    CPU(s) scaling MHz: 40%
    CPU max MHz:        1989.0000
    CPU min MHz:        793.0000
    BogoMIPS:           26.00
    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
Vulnerabilities:
  Gather data sampling: Not affected
  Itlb multihit:        Not affected
  L1tf:                 Not affected
  Mds:                  Not affected
  Meltdown:             Not affected
  Mmio stale data:      Not affected
  Retbleed:             Not affected
  Spec rstack overflow: Not affected
  Spec store bypass:    Not affected
  Spectre v1:           Mitigation; __user pointer sanitization
  Spectre v2:           Mitigation; Branch predictor hardening, but not BHB
  Srbds:                Not affected
  Tsx async abort:      Not affected

I have included precompiled binaries in https://github.com/btwiuse/wasmtime-linux-aarch64-dbg
It's interesting when I execute it with qemu-user-static on a linux/amd64 host, it doesn't show the error:
qemu-aarch64-static wasmtime-linux-aarch64-dbg

I just applied the patch from https://github.com/bytecodealliance/wasmtime/issues/6003 and it fixed the error
$ git diff
diff --git a/main.rs b/main.rs
index 0e6b7dd..6e72a69 100644
--- a/main.rs
+++ b/main.rs
@@ -3,6 +3,11 @@ use wasmtime::{Config, Engine, Error, InstanceAllocationStrategy};
 fn main() -> Result<(), Error> {
     let mut config = Config::new();

+    config.static_memory_maximum_size(0);
+    config.dynamic_memory_reserved_for_growth(0);
+    config.static_memory_guard_size(0);
+    config.dynamic_memory_guard_size(0);
+
     let _engine_good = Engine::new(dbg!(&config))?;

     config.allocation_strategy(InstanceAllocationStrategy::pooling());

Thanks for the extra info! Given what you're seeing it seems unlikely you're running into vm.max_map_count as a limit. That being said my guess is you're running into some limit somewhere which is what's causing ENOMEM, and at this point your guess as to being able to pinpoint which limit is being hit is as good as mine.
The configuration you applied I'll note has a large impact on the performance of WebAssembly, so it's not really a "fix" per se but is a set of knobs that can be turned in theory. For example with those knobs you've greatly reduced the virtual memory allocation so it succeeds.
Some other things you might want to try:

I took a look at sysctl -a | rg '^vm' and the only other one that seemed relevant was vm.overcommit_memory. Is that nonzero on your systems? Alternatively, could you paste the output of sysctl -a | rg '^vm' on a system that fails to run this program?
Could you try bisecting the size necessary to trip the allocation failure? That can be done by tuning PoolingAllocationConfig::total_memories.

Other than that though I'm running out of ideas myself :(

I'm going to close this issue since I don't think there's much in Wasmtime we can do about this. What I can recommend though is a block like this where wasmtime serve will dynamically detect it shouldn't use the pooling allocator on some aarch64 configurations. I suspect that's what was happening here where the virtual address space only has 39 bits instead of the expected 48 which resulted in these errors.


Fix server-streaming request pattern.

server-streaming: 3 arguments (request, metadata, options).
The callback must not exist.
client-streaming: 3 arguments (metadata, options, callback).
The request must not exist.
bidi-streaming: 2 arguments (metadata, options).
Both request and callback must not exist.

Also added test cases.

Current coverage is 92.64% (diff: 83.33%)

Merging #93 into master will decrease coverage by 0.21%

@@             master        #93   diff @@
==========================================
  Files            10         10
  Lines          1190       1196     +6
  Methods         189        190     +1
  Messages          0          0
  Branches        235        237     +2
==========================================
+ Hits           1105       1108     +3
- Misses           85         88     +3
  Partials          0          0

Powered by Codecov. Last update f58ffb1...5d1fdd4


[bug] Loading a video as an assets does not work.

Describe the bug
Loading a video as an asset does not work.
I followed the guide here: https://tauri.studio/docs/api/js/modules/tauri
It works fine with image files (png/jpg etc.) but not with videos.
I tried loading the video https://www.w3schools.com/html/mov_bbb.mp4 directly from the URL, and this worked without problems.
But using the asset:///home/paul/Downloads/mov_bbb.mp4 URL this does not work
Loading images from the same folder does work.
In the network panel you can see that the request failed but no further reason is specified

The loading of assets this way is IMO not very good explained and when it fails, for some reason, it is very difficult to find out why.
Thank you for creating Tauri, it is awesome!
Reproduction
No response
Expected behavior
No response
Platform and versions
Operating System - Arch Linux, version Rolling Release X64

Node.js environment
  Node.js - 17.7.1
  @tauri-apps/cli - 1.0.0-rc.6
  @tauri-apps/api - 1.0.0-rc.2

Global packages
  npm - 8.5.4
  pnpm - Not installed
  yarn - 1.22.17

Rust environment
  rustup - 1.24.3
  rustc - 1.59.0
  cargo - 1.59.0
  toolchain - stable-x86_64-unknown-linux-gnu

App directory structure
/dist
/node_modules
/src-tauri
/src
/.git
/public

App
  tauri - 1.0.0-rc.4
  tauri-build - 1.0.0-rc.4
  tao - 0.6.4
  wry - 0.13.3
  build-type - build
  CSP - default-src tauri: asset: https://asset.localhost
  distDir - ../dist
  devPath - http://localhost:3000/
  framework - React

Stack trace
No response
Additional context
No response

This config works for me.
"allowlist": {
      ...
      "protocol": {
        "asset": true,
        "assetScope": ["**"]
      }
    },
    "security": {
      "csp": "default-src 'self'; img-src 'self' asset: https://asset.localhost; media-src 'self' asset: https://asset.localhost"
    }
}

As i said in the other issue, you shouldn't configure the scope like this (Especially since we are working on a fix).
You're better of by doing it more like this:

Configure it correctly and as strict as possible.
Use dialogs and file-drop events to dynamically extend it.
Use rust to manually extend the scope at runtime as a last resort.

About scope errors: It should be logged to the terminal (in tauri dev) and we return a 403 response (with an empty body) on scope related errors

This is not a scope issue. My scope already looks like this:
 "protocol": {
      "all": false,
      "asset": true,
      "assetScope": ["*"]
},

For my project this is necessary as the file explorer that i'm building requires the capability to, you know, display files :p.
Images do work via asset://, text like files and pdfs are loaded through rust but videos won't load with the assets protocol.

Ah whoops, didn't see that you were 2 different people, sorry.

Did you try adding media-src in csp? media-src 'self' asset: https://asset.localhost works for me.

@red010182
The default-src already does allow assets: default-src tauri: asset: https://asset.localhost
I tried it anyway but it is not working. Also loading assets from the web wouldn't work if that was the problem.

@firstdorsal do you have a reproduction? I have a video conversion app I'm making and I'm able to display user-uploaded videos (from dialog) in a <video> element with the following config:
{
  // ...
  "protocol": {
    "asset": true
  },
  // ...
  "security": {
    "csp": "default-src: 'self'; media-src 'self' asset:"
  }
}

I can reproduce this issue, seems to be a webkit2gtk problem.

Is there a workaround that we can use? Or we just wait for a proper fix?

@tedbyron

from dialog
If you mean using the "Native" browser dialog to select a video then this is not related I think.

@lucasfernog great, good to know! Is this working on Win/Mac?

I never had issues on Windows and macOS. And I don't know about a workaround :/

@wusyong was investigating this issue, I think it's a problem with latest webkit2gtk.

Is https://asset.localhost/<filepath> supposed to work also? I get "Connection refused" with that but nothing at all with asset://.

Also, is there an upstream bug report? I can't find one.

I tried to open this page on wry like the following.
let webview = WebViewBuilder::new(window)?.with_url("https://yari-demos.prod.mdn.mozit.cloud/en-US/docs/Web/HTML/Element/video/_sample_.single_source.html")?;

But this shows the empty video screen .
https://user-images.githubusercontent.com/34934510/181906813-6ad3646c-f89a-42d0-9477-e35686b19435.mov

Maybe issue is here for webkitgtk
https://bugs.webkit.org/show_bug.cgi?id=146351

It's weird 'cause I was sure it worked on previous webkit2gtk releases :(

Loading audio with the asset protocol is also broken

It seems fixed in 2.36.4.
https://webkitgtk.org/2022/07/28/webkitgtk2.36.5-released.html
I plan to add headers support again when I have some time. Will test this too.

