text:
[Snyk] Security upgrade com.amazonaws:aws-java-sdk-core from 1.12.239 to 1.12.760

This PR was automatically created by Snyk using the credentials of a real user.![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123)
Snyk has created this PR to fix 61 vulnerabilities in the maven dependencies of this project.
Snyk changed the following file(s):

api/pacman-api-admin/pom.xml

Vulnerabilities that will be fixed with an upgrade:

Issue
Score
Upgrade

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-608664
  780
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  Reachable Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-450917
  705
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Mature

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-467015
  675
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Mature

Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426
  670
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  Reachable Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1054588
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056416
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056418
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056420
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056421
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056426
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056427
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-174736
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-548451
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-559094
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-559106
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-560762
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-561585
  630
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1009829
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1047324
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056414
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056417
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056419
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056424
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056425
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-467016
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-560766
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-561362
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-561373
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-561586
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-561587
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-564887
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-564888
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-570625
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-572300
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-572314
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-572316
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-72448
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-72449
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-72450
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-72451
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-72882
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-72883
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-72884
  563
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

XML External Entity (XXE) Injection SNYK-JAVA-COMFASTERXMLJACKSONCORE-1048302
  560
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1052449
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1052450
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-1061931
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-455617
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-467014
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-469674
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-469676
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-471943
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-472980
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-540500
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-6056407
  555
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244
  525
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329
  525
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038424
  520
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-450207
  520
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found Proof of Concept

Information Exposure SNYK-JAVA-COMMONSCODEC-561518
  485
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  Reachable No Known Exploit

Improper Input Validation SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-1048058
  415
com.amazonaws:aws-java-sdk-core:  1.12.239 -> 1.12.760  No Path Found No Known Exploit

[!IMPORTANT]

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:
🦉 Deserialization of Untrusted Data
🦉 XML External Entity (XXE) Injection
🦉 Denial of Service (DoS)
🦉 More lessons are available in Snyk Learn

Checkmarx One – Scan Summary & Details – f1ea51e7-8150-4369-b139-d654d1e8728c
New Issues

Severity
Issue
Source File / Package
Checkmarx Insight

Cleartext_Submission_of_Sensitive_Information
/lambda-functions/notification-es-logging-service/src/main/java/com/paladincloud/notification_log/config/AuthManager.java: 44
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/lambda-functions/notification-es-logging-service/src/main/java/com/paladincloud/notification_log/config/AuthManager.java: 44
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-rule-engine-2.0/src/main/java/com/tmobile/pacman/commons/autofix/manager/AuthManager.java: 41
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-aqua-enricher/src/main/java/com/tmobile/cso/pacman/aqua/jobs/AquaDataImporter.java: 37
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-rule-engine-2.0/src/main/java/com/tmobile/pacman/commons/autofix/manager/AuthManager.java: 41
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-rule-engine-2.0/src/main/java/com/tmobile/pacman/commons/autofix/manager/AuthManager.java: 41
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-asset/src/main/java/com/tmobile/pacman/api/asset/service/AssetServiceImpl.java: 856
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-rule-engine-2.0/src/main/java/com/tmobile/pacman/executor/PolicyExecutor.java: 141
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-rule-engine-2.0/src/main/java/com/tmobile/pacman/executor/PolicyExecutor.java: 141
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/gcp-discovery/src/main/java/com/tmobile/pacbot/gcp/inventory/auth/GCPCredentialsProvider.java: 281
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/azure-discovery/src/main/java/com/tmobile/pacbot/azure/inventory/auth/AzureCredentialProvider.java: 72
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/azure-discovery/src/main/java/com/tmobile/pacbot/azure/inventory/auth/AzureCredentialProvider.java: 67
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/gcp-discovery/src/main/java/com/tmobile/pacbot/gcp/inventory/auth/GCPCredentialsProvider.java: 281
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/azure-discovery/src/main/java/com/tmobile/pacbot/azure/inventory/auth/AzureCredentialProvider.java: 72
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/azure-discovery/src/main/java/com/tmobile/pacbot/azure/inventory/auth/AzureCredentialProvider.java: 67
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/service/AmazonCognitoConnector.java: 121
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-vulnerability/src/main/java/com/tmobile/pacman/api/vulnerability/service/VulnerabilityService.java: 973
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/gcp-discovery/src/main/java/com/tmobile/pacbot/gcp/inventory/auth/GCPCredentialsProvider.java: 281
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/azure-discovery/src/main/java/com/tmobile/pacbot/azure/inventory/auth/AzureCredentialProvider.java: 72
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/azure-discovery/src/main/java/com/tmobile/pacbot/azure/inventory/auth/AzureCredentialProvider.java: 67
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/gcp-discovery/src/main/java/com/tmobile/pacbot/gcp/inventory/auth/GCPCredentialsProvider.java: 143
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/gcp-discovery/src/main/java/com/tmobile/pacbot/gcp/inventory/auth/GCPCredentialsProvider.java: 144
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-data-shipper/src/main/java/com/tmobile/cso/pacman/datashipper/util/AssetGroupUtil.java: 391
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-data-shipper/src/main/java/com/tmobile/cso/pacman/datashipper/util/AssetGroupUtil.java: 373
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-data-shipper/src/main/java/com/tmobile/cso/pacman/datashipper/util/AssetGroupUtil.java: 391
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-data-shipper/src/main/java/com/tmobile/cso/pacman/datashipper/util/AssetGroupUtil.java: 373
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-data-shipper/src/main/java/com/tmobile/cso/pacman/datashipper/util/AssetGroupUtil.java: 391
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-data-shipper/src/main/java/com/tmobile/cso/pacman/datashipper/util/AssetGroupUtil.java: 373
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/controller/AccountsController.java: 59
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/controller/AccountsController.java: 59
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/controller/AccountsController.java: 59
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/controller/AccountsController.java: 59
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/controller/AccountsController.java: 59
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/lambda-functions/notification-template-formatter-service/src/main/java/com/paladincloud/HttpUtil.java: 154
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/lambda-functions/notification-send-email-service/src/main/java/com/paladincloud/utils/HttpUtil.java: 152
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/controller/AccountsController.java: 59
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/QualysAccountServiceImpl.java: 132
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/QualysAccountServiceImpl.java: 125
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/jobs/pacman-data-shipper/src/main/java/com/tmobile/cso/pacman/datashipper/util/AuthManager.java: 22
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 125
Attack Vector