Hi all,
I don't know if it helps, I have just tested a basic video sample using the asset protocol. With a regular up-to-date ubuntu release, using webkitgtk2.36.6.
Videos are still not playing on my station. Hopefully the next webkitgtk releases will have it fixed :)

Commenting the function name so others can find this issue when they search for convertFileSrc.

Still no workaround?

I have same problem but with images on MacOS
This code fix this issue
"protocol": {   "asset": true }, "security": {   "csp": "default-src: 'self'; media-src 'self' asset:" },

I'm experiencing this on Arch Linux as well.
Video was working in my app a couple days ago, now it's blank and my code hasn't changed. So I believe it's an issue in webkitgtk.
My system currently has webkit2gtk v2.38.2-2.

Update:
I had recently reinstalled my OS and was missing some packages.
In my case, this issue was fixed by install gstreamer and gst-plugins...
gst-libav, gst-plugins-bad, gst-plugins-base, gst-plugins-good, gst-plugins-ugly on Arch...
Which is not mentioned in the getting started / docs.

Looks like the issue still remains and I tried my best to write a C example to report back:
https://bugs.webkit.org/show_bug.cgi?id=146351#c5

@iohzrd Hey, can you elaborate more on how you fixed it? I upgraded my webkit2gtk to v2.38.2-2 and also installed gstreamer1.0 alongside all of the recommended plugins. It still doesn't want to load the video resource

There are 2 issues mixed up here:

videos not loading in general, including remote videos (for example from youtube) -> The fix is to install gstreamer
local videos not loading via convertFileSrc -> No fix available right now (gstreamer would still be necessary)

I got an issue where i need to load image and video inside tauri as an asset where the file is located in randomly path, but i solve that issue by copying the file inside tauri PATH, in my case i use appDataDir and it work just fine
My example app:

I use react-player in this example and work fine
My code

was this removed from the roadmap because there's no intent to support? I'm trying to let users pick a video file but after selection I get asset protocol not configured to allow the path: Users/nfinished/Desktop/sample.mp4 in console and a 403 in the app.
assetScope is ["*"] and csp is default-src 'self'; media-src 'self' asset:

Don't mind our project boards yet, we're just playing around with them, trying to find something that works for us. In the latest iteration they only contain PRs which is why this issue was removed.

Came here from #6962, thanks to @FabianLars.
After reading other related issues (this and #2327 and #4496), I thought that this should be fixed in webkit2gtk 2.34.0. I'm facing this issue on webkit2gtk-4.0 2.40. Does this mean newer versions of webkit2gtk break this again? In Windows it still works without issues.
Example snippet:
import { Howl } from 'howler'
import { convertFileSrc } from '@tauri-apps/api/tauri'

const filePath = '/home/user/Music/example.mp3'
const assetUrl = convertFileSrc(filePath)
const sound = new Howl({
  src: [assetUrl]
}) // Origin http://localhost:1420 is not allowed
sound.once('load', () => {
  sound.play()
})

Screenshot:

Error log from webview:
[Log] asset://localhost/%2Frun%2Fmedia%2Fthang%2FDATA2%2FMusic%2FTaylor%20Swift%2FTaylor%20Swift%20-%20Red%20(Deluxe%20Edition)%20(2018)%2F06.%20Taylor%20Swift%20-%2022.flac (player.js, line 16)
[Error] Origin http://localhost:1420 is not allowed by Access-Control-Allow-Origin. Status code: 200
[Error] Failed to load resource: Origin http://localhost:1420 is not allowed by Access-Control-Allow-Origin. Status code: 200 (/run/media/thang/DATA2/Music/Taylor Swift/Taylor Swift - Red (Deluxe Edition) (2018)/06. Taylor Swift - 22.flac, line 0)
[Error] XMLHttpRequest cannot load asset://localhost/%2Frun%2Fmedia%2Fthang%2FDATA2%2FMusic%2FTaylor%20Swift%2FTaylor%20Swift%20-%20Red%20(Deluxe%20Edition)%20(2018)%2F06.%20Taylor%20Swift%20-%2022.flac due to access control checks.

npm run tauri info:
> tauri info

[✔] Environment
    - OS: Arch Linux Unknown X64
    ✔ webkit2gtk-4.0: 2.40.1
    ✔ rsvg2: 2.56.0
    ✔ rustc: 1.69.0 (84c898d65 2023-04-16)
    ✔ Cargo: 1.69.0 (6e9a83356 2023-04-12)
    ✔ rustup: 1.26.0 (5af9b9484 2023-04-05)
    ✔ Rust toolchain: stable-x86_64-unknown-linux-gnu (default)
    - node: 18.16.0
    - npm: 9.5.1

[-] Packages
    - tauri [RUST]: 1.3.0
    - tauri-build [RUST]: 1.3.0
    - wry [RUST]: 0.24.3
    - tao [RUST]: 0.16.1
    - @tauri-apps/api [NPM]: 1.3.0
    - @tauri-apps/cli [NPM]: 1.3.1

[-] App
    - build-type: bundle
    - CSP: default-src 'self'; img-src 'self' asset: https://asset.localhost; media-src 'self' asset: https://asset.localhost
    - distDir: ../dist
    - devPath: http://localhost:1420/
    - framework: Vue.js
    - bundler: Vite

webkitgtk still has issues to load video from custom URL scheme.
I also have a reproducible example in pure C.
https://github.com/wusyong/gtkbrowser/tree/video
But I couldn't track the upstream issue. I'll find some time to open one again (or find the one I commented before.)

This still happens to audio assets with correct configuration.

"protocol": {
        "all": false,
        "asset": true
}

asset:// works for image assets however.

Dropped some info to https://bugs.webkit.org/show_bug.cgi?id=146351
Hope this will be fixed soon.
@lucasfernog is it possible to find which version was working for you? Even upstream bug was opened in 2015, maybe there where some changes that made it work for some versions. I am ready to compile previous versions of webkit, test it and go through changelog & git diff to help solving this faster

Unfortunately I have no idea :( @ZerdoX-x

I can affirm that I'm facing a similar issue to duydang2311, I am able to load images through the asset protocol, although unable to load PDF documents using the pdfJS library

@foodornt im using this setup to handle PDF files, and im using pdf js as well with local vendor files, this is work for all desktop OS (window, Mac, and Linux), add fs to allow the list and add the scope

@xxidbr9 it's very kind of you to stop by and share with us your setup! Thank you!
It appears that my issue is because I'm using react dev server (which is running on port 1420) and trying to access port 80 (Cross Origin) which is again being blocked by that dev server

@foodornt looks like your problem is not related to this issue anyways.

@xxidbr9 it's very kind of you to stop by and share with us your setup! Thank you!
It appears that my issue is because I'm using react dev server (which is running on port 1420) and trying to access port 80 (Cross Origin) which is again being blocked by that dev server

Edit: there's no server running on port 80 anyways 🤔 I wonder what's serving files in the first place

share your allowList, for the assets file it using asset protocol not http, so you need to add and add scope as well in fs
      "protocol": {
        "asset": true,
        "assetScope": ["**"]
      }

@ZerdoX-x it could be, I'll open another one after I retry.
@xxidbr9 it's asset:// and not http:// request. I used the convertFileSrc function, and when debugging the URL, it indeed starts with asset://. The allowList is exactly like the one you provided.

Up,
Anyone have solved this issue in Linux environment ?

@Siirko yes. you can try to read the thread and find references from commits from other repos to this issue

Somehow on tauri discord found a workaround for audio file (this maybe applicable to other type of file), you just have to load the file with fs and create a Blob which you create an DataURL with it
Example :
  const [urlAudio, setUrlAudio] = useState<string>("")
  return (
    <>
      <Button
        variant="ghost"
        onClick={() => {
          const filePath = .....
          void readBinaryFile(filePath)
            .catch((err) => {
              console.error(err)
            })
            .then((res) => {
              const fileBlob = new Blob([res as ArrayBuffer], { type: "audio/mpeg" })
              const reader = new FileReader()
              reader.readAsDataURL(fileBlob)
              const url = URL.createObjectURL(fileBlob)
              setUrlAudio(url)
            })
        }}
        className="w-full justify-start font-normal"
      >
        ok
      </Button>
      <audio controls>
        <source src={urlAudio} type="audio/mpeg" />
      </audio>
    </>
  )

You just need to setup tauri.conf.json permission for letting fs reading files with "scope": ["**"]

This is quite annoying
I hope webkit lib solves it soon, although would still be problematic for users who haven't updated the lib

I'm not sure if this is the same bug, but I'm using SvelteKit and doing
<audio controls>
  <source src="/switch.ogg" type="audio/ogg" />
</audio>

and placed the corresponding sound file in src-svelte/static/switch.ogg. I can play this sound on yarn tauri dev but not the release build.
If instead I set the audio source to be some random file from https://en.wikipedia.org/wiki/Category:Wikipedia_Ogg_files, then that external sound file plays successfully even on the release build.
If I try to programmatically play the sound:
<script lang="ts">
  import clickSound from "$lib/sounds/switch.ogg";
  ...
  function playClick() {
    const audio = new Audio(clickSound);
    audio.play();
  }
</script>

<button
  ...
    on:click={playClick}
  >
    ...
</button>

I get the error
0:00:10.166424993 20275 0x559a88e1aa00 WARN            uridecodebin gsturidecodebin.c:1409:gen_source_element:<uridecodebin0> error: No URI handler implemented for "tauri".

where console.log(clickSound) gives me
tauri://localhost/_app/immutable/assets/switch.326f3a0f.ogg

convertFileSrc doesn't appear to help either.

Does it happens in Apple webkit as well?
https://bugs.webkit.org/show_bug.cgi?id=146351
Looks very related to the bug in Linux
The deeper issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3021

gstreamer is only used on Linux. The issue in your case should be that you're providing a plain file path while it needs the asset: protocol (via convertFileSrc).

@FabianLars
Looks like apple's webkit does uses gstreamer.
Source/WebCore/platform/mediastream/gstreamer

That codebase is shared between apple, webkitgtk, and wpe (and more?). So having a gstreamer folder doesn't mean much for the macos port, especially if we take a look at what other folder are in that mediastream folder.

Guess I stumbled into the same issue.
I have build an app with tauri and sveltekit for the raspberry pi. Everything works so far except playing an embedded mp4 video in the bundled app for the pi.
The video works on all other platforms in their respective bundled version. On the raspi, I see the play button crossed out. There is no error in the console. I can see that the source section in the inspector contains the video. The src link is using the tauri protocol. When I change the src url in the inspector dom to the same video hosted on a server, it plays the video. I assume this is the same custom schema protocol.

I'm running into this issue on Linux (MP3 audio playback works with dev but not release build), except its happening not just for assets but also remote MP3 URL playback.
Does anyone know of a workaround on Linux?

Any updates on this? I've been holding off a feature in Linux that prevents video from playing. Can anyone from the team please respond if there are any alternatives?

Still the same alternatives/workarounds as mentioned earlier in this issue:

Load small files via fs functions as binary
Large files require a http server on the rust side (or a sidecar in your language of choice i guess) so that the file will be loaded over http instead.

Because we do not want to add a http server into tauri itself (assuming nobody changed their minds), we're stuck with this until we have an alternative for webkitgtk.

Does anyone know of a workaround on Linux?

@Siirko @superkelvint please take a look at references to this issue.
https://github.com/luxuereal/Alexandria_EBook_Tauri/commit/1050664fafc5d0b720dda7fa112d27cd789c8dbf
https://github.com/tranxuanthang/lrcget/commit/0a2fe9943e40503a1dc5d9bf291314f31ea66941
this might be helpful.

Any updates on this?

https://bugs.webkit.org/show_bug.cgi?id=146351 Here is the original bug report for webkit.

Does anyone know of a workaround on Linux?

@Siirko @superkelvint please take a look at references to this issue, they are available in the discussion above. Please do not bump same issue with same questions.
luxuereal/Alexandria_EBook_Tauri@1050664 tranxuanthang/lrcget@0a2fe99 vjousse/pomodorolm@61e9055
this might be helpful.
@niraj-khatiwada

Any updates on this?

https://bugs.webkit.org/show_bug.cgi?id=146351 Here is the original bug report and discussion in webkit bug tracker. Tauri didn't do anything on it's side yet, and I don't think it can do for now. As it will break one of the core feature: working without running local server.

Thanks for the information. I didn't realize it was the issue on webgtk gstreamer itself. I understand that Tauri cannot do anything about it. Looks like it's already been 9 years since the issue was raised and I don't think it is going to be fixed anytime soon. So I'll just spin up a http server as a workaround.

A quick workaround that I resorted to:
let sound = new Audio("data:audio/mpeg;base64,<insert base64 converted audio string>");
sound.currentTime = 0;
sound.play();

Less than ideal, but does the job for small/short audio files.

cursed way to fix this issue:
const blobUrl = URL.createObjectURL(await fetch(asset).then(res => res.blob()))
const sound = new Audio(blobUrl)

Perhaps it could be worked around by Tauri by allowing to register custom response generator under a path of default scheme? Something like tauri::Builder::default().register_uri_path("/videos", |_app, request| { ... , where all requests going to /videos would be handled by custom code?

This is exactly how the default tauri and asset protocols work and the root cause of the issue here so yet another protocol with the same implementation would not help anyone.

I understand. I assumed this is possible: https://github.com/tauri-apps/wry/issues/1087

Yeah that would be cool but only windows supports modifying arbitrary http requests/responses like that (and it's also how the current custom protocol implementation works on windows). The current macOS and Linux webviews only support monitoring requests.


Boolean states

it looks like configparser:SectionProxy.BOOLEAN_STATES contains a bunch of names for booleans:
BOOLEAN_STATES = dict (8) instance at 0x103c57680
                            {
                                '1': bool instance at 0x102de03e8
                                    <
                                        True
                                    >,
                                'yes': bool instance at 0x102de03e8
                                    <
                                        True
                                    >,
                                'true': bool instance at 0x102de03e8
                                    <
                                        True
                                    >,
                                'on': bool instance at 0x102de03e8
                                    <
                                        True
                                    >,
                                '0': bool instance at 0x102de0408
                                    <
                                        False
                                    >,
                                'no': bool instance at 0x102de0408
                                    <
                                        False
                                    >,
                                'false': bool instance at 0x102de0408
                                    <
                                        False
                                    >,
                                'off': bool instance at 0x102de0408
                                    <
                                        False
                                    >
                            }

I should have call.Param use this list instead of its own list.

It's actually the RawConfigParser that defines BOOLEAN_STATES

These are the Golang boolean states:
1, 0, t, f, T, F, true, false, TRUE, FALSE, True, False


feat(scheduler): Add Reminder command

closes: #81

Screenshot with the received DM:

Note: It says the message was received at 22:48 (aka 10:48), but it was indeed received at 22:49 since the 48th minute was when I sent the reminder command.

Did I break it?
I used:
^reminder test message reminder || 2020-07-17 8:41

And at 8:41 got (twice):
INFO: Running the job reminder-412611450364887048 - undefined

Oh I did get this as a DM, sorry...

And at 8:41 got (twice):
INFO: Running the job reminder-412611450364887048 - undefined

That is weird, was perhaps one message saying "Running" and the other saying "Finished", like the image @eddiejaoude ?
The undefined problem is something I need to fix, good catch 😃.


Resolve Vulnerabilities in Runtime Image

Hello!
As part of our ongoing to ensure the security of our products, one or more vulnerabilties requiring redmediation have been identified.

Vulnerability
Severity
Image
Package
Description

CVE-2023-37920
critical
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
certifi:2022.12.7
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the [...]

CVE-2023-48022
critical
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
ray:2.9.3
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's p[...]

To resolve this, we recommend the following approach:

Install trivy (https://aquasecurity.github.io/trivy)
Scan the current version of the image using a command like trivy image --scanners vuln --severity  CRITICAL,HIGH --timeout 60m [...image address...]
Validate that the CVEs are detected using trivy.  The provided scans were taken using a different scanner (ECR), so the first step should be to validate that trivy can see them as well.
Iterate to resolve the vulnerabilities.  trivy enables you to scan the image without pushing them, so it should help in finding the resolution
Test and publish the fix version, and let us know where we can find the fixed image(s) so we can validate the fixes on our side as well.

Note that we disregard the severity levels assigned by various tools and operate soley on CVSS in line with NIST guidelines.  Also note that this scan was performed by ECR, so the results will likely be different.  It is in our experience that Trivy produces more results than ECR or Prisma.

The certifi package is 2024.2.2 in image 0.2.0 408.  The version being detected is in a "pkgs" folder that is unused and just part of conda base.  So the notice is a false positive on the wrong version.