Cleartext_Submission_of_Sensitive_Information
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/TenableAccountServiceImpl.java: 119
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 20540
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 20540
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 20540
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 20540
Attack Vector

Client_Potential_XSS
/webapp/src/app/shared/searchable-dropdown/searchable-dropdown.component.ts: 142
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 21841
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 21838
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 21831
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 21828
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 21825
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 21822
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger.js: 63
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 20550
Attack Vector

Client_Potential_XSS
/commons/pac-api-commons/src/main/resources/docs/v1/js/swagger-ui.js: 20547
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 111
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 106
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 111
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 106
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 151
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 154
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 151
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 154
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 151
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 154
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 151
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 154
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 111
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 106
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 111
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 106
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/controller/AccountsController.java: 59
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 89
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AwsAccountServiceImpl.java: 213
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AwsAccountServiceImpl.java: 216
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/QualysAccountServiceImpl.java: 155
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/QualysAccountServiceImpl.java: 158
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 151
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 154
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 151
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 154
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 151
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 154
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 151
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AquaAccountServiceImpl.java: 154
Attack Vector

Privacy_Violation
/api/pacman-api-admin/src/main/java/com/tmobile/pacman/api/admin/repository/service/AbstractAccountServiceImpl.java: 111
Attack Vector

More results are available on AST platform

repo: TheRedHatter/CE


text:
[Snyk] Security upgrade php from 7.1-apache to 7.4.33-apache

This PR was automatically created by Snyk using the credentials of a real user.
Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.
Changes included in this PR

base/gitlist/0.6.0/Dockerfile

We recommend upgrading to php:7.4.33-apache, as this image has only 225 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.
Some of the most important vulnerabilities in your base image include:

Severity
Priority Score / 1000
Issue
Exploit Maturity

929
Server-Side Request Forgery (SSRF) SNYK-DEBIAN10-APACHE2-1585740
Mature

929
Server-Side Request Forgery (SSRF) SNYK-DEBIAN10-APACHE2-1585740
Mature

929
Server-Side Request Forgery (SSRF) SNYK-DEBIAN10-APACHE2-1585740
Mature

929
Server-Side Request Forgery (SSRF) SNYK-DEBIAN10-APACHE2-1585740
Mature

886
Out-of-bounds Write SNYK-DEBIAN10-APACHE2-2322058
Mature

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
🛠 Adjust project settings

Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Server-Side Request Forgery (SSRF)

Checkmarx One – Scan Summary & Details – 7b6409b7-8ce8-417a-8cec-254bc00144e0
No New Or Fixed Issues Found

source: gharchive/pull-request

repo: TheRedHatter/vulhub

license: MIT

license_type: permissive

license_source: github-api


text:
NPE@temportalist.esotericraft.emulation.common.EntityState.serializeNBT

Server crash on killing blow to EnderZoo Wither Witch while using Tconstruct broadsword.
fml-server-latest.log.txt
crash-2016-06-08_11.57.10-server.txt

Can you provide more ways and steps to reproduce?