There's no resolution for the ray package, no new version is specified, no action can be taken as it's required part of vLLM.  Ray is not exposed directly, only the vLLM port that is not ray directly, so there's no real issue.

@pseudotensor Thanks!  For certifi, then can we remove it from the filesystem during the build process?

There are also a handful of HIGH severities, some of these may or may not be real

Vulnerability
Severity
Image
Package
Description

CVE-2022-3996
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken[...]

CVE-2022-40898
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
wheel:0.37.1
An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of s[...]

CVE-2022-4450
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header da[...]

CVE-2023-0215
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internal[...]

CVE-2023-0216
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS[...]

CVE-2023-0217
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP[...]

CVE-2023-0286
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were p[...]

CVE-2023-0401
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the ha[...]

CVE-2023-38325
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

CVE-2023-43804
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
urllib3:1.26.14
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any[...]

CVE-2023-4807
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal stat[...]

CVE-2023-49083
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_[...]

CVE-2023-50782
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS [...]

CVE-2023-5363
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
cryptography:38.0.4
Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths.  This can lead to pote[...]

CVE-2023-6730
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
transformers:4.28.1
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

CVE-2023-7018
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-408
transformers:4.28.1
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

@achraf-mer Can you add the removal of pkgs folders for the h2ogpt/vllm installs like we have for DAI?

@codyharris-h2o-ai In some cases I don't understand the message.  It says for that last one, we have transformers 4.28.1 and issue was present prior to 4.36.  So why is listed?  Makes no sense.

Just randomly, @codyharris-h2o-ai For transformers, I only see 4.38.2 in the image, not 4.28.1.  I don't know where it is getting the versions.

It's picking it up from workspace/spaces/demo/requirements.txt

findings.json
Attaching the raw report from ECR

Ok, that's old code, could be updated, not part of image really.

@codyharris-h2o-ai I pushed those changes to remove those unnecessary files.  Try again tomorrow on 0.2.0-410

@codyharris-h2o-ai Please check again.

@pseudotensor thanks,
I scanned 412 with the following results:

Vulnerability
Severity
Image
Package
Description

CVE-2023-48022
critical
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
ray:2.9.3
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's p[...]

CVE-2024-0964
critical
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
gradio:3.50.2
A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

SNYK-PYTHON-GRADIO-6263801
critical
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
gradio:3.50.2
## Overview gradio is a Python library for easily interacting with trained machine learning m[...]

CVE-2022-3996
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken[...]

CVE-2022-40898
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
wheel:0.37.1
An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of s[...]

CVE-2022-4450
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header da[...]

CVE-2023-0215
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internal[...]

CVE-2023-0216
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS[...]

CVE-2023-0217
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP[...]

CVE-2023-0286
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were p[...]

CVE-2023-0401
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the ha[...]

CVE-2023-38325
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

CVE-2023-4807
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal stat[...]

CVE-2023-49083
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_[...]

CVE-2023-50782
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS [...]

CVE-2023-51449
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
gradio:3.50.2
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning mod[...]

CVE-2023-5363
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
cryptography:38.0.4
Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths.  This can lead to pote[...]

CVE-2023-6572
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-412
gradio:3.50.2
Command Injection in GitHub repository gradio-app/gradio prior to main.

Sorry 512 is gradio 3 for k8 and 513 failed during push due to some network issue.  Need to avoid the gradio 3 builds we make for k8 issue.

Ok will try 410

I'm building new one.

@achraf-mer Can you add the removal of pkgs folders for the h2ogpt/vllm installs like we have for DAI?

I see done in https://github.com/h2oai/h2ogpt/commit/98e390b94a7118916e85992c03ecfbc6f5e1545f and you are building a new image, so will wait and see how to address new findings, thanks.

@achraf-mer I already removed the items, I unassigned you thanks!

Latest scan of 414:

Vulnerability
Severity
Image
Package
Description

CVE-2023-48022
critical
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
ray:2.10.0
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's p[...]

CVE-2022-3715
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
bash:5.1
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead [...]

CVE-2022-3715
high
typesense/typesense:0.25.2
bash:5.1
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead [...]

CVE-2022-3996
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken[...]

CVE-2022-40898
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
wheel:0.37.1
An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of s[...]

CVE-2022-42969
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
py:1.11.0
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attac[...]

CVE-2022-4450
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header da[...]

CVE-2022-46908
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
libsqlite3-0:3.37.2
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhi[...]

CVE-2023-0215
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internal[...]

CVE-2023-0216
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS[...]

CVE-2023-0217
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP[...]

CVE-2023-0286
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were p[...]

CVE-2023-0401
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the ha[...]

CVE-2023-32786
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
langchain:0.0.325
In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, e[...]

CVE-2023-38325
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

CVE-2023-4807
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal stat[...]

CVE-2023-49083
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_[...]

CVE-2023-50782
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS [...]

CVE-2023-5156
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
libc-bin:2.35
A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may res[...]

CVE-2023-52425
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
expat libexpat1:2.4.7
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case [...]

CVE-2023-5363
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-414
cryptography:38.0.4
Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths.  This can lead to pote[...]

CVE-2023-5363
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
libssl3:3.0.2
Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to pote[...]

CVE-2023-6730
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
transformers:4.33.0
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

CVE-2023-7018
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
transformers:4.33.0
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

CVE-2023-7104
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
libsqlite3-0:3.37.2
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionRea[...]

CVE-2024-0553
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
libgnutls30:3.7.3
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the r[...]

CVE-2024-0553
high
typesense/typesense:0.25.2
libgnutls30:3.7.3
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the r[...]

CVE-2024-0567
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
libgnutls30:3.7.3
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. Th[...]

CVE-2024-0567
high
typesense/typesense:0.25.2
libgnutls30:3.7.3
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. Th[...]

CVE-2024-24762
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-base:1.4.0
starlette:0.34.0
python-multipart is a streaming multipart parser for Python. When using form data, python-multipart uses a Regular Expressio[...]

SNYK-GOLANG-GITHUBCOMGOJOSEGOJOSEV3-6070737
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpte-mux:1.4.0
github.com/go-jose/go-jose/v3:v3.0.0
## Overview  Affected versions of this package are vulnerable to Denial of Service (DoS) when decrypting JWE inputs. An attacker[...]

wrt ray, we must mitigate the functionality by removing the offending source files in the package (such as overwriting or deleting or stubbing out the appropriate functions), or remove ray altogether.

Where is cryptography==38.0.04 from?  I only see we install any latest version, unconstrained.  Should be 42.0.5.

@pseudotensor, hey it appears to be coming from h2ogpt_conda/lib/python3.10/site-packages/cryptography-38.0.4.dist-info/METADATA

I think it's because docker build was using fixed miniconda version, not latest, so should be ok tomorrow.

Vulnerability
Severity
Image
Package
Description

CVE-2023-48022
critical
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-446
ray:2.10.0
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's p[...]

SNYK-PYTHON-PILLOW-6514866
high
223008754879.dkr.ecr.us-east-1.amazonaws.com/h2ogpt-runtime:0.2.0-446
pillow:10.2.0
## Overview  Affected versions of this package are vulnerable to Buffer Overflow via the strcpy function in _imagingcms.c, d[...]

@codyharris-h2o-ai is the ray issue a case of a bad report?
according to https://nvd.nist.gov/vuln/detail/CVE-2023-48022 and https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0 the CVE only applies to 2.6.3 and 2.8.0.

I discussed this with @YogevMaty and it sounds like it is still an issue

Apparently this CVE is very similar to the one we had in h2o3 .
The default installation does not require authentication and is listening on <IP_ADDRESS>
The company behind Ray is saying it is not a CVE it's by design this is the reason it is not visible  in some scanners.
Currently they are not planing of fixing this issue.
what to do
Security and isolation must be enforced outside of the Ray Cluster. Ray expects to run in a safe network environment and to act upon trusted code. Developers and platform providers must maintain the following invariants to ensure the safe operation of Ray Clusters.
https://docs.ray.io/en/latest/ray-security/index.html#best-practices
more info in -https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild


a failure occurred while executing com.android.build.gradle.internal.tasks.workers$actionfacade

After installing this plugin, when compiling the game, this error began to come out, how can it be fixed, in addition to simply deleting this plugin?
Thanks!

The problem was solved by simply restarting the engine and re-entering data from the keys.


🐛 Where is the quote and parenthesis my opensource developer friends?

Before submitting your bug report

[X] I believe this is a bug. I'll try to join the Continue Discord for questions
[X] I'm not able to find an open issue that reports the same bug
[X] I've seen the troubleshooting guide on the Continue Docs

Relevant environment info
"tabAutocompleteModel": {
        "title": "mistral-codecomplete",
        "provider": "mistral",
        "model": "codestral-latest",
        "apiKey": "***"
    },

Description

Poorly handled post autocomplete feature.
To reproduce
just type and wait
some similar definitions .
randomly happens, deepseek is much better. but still suffers the line ending problem.
Log output
No response

try this
https://cdn.discordapp.com/attachments/1277836331501883449/1280291965879193731/fix.zip?ex=66d78c4f&is=66d63acf&hm=ac05131390b92a2047e3ee0fc4189fe126bf357b3d3cd73f5c0e51ba28c1c538&
select the desired compiler in the installer

try this https://cdn.discordapp.com/attachments/1277836331501883449/1280291965879193731/fix.zip?ex=66d78c4f&is=66d63acf&hm=ac05131390b92a2047e3ee0fc4189fe126bf357b3d3cd73f5c0e51ba28c1c538& select the desired compiler in the installer
@zawa999
Good try pal, dont mess with me when im already annoyed.


Multiple buttons created for wargear

Multiple buttons are created for wargear options that have sub-menus. E.g. Sicarian Infiltrator Princeps creates 2 buttons, one for the Princeps with no wargear, and one called Taser goad & Flechette blaster. Talos Pain Engine creates 3: 1 called Talos with no wargear, one called Talos Pain Engine with correct wargear, and one called 2 Haywire blasters
Army Lists.zip

I've pushed an update that should hopefully address this. Please take a look and let me know if you're still having issues. If there are further specific units giving you trouble if you can upload a roster file containing just the problematic units that would be helpful.

Thanks for the report - I was able to clean up a bunch of cases where models were incorrectly reported. If you see more issues in the future please open a new issue with an example roster


Static example

We now use 3 channels, so how_many_bytes should return accordingly

Bitmap class: allocate_image_memory that takes width and height


Relative links not working on overview of plugins page

I wasn't sure how to fix it (hence no pull request), but when I click the links in the table on https://www.jspsych.org/plugins/overview/ I get taken to a page that doesn't exist. It looks like overview/ is getting added to each url accidentally.

You're right, thanks for flagging this @jackdolgin! We'll get this fixed in the next release.
p.s. I'm not totally sure about how to fix this either, but I think the links need to go up one level with "../" so that the plugin page name gets added onto "https://www.jspsych.org/plugins" instead of being appended onto the current page ("https://www.jspsych.org/plugins/overview"), e.g.
Plugin | Description
------ | -----------
[jspsych‑animation](../jspsych-animation) | Shows a sequence of images at a specified frame rate. Records key presses (including timing information) made by the subject while they are viewing the animation.


feature(backport): Perform a once-off bulk backport of the full dataset

Add a couple of helper functions needed for bulk backport.

Needed to merge this because etl was failing after moving open numbers to its own channel.

No worries! I think the PR title was misnamed, given that this PR adds just the helpers, but the description made sense.

No worries! I think the PR title was misnamed, given that this PR adds just the helpers, but the description made sense.

True, I tend to use identical names for PRs belonging to the same issue, but this got out of hand a bit.


Wrong GUI scale

Some resolutions and desktop scales  can cause some problems with the GUI.

apparently solved in last update (main_window.py)


[openimageio] update port of v<IP_ADDRESS> to remove boost dependency

Library name
OpenImageIO
New version number
v.<IP_ADDRESS>
Other information that may be useful (release notes, etc...)
https://github.com/microsoft/vcpkg/pull/42175 updated openimageio to v<IP_ADDRESS>, however the updated port stills lists boost as a dependency, even though that should have been removed per the official build instructions and release notes.  Therefore, I believe this is an error in the port's vcpkg.json?  Please correct me if I am wrong in my understanding.

Your understanding is correct, and thank you for raising this question.


Update hyper dependency to 0.10

Fixes #3

Thanks for your contribution, but I want the serde bump to land first in Servo.

Superseded by #13.


eclipse: Add option package to programes.eclipse module

Description
Add config option package for module programs.eclipse
and assign cfg.package to the
eclipse parameter of pkgs.eclipses.eclipseWithPlugins,
instead of the hard-coded pkgs.eclipses.eclipse-platform.
This allows user to use other eclipse packages
like pkgs.eclipses.eclipse-java.
Checklist

[X] Change is backwards compatible.

[X] Code formatted with ./format.

[X] Code tested through nix-shell --pure tests -A run.all.

[ ] Test cases updated/added. See example.

[X] Commit messages are formatted like
{component}: {description}

{long description}

See CONTRIBUTING for more information and recent commit messages for examples.

If this PR adds a new module

[ ] Added myself as module maintainer. See example.

[ ] Added myself and the module files to .github/CODEOWNERS.

Thanks! Rebased to master in 561b3d565091ec881aeeca41df8b12db16195c92.


Lucene: add durability of indexes

Add durability of lucene indexes storing using the WAL
First steps:

persists index metadata inside a document in the index itself
persists index definition inside a document in the index itself
persists into the WAL the keys as byteArray

Closing this in favor of
https://github.com/orientechnologies/orientdb/issues/7697


Make download endpoint configurable

Equivalent to https://github.com/RCasatta/bitcoind/pull/107, this PR makes the endpoint configurable from which we download the binaries.

needs conflicts resolution

Had to kick CI once, not sure why it was flaky, but likely unrelated to this PR.

Not sure it's the same issue I found but with #61 I introduced a couple of functions with tests and I noticed tests are flaky with electrs version 0.9.1 but much more stable with 0.9.11. I introduced the feature electrs_0_9_11 I recommend using it


Exclude folders from 'open resource'

It would be nice if there was a setting to exclude folders from the 'open resource' panel.

For me, it would be even better if I could limit it completely to just my project files.  (If I need something from an external library my project references, I can usually just hit F4 to be brought there directly, right?)  Was that your use case too, or you need exclude folders in particular for something more refined?

@GimmickyApps  You mean this?

That's what I had hoped those would do, but no.
"Code files only" is useful.  (I'm not sure what use it is without that checked, actually...because often for non-code files I want to right-click and edit, rather than open with the default viewer...e.g. audacity instead of vlc, gimp instead of windows preview).
"In Classpaths only" seems to get rid of my project's "export" dir (although, not entirely...there's still one at the bottom of the list, formerly there were three at the top), which is useful, but it still includes, for example, all of HaxeFlixel and so on.  So "main" gives me dozens of options, when I just want my project's main.  "Cat" gives anything with "appliCATion" in it, when I just want my project's Cat.hx class.

Try QuickNavigate's Type Explorer - much better suited to this use case (I still think it should be included in FD out of the box).

Oh my gosh, +1 for including it out of the box.  I've been missing something like Quick Outline ever since Visual Studio '97, and it's even better than what they had (drop-down box of methods, built into the toolbar.)  Thanks!

Although, unfortunately, Type Explorer then lacks the two options of Open Resource.  I wonder where one can find all three, just a quick way to open .hx files from your own project's source dir only, not export, not libs, not assets, not assetpaths classes.

Have you made sure that "Search types in external classpaths" is unchecked?

Yes, and it still shows one class per asset (I will never need that) and stuff under my export directory.

Ah, that. I think that's a FD issue since QuickNavigate just uses FD's classpaths, but not 100% sure. @SlavaRa?

@Gama11 yes, that is true, QuickNavigate uses FD's classpaths.


When I installed, started seeing variables eval inside the editor. Uninstalled your extension but this behaviour continues. How to fix?

Hello,
I installed your extension (VSCode 1.91.1 in macos Sonoma), and started seeing variable evals inline in the editor view. Just uninstalled your extension but this behaviour continues. How may I fix this?

I'm not aware of anything this extension does which could cause that.
What is your debug.inlineValues setting?

It was 'auto'. Now I forced it to 'off'. But I have never changed this setting and also never had inline value shown in the editor, so I supposed it was this extension that changed this behaviour.

I have no idea how the extension could have done that. Anyway, glad you have resolved it.


only admins should be able to create/update/delete certain domain objects.

Describe the bug
Only admins should be able to create, edit, update, and delete the following objects:

MembershipType
Category
FeeType
Location
Agreement

To Reproduce
Steps to reproduce the behavior:

log out & go to website.  Log in as a standard member.
load the membership type controller.
create a new membership type.
observe success message
[repeat for other domain objects]

Expected behavior
Non-admin user should be prevented from creating, editing, or updating new objects of these types.
Screenshots

Desktop (please complete the following information):
Smartphone (please complete the following information):
Additional context
Note that we use the Pundit gem -- https://github.com/varvet/pundit -- for authorization and the Rolify gem for roles -- https://github.com/RolifyCommunity/rolify -- and the solution should use these gems' functionality.

Can I try this one?

Thanks @m-pereira we appreciate all the help you're giving us!  I'm going to send you an invite to be a collaborator, if you want so you can self assign when you want to work on something!


How do you delete powerShell, please specify system log in Windows 7 ?

@itll Are you trying to remove a system log in Windows 7 using this resource? Please elaborate.


collider: crypto/tls: failed to parse private key

I generated self-signed certificates:
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:CA
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:testwebsite.com
Organizational Unit Name (eg, section) []:Engineering
Common Name (e.g. server FQDN or YOUR name) []:www.testwebsite.com
Email Address<EMAIL_ADDRESS>When I run the collider, I see this error:
2017/06/05 21:25:50 Error Run: crypto/tls: failed to parse private key

When I generate using (based on http://www.kaihag.com/https-and-go/):
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem

I get this error:
2017/06/05 22:11:31 http: TLS handshake error from <some-ip>:1082: remote error: unknown certificate

How to fix this? It would be nice if you can add instructions for generating certificates as well. Thanks!

This bug: https://github.com/webrtc/apprtc/issues/442 info helped me.


Entities don't work in jobs

Actions just display/use "Player" as Entities in jobs like the hunter (tame, kill animals...) and farmer job (shear, milk cow, breed, tame).
Only some like the Chicken and Rabbit work
(no errors)

For me only works Chicken and Rabbit

Same issue here. Also isn't listing any Mythic Mobs either.

1.13.2 Paper 627 , Jobs 4.12.0
Job Hunter doesn't pay for passive mobs (Kill : Cow , Chicken , Sheep , Pig , Rabbit , Mooshroom , Squid ) (Breed : same except Squid ) and some hostile mobs (Kill : Silverfish , Ghast , Magma_cube & Slime smaller than the biggest)  , pastebin from my jobconfig : https://pastebin.com/bGmiHHLT ( starting at line 258 )

@DonSensiLeone Did you tried with only lower-cased chars? Such as cow, chicken

oh , it was Cow , Chicken .. before then i tried to write upper case , i'll try lower case


Context contract field representation.

Test all field representation for all supported libraries. I.e. Dict, List, Tuple, Integer, String, etc.

We removed support of third party libraries, so this issue is not relevant any more.

We removed support of third party libraries, so this issue is not relevant any more.


Authentication issues

I don't have time to dig much more into this right now, so let me document it here first before I forget. I currently have some authentication issues (context: trying to port my code from the older version to the newer API, and struggling to find where I could just get the JSON before the pyarrow...)
More generally, it would be nice to have an extra option as I could prefer to run anonymously by default, and login only when necessary:
async with FR24(login: bool | {'username': user, 'password': pass}) as fr24:
    ...

Currently, on my side, authentication in the asynccontextmanager fails with
ConnectError: All connection attempts failed

Surprisingly, in the TUI part of the code, I just use the following (without the FR24 client) and it still works:
self.auth = await login(self.client)

I am unable to reproduce the ConnectError on my end, but I suspect the issue is due to the custom httpx.AsyncHTTPTransport(retries=5) passed into the httpx.AsyncClient here. The documentation for the retry logic is rather lacking, so there might be something I'm overlooking. Does removing it resolve the issue?
As for how to get the JSON before pyarrow, you could do this:
from fr24.core import FR24

async def my_playback() -> None:
    async with FR24() as fr24:
        pb = fr24.playback(flight_id=0x2FB3041)
        response = await pb.api.fetch() # raw json here
        pb.data.add_api_response(json_response) # transformed to arrow table

await my_playback()

I'll have a go at the proposed anonymous-by-default implementation :)

Just implemented the authentication override:
# reads from environment variables/config file by default
async with FR24() as fr24:
    ...
# force anonymous
async with FR24(creds=None) as fr24:
    ...
async with FR24(creds={"username": "...", "password": "..."}) as fr24:
    ...
async with FR24(creds={"subscriptionKey": "...", "token": "..."}) as fr24:
    ...

Actually, more general architecture concern: how to proceed if I want to come with my own httpx.AsyncClient because I want to share it with other tools?

I had been using AsyncHTTPTransport(retries=5) because I was intermittently receiving connection errors particularly during livefeed requests: it wasn't really necessary. I had a quick glance at the default AsyncHTTPTransport created by the httpx.AsyncClient but was unable to find any differences with our custom one.
Anyways, I've made a commit that allows you to pass a custom client and made the login explicit:
client = httpx.AsyncClient(transport=httpx.AsyncHTTPTransport(retries=5))
async with FR24(client) as fr24:
    # anonymous by default
    await self.http.login() # reads from environment or configuration file, or,
    await self.http.login(creds={"username": "...", "password": "..."}) # or,
    await self.http.login(creds={"subscriptionKey": "...", "token": "..."})

This is a breaking change for my codebase as it no longer autologins, but yeah, explicit logins do look nicer.


"Cannot set property 'props' of undefined" on styled Typescript class component

See http://github.com/emandres/ts-react-styleable-repro for a reproduction of the error. It appears that this only affects class components, not function/stateless components.

@emandres I tried to repro
clone
npm install
npm run build
npm start
open localhost:8080
I saw no error in the build step or in the console in-browser.  Is there something else I need to do to expose the error?

D'oh, committed it with the wrong line commented. Pull again.

Got the error now.  Investigating...

@emandres Should be fixed now.  Upgraded your repo to<EMAIL_ADDRESS>and it was good.  Root cause was that your class-style component was seen as a function w/in styleable, and there wasn't a good reason for the distinction anyway.  See commit for more deets https://github.com/pluralsight/react-styleable/commit/56d4da90d839e0135a3a1ba1c01c51cdb378e7cd
Thanks for the report!

Fix in v3.0.1


Refactor crate

Currently the crate isn't at its optimal state. A good refactoring may fix.

The system ShapePlugin includes despawns the previous entity and spawns a new one with sprite bundle. As a result, the newly spawned entity's id is unobtainable. This seems to be a usability regression?

The system ShapePlugin includes despawns the previous entity and spawns a new one with sprite bundle. As a result, the newly spawned entity's id is unobtainable. This seems to be a usability regression?

I don't think so. Unless commands.spawn returns the newly created entity id (and it doesn't), nothing gets lost.
What I did is, instead of creating directly a SpriteBundle, the user creates a ShapeDescriptor by calling the draw method. Then, in the app stage after "update" that I created, the system shapesprite_maker creates the sprite bundle and despawns the descriptor.
This approach enables a user to draw shapes without managing manually tessellators and meshes.

I don't think so. Unless commands.spawn returns the newly created entity id (and it doesn't), nothing gets lost.
What I did is, instead of creating directly a SpriteBundle, the user creates a ShapeDescriptor by calling the draw method. Then, in the app stage after "update" that I created, the system shapesprite_maker creates the sprite bundle and despawns the descriptor.
This approach enables a user to draw shapes without managing manually tessellators and meshes.

The problem is that whoever spawning the descriptor won't know the entity spawned by the system and you also lose all the other components.
Btw spawn changes the current_entity so it does return the entity id in some way.

On Jan 11, 2021, at 05:39, Federico Rinaldi<EMAIL_ADDRESS>wrote:

I don't think so. Unless commands.spawn returns the newly created entity id (and it doesn't), nothing gets lost.
What I did is, instead of creating directly a SpriteBundle, the user creates a ShapeDescriptor by calling the draw method. Then, in the app stage after "update" that I created, the system shapesprite_maker creates the sprite bundle and despawns the descriptor.
This approach enables a user to draw shapes without managing manually tessellators and meshes.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or unsubscribe.

The problem is that whoever spawning the descriptor won't know the entity spawned by the system and you also lose all the other components.
Btw spawn changes the current_entity so it does return the entity id in some way.

On Jan 11, 2021, at 05:39, Federico Rinaldi<EMAIL_ADDRESS>wrote:

I don't think so. Unless commands.spawn returns the newly created entity id (and it doesn't), nothing gets lost.
What I did is, instead of creating directly a SpriteBundle, the user creates a ShapeDescriptor by calling the draw method. Then, in the app stage after "update" that I created, the system shapesprite_maker creates the sprite bundle and despawns the descriptor.
This approach enables a user to draw shapes without managing manually tessellators and meshes.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or unsubscribe.

I may try to find an alternative solution that may be even cleaner than the current one and may not need an intermediate ShapeDescriptor entity. I'll create an issue and link it there, since it deserves its own topic.

I may try to find an alternative solution that may be even cleaner than the current one and may not need an intermediate ShapeDescriptor entity. I'll create an issue and link it there, since it deserves its own topic.


action: support pre-v0.3.0 artifact naming scheme

This action is unable to fetch releases older than 0.3.0 since the artifact naming scheme was different for older releases.
https://github.com/cue-lang/cue/releases/download/v0.2.2/cue_0.2.2_Darwin_x86_64.tar.gz
vs
https://github.com/cue-lang/cue/releases/download/v0.4.2/cue_v0.4.2_darwin_amd64.tar.gz

@myitcv are you able to take a look at this?

@jsok my hope would be that nobody is depending on anything older than v0.3.0!
Is there a reason you need such an old version of CUE?

Unfortunately I maintain some CUE which is stuck on 0.2.2. It's being migrated away but it's still a work in progress.


Working on React Core contribution

All your files have a .js extension, and you use typescript syntax.
Could you explain how you are working ?
Do you have a particular configuration for your IDE ?
Why is it organized in this way ?

React repo uses flow for type checking. You can read more about flow here https://reactjs.org/docs/static-type-checking.html#flow  and here https://flow.org/en/docs/react/

Closing this issue :)


Change display name for Json integration to use a capital F.

Change display name for Json integration to use a cpital F instead of
lowercase which is the standard across the rest of our integrations.

Testing plan:
GIFs or screenshots:

It’s a noun (like calendar), but it’s not a proper noun (like Google Calendar).


Generic/DisallowYodaConditions: add code coverage ignore annotation for untestable line

Description
This PR adds the @codeCoverageIgnoreStart/@codeCoverageIgnoreEnd PHPUnit annotations to ignore, for the purposes of code coverage, a line that can't be tested. I considered doing this initially when I worked on improving code coverage for this sniff in #465, but I wrongly assumed that was not an option due to the Squiz.Commenting.InlineComment.InvalidEndChar error (which is part of the standard used by PHPCS).
What I failed to notice back then is that I was adding the annotation below a comment, and this triggers the error:
// Shouldn't be possible but may happen if external sniffs are using this method.
// @codeCoverageIgnoreStart

Adding the annotation before the comment as it is done in this PR does not trigger the error because the Squiz.Commenting.InlineComment sniff will only trigger the InvalidEndChar error if the first character of the comment is a letter.
I also considered using return true; // @codeCoverageIgnore, but this is not an option because it triggers Squiz.Commenting.PostStatementComment.Found.
Related issues/external references
Part of #146
Types of changes

[ ] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)

[ ] This change is only breaking for integrators, not for external standards or end-users.

[ ] Documentation improvement

PR checklist

[x] I have checked there is no other PR open for the same change.
[x] I have read the Contribution Guidelines.
[x] I grant the project the right to include and distribute the code under the BSD-3-Clause license (and I have the right to grant these rights).
[ ] I have added tests to cover my changes.
[x] I have verified that the code complies with the projects coding standards.
[ ] [Required for new sniffs] I have added XML documentation for the sniff.

Here is the issue: https://github.com/PHPCSStandards/PHP_CodeSniffer/issues/560


New warnings in 0.11.0 (ClojureScript)

I guess these are all innocuous warnings:
WARNING: Use of undeclared Var cljs.js/*eval-fn* at line 52 tests-out/com/rpl/specter/impl.cljs
WARNING: cljs.js/*eval-fn* not declared ^:dynamic at line 52 tests-out/com/rpl/specter/impl.cljs
WARNING: Use of undeclared Var cljs.js/*eval-fn* at line 52 tests-out/com/rpl/specter/impl.cljs
WARNING: Use of undeclared Var cljs.js/*eval-fn* at line 52 tests-out/com/rpl/specter/impl.cljs
WARNING: Use of undeclared Var cljs.js/js-eval at line 52 tests-out/com/rpl/specter/impl.cljs
WARNING: Use of undeclared Var cljs.js/*eval-fn* at line 52 tests-out/com/rpl/specter/impl.cljs
WARNING: Use of undeclared Var cljs.js/eval at line 53 tests-out/com/rpl/specter/impl.cljs
WARNING: Use of undeclared Var cljs.js/empty-state at line 53 tests-out/com/rpl/specter/impl.cljs

However we do fail our builds when the ClojureScript compiler emits warnings, since they're almost always errors. Would be nice to have these fixed.
Keep up the good work! :)
Cheers,
Alf

Already fixed for next version, see #97. Will leave this issue open until that release.

Oh, sorry. Searched for "WARNING", but I guess I only did it in open issues. Good idea to keep this open, then.


factor out canvas backing logic for widgets

create a new mixin called e.g. CanvasBacked that performs the canvas drawing logic for a widget. unexpose Widget.get_canvas, and instead expose:

a CanvasBacked.refresh method, which will do effectively what Widget.draw now does; and
a Widget.draw method, which will draw a widget at specified coordinates on the screen or active canvas

note that there will be no CanvasBacked.get_canvas. this is because with CanvasBacked's implementation of draw, there will be no need to leak the canvas. for that matter the mixin can be called something more centered on its extrinsic properties instead, such as Buffered
the idea here is that widgets can be designed to be buffered or not depending on their needs. like it's probably not necessary for a simple button widget to have its own canvas

resoloved by https://github.com/HeladoDeBrownie/Nexus/commit/7aabbd679d4e83e0a108eaaf2fd116cc06436823

resoloved by https://github.com/HeladoDeBrownie/Nexus/commit/7aabbd679d4e83e0a108eaaf2fd116cc06436823


Execution in non-interactive environment

I am trying to make samgeo to work outside the context of a python notebook. I already subclassed SamGeo and overrided the tiff_to_tiff method to remove the tqdm wrapper from the sample_grid iterator. Even still, the process gets frozen and am still unable to properly debug the issue. Are there any other jupyter-specific methods/classes used?
(I am developing a QGIS wrapper here )

Hi @lymperis-e , I think your problem is relative to QGIS and how you call the pytorch in the background, not segment-geospatial. It can be problem when the GPU is used by a QGIS thread and you try to init a pytorch model.
To avoid freeze and errors in one of my script, I had to add this code to the class definition :
class Process(QgsProcessingAlgorithm):
    ....
    def flags(self):
        return super().flags() | QgsProcessingAlgorithm.FlagNoThreading

Not sure if this the same logic in plugins...
But I'm pretty sure this is a threading problem, which is common when coding PyQt.
Hope this will help.

@vidlb Thank you for helping out. Closing this issue for now. Feel free to reopen it if you are still experiencing issues @lymperis-e

HI.
I am working with Fast Sam and want to execute Fast Sam without a notebook, like a simple Python script. I want to save the final output image in a directory. But show_anns() function is giving a Segmentation fault (core dumped) error. By debugging more , the function
fast_show_mask_gpu(
                annotations,
                plt.gca(),
                random_color=mask_random_color,
                bboxes=bboxes,
                points=points,
                pointlabel=point_label,
                retinamask=retina,
                target_height=original_h,
                target_width=original_w,
            )

is creating the problem.  Should I make edits  in fast_show_mask_gpu or is there any  easy approach to bypassing this function and save the final image with colorful masks like below. Thanks.

Feel free to submit a pull request if you can fix the issue


8.1.2 XML error

Hello,
We have recently newly installed the SpineOMatic program, but have not been successful in getting it to access ExLibris.  Other campuses in our district have not had problems and we have followed all of the very simple instructions and advice. We are unable to move the files to the C drive because of admin issues, but others have successfully run their programs from the desktop files which we have also moved the program to.  Any information on how we can get this issue resolved?

@rmking48, is the program not working at all, or are you getting an XML error in the label window when you scan a barcode?

Hello - we are able to update the various tabs and add the API key and Alma URL, but only when we scan a barcode do we get the error.

@rmking48, are the workstations at all campuses administered by the same IT team? Generally, this error occurs if the workstation is using a version of TLS < 1.2.  The application defers to the operating system to set the TLS version. Alma doesn't like anything less than 1.2.

Correct - yes, we have different IT teams, and I have asked ours to verify if we have TLS 1.2 enabled, but so far no one has gotten back to us.


Custom prompt formatting closures, documentation enhancements, lifting to llama.cpp upstream

Custom prompt formatting closures, documentation enhancements, lifting to llama.cpp upstream
:recycle: Current situation & Problem
While lifting SpeziFHIR and LLMonFHIR to SpeziLLM as well as implementing a demo application for the CS342 class, I noticed some inconveniences and behavior that need to be adjusted slightly.
Furthermore, the current SpeziLLM implementation doesn't utilize new llama.cpp APIs and doesn't allow for custom prompt formatting closures for local LLMs, which is important to serve a variety of different LLM categories.
:gear: Release Notes

Documentation enhancements and improved consistency
Lift to up-to-date llama.cpp upstream
Enabling custom prompt formatting closures

:books: Documentation
Adjusted the in-line DocC comments as well as DocC articles to reflect changes in SpeziLLM.
:white_check_mark: Testing
Tested locally with SpeziFHIR and LLMonFHIR and whilst writing a demo application for the CS342 class.
:pencil: Code of Conduct & Contributing Guidelines
By submitting creating this pull request, you agree to follow our Code of Conduct and Contributing Guidelines:

[x] I agree to follow the Code of Conduct and Contributing Guidelines.

@PSchmiedmayer Please force merge once again as we have some codecov misses


Issue 18244: std.math generic functions need to have sig constraints

Not having any sig constraints causes needless conflicts with user-defined numerical types, e.g.:
// myNumber.d
module myNumber;
struct MyNumber { ... }
int signbit(T : MyNumber)(T num) { ... }

// usercode.d
import myNumber;
import std.math;
MyNumber num;
auto x = signbit(num); // tries to call std.math.signbit, and fails

To anticipate the objection "user code should not use the name signbit": sometimes, we want to deliberately reuse established names for certain operations, so that we can drop in a user-defined type as a replacement for built-in floats without having to modify a lot of user code. As long as it behaves similarly enough to a built-in float, it should be allowed with a minimum of roadblocks.

Another regression: https://issues.dlang.org/show_bug.cgi?id=18473

Why did this even make it into a PATCH release ?
Breaking user code which have been working for years gratuitously is not nice, but in a patch release, it's definitely not okay. And why wasn't it fixed in another patch release ?
For ref, I came accross this while trying to use std_data_json: https://github.com/s-ludwig/std_data_json/pull/36

Yeah, it should not have been merged into a patch release when there's a regression filed against it.

It was indeed more of an enhancement than a bug fix and shouldn't have landed in stable.
Requires a bit of attention to distinguish such issues in Bugzilla.
How should we proceed? For the time being I'd consider to just revert this.
Any good idea how to test if sth. is convertible to a numeric type? This reminds me of the similar issue we had with constraints on strings that stopped working with alias this string types.

It has already been reverted #6213.

Similar to what we had to do for string constraints.
15027 – rangified functions no longer work with alias this'ed strings (e.g. DirEntry)
https://github.com/dlang/phobos/pull/3770
https://github.com/dlang/phobos/pull/3774

Is there an easy way to check if something might be related to a regression?  Because @John-Colvin had already filed one after this PR was merged, before it landed in stable.
Anyway, about conversion, I'm thinking it's probably possible, but unlikely to be a simple one-liner. Probably have to factor out the test(s) into a helper template.

Any good idea how to test if sth. is convertible to a numeric type?

Don't. It is always a mistake. Checking for "is it an integer or floating point type" makes no more sense than "is it a string or an integer". They look very similar to each other but actually have no non-trivial semantics in common.
Even if you restrict yourself to floating point types, one immediate problem you face is, is it losslessly convertible to a numeric type? Lossy conversion is something you didn't have to worry about with strings.
Can int be converted to double? Even that question isn't simple.

Supporting implicit conversions with templated functions is almost always a mistake. It generally causes subtle bugs, though which bugs it causes tends to depend on the types involved. Part of the problem we frequently have with that though is that a function that's not templated inherently supports various implicit conversions but in a way that the conversion is forced at the call site, and when we go and change the function so that it's templated, the semantics change even if it accepts exactly the same set of types. It doesn't look like that's the case with what happened here, but implicit conversions in generic code tend to be a nasty can of worms and are usually best avoided.


TypeError: DeciLMForCausalLM.init() takes from 1 to 3 positional arguments but 4 were given

Hi! Thx for the new release. I just realized that loading DeciLM doesn't seem to work anymore in 0.3.0.
from vllm import LLM

llm = LLM(model="Deci/DeciLM-7B", trust_remote_code=True)  # Name or path of your model

Throws:
[/usr/local/lib/python3.10/dist-packages/vllm/model_executor/model_loader.py](https://localhost:8080/#) in get_model(model_config, lora_config)
     70         with torch.device("cuda"):
     71             if getattr(model_class, "supports_lora", False):
---> 72                 model = model_class(model_config.hf_config, linear_method,
     73                                     lora_config)
     74             elif lora_config:

TypeError: DeciLMForCausalLM.__init__() takes from 1 to 3 positional arguments but 4 were given

This did work in 0.2.7.
Tested (i) in colab and (ii) on recent NVIDIA docker image with A6000.

I've run into the exact same issue as well.

Hi, @ggbetz @ggbetz . This issuce has been solved in v0.3.1.


Detecting fold/unfold click

Hello,
I'am using the VueJS version of bosket and I'am struggled with probably a stupid thing, how could i detect that a click on the opener has been made,  I knowh there is the onSelect method which is triggered when an item is selected, but i would like to know is if there is a way to have a kind of OnOpener method which would provide the state of  the node (fold/unfold) and the item corresponding to it but without selecting the item.
Thanks,
JM

Hello @jmguil !
I've published a new version with a callback added when you click on an 'opener'.
Here's the documentation link (optional properties > openerOpts) and also a little fiddle.
Hope it will help 😉 .

Hello,
Fantastic ! Thanks for your reactivity :-)
I will try that today.


경기대학교 원격 교육원 추가

경기대학교 원격 교육원 추가

Add ekgu.ac.kr

@Asura77 Thank you for your patience while waiting for a review and processing your request. Pull request merged. Please start applying for JetBrains educational subscription at https://www.jetbrains.com/shop/eform/students in an hour, to allow the changes to propagate through JetBrains systems.


HHH-15674 @NamedEntityGraph not working on entity that have composite PK

https://hibernate.atlassian.net/browse/HHH-15674

Thanks @beikov


Hide edges when filtering nodes in graph view

Summary
When filtering nodes, hide the graph edges as well as the nodes, or at least provide an option to toggle this behavior.
Use Cases
Suppose I have 100 parallel nodes and I want to find the 1 node that failed, I will filter to only the failed nodes. Then I still have to scroll back and forth to find the actual node. Once I have filtered, that should simply be the only remaining node in that layer. This kind of "empty tree" view is not very helpful. (I promise, there is a failed node off to the left somewhere 😄)

Message from the maintainers:
Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

Is there any update on this?
It would be very nice to have the feature as filtering would work much better.
When you have many nodes, filtering them out is useful, but if the empty tree is still there it makes the filtering of nodes less useful


is there a documented syntax diagram for the command template?

I want to extend an app I wrote, which copied an example from another app.
it has optional words
it has
 (ask) appname (to) *

I want to have both tell and ask as optional first words.
but I have never seen a full syntax diagram of what is allowed
is it
(ask|tell)
or
(ask) (tell)
or something else?
sorry for submitting an issue.. I cannot find any doc that describes this

@sdetweil
The basic way to define commands does not support multiple options for an optional parameter. You can see the full explanation of what is supported in the documentation.
To achieve what you want you can either define two separate commands that point at the same function, like this:
var commands = {
  '(ask) appname (to) *do': myFunction,
  '(tell) appname (to) *do': myFunction,
};

Or better yet, use a regular expression to define your command syntax.

thanks but the 'doc' doesn't even describe what 'optional' looks like
(surround by ellipsis)
this works correctly
(ask) (tell)  appname (to) *

Just note that your solution of (ask) (tell) appname (to) * isn't just ask or tell. It would accept ask and/or tell, but only in that specific order (i.e., it will accept the sentence ask tell appname to do but not tell ask appname to do). It gets the job done, but it also seems to me like a solution that could lead to hard to debug issues down the line.