I got a similar crash. Happened when I entered menu to pause the game for an unrelated issue of hostile mobs ignoring players. Last entity killed was the only actual hostile entity, ironically a bat (part of rough mobs).
forge: 1954
mc: 1.9.4
EsoTeriCraft-1.9.4-0.0.1.71
Origin-1.9.4-9.1.6
log.txt

source: gharchive/issue

repo: TheTemportalist/EsoTeriCraft

license_source: bigquery


text:
fix(report/handlers): accept more semver versions

The current problem we have, specifically, is that since v1.2.0 the
mobile apps emit full semver including also the build.
This requires several parts of our infrastructure to improve the
regexp being used so to validate also this kind of input.
See also: measurement-kit/measurement-kit#1388
An earlier version of this diff was blessed by @hellais on Slack and
since then I just changed comments.

The build is failing like this:
function killitwithfire () {

    trap - ALRM

    kill -ALRM $prog 2>/dev/null

    kill -9 $! 2>/dev/null && exit 0

}

function waitforit () {

    trap "killitwithfire" ALRM

    sleep $1& wait

    kill -ALRM $$

}

waitforit $1& prog=$! ; shift ;

+prog=6047

+shift

+waitforit

trap "killitwithfire" ALRM INT

+trap killitwithfire ALRM

+trap killitwithfire ALRM INT

"$@"& wait $!

+wait

+sleep

+wait 6049

sleep: missing operand

Try 'sleep --help' for more information.

RET=$?

+RET=0

if [[ "$(ps -ef | awk -v pid=$prog '$2==pid{print}{}')" != "" ]]; then

    kill -ALRM $prog

    wait $prog

fi

+kill -ALRM 6046

ps -ef | awk -v pid=$prog '$2==pid{print}{}'

killitwithfire

++killitwithfire

++trap - ALRM

++kill -ALRM 6047

++kill -9 6049

++ps -ef

++awk -v pid=6047 '$2==pid{print}{}'

/home/travis/.travis/job_stages: line 57:  6046 Segmentation fault      (core dumped) ./.travis.test.sh 30 ./bin/oonib

The command "chmod +x .travis.test.sh && ./.travis.test.sh 30 ./bin/oonib" exited with 139.

I don't understand very well what it could be, and it seems like this is something related to the way in which travis is handling the test. I am going to restart it to see if it's deterministic (I actually hope so).

I am experiencing more errors with the build, like that the keyserver doesn't know the key. 😡

Alright, it seems it's time to play golf.

Coverage increased (+0.04%) to 78.469% when pulling 9e0eca426cacf7ec4e301fd612ed25d9c824e22a on fix/version_regexp into 03d738b8daa86ed103e435a23adc16e9bac64127 on master.

Coverage increased (+0.09%) to 78.527% when pulling ec91e00d53ea57413c7cb5301fc2d747433ee7d9 on fix/version_regexp into 03d738b8daa86ed103e435a23adc16e9bac64127 on master.

Coverage increased (+0.04%) to 78.469% when pulling 9bb6db5e2a453911873e6fa069f12a85466473fe on fix/version_regexp into 03d738b8daa86ed103e435a23adc16e9bac64127 on master.

I really hate these coveralls annoying comments that don't serve any purpose.

Coverage increased (+0.09%) to 78.527% when pulling d09c1c59e09743a3986ef27ca4d31f6878125b80 on fix/version_regexp into 03d738b8daa86ed103e435a23adc16e9bac64127 on master.

In the end, I decided to rewrite the test that caused a segfault.
I believe the problem appeared now that travis has upgraded its infrastructure to 14.04: the previous travis build was for 03d738b and occurred on Apr, 6 when travis was still using 12.04.
The original script was brilliant: it did two nested waits to make sure the running process was either killed gracefully or with fire. But probably was too brilliant and triggered some edge case.
I did not want to wrestle too much with travis. Also, reading the script, it seems to me it's fine to rewrite it such that, if we cannot kill the background process, the build will hang and then fail (on travis).
I guess having the local build hang and the travis build fail is good enough for our purposes.

Alright, I have read the diff once more. I am going to self bless this as good, given that @hellais already blessed the diff improving the regexp on Slack and that the test changes "look good to me".

authors: bassosimone coveralls

repo: TheTorProject/ooni-backend


text:
🛑 Trident API is down

In b7d830c, Trident API (https://thetrident.one/api) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Trident API is back up in 0509d6d after 20 minutes.

repo: TheTridentOne/upptime


text:
[Addition] World Pregenerators

Checklist

[X] I've checked that my mod suggestion hasn't already been added to one of the lists.
[X] I've checked the latest issues to make sure that this mod hasn't already been suggested.

What is your mod's name?
Chunk Pregenerator
What is your mod's main version?
Other (Forge)
What is your mod's other versions?
1.8.X or earlier, 1.12.X, 1.15.X (Forge), 1.16.X (Forge), 1.18.X (Forge), 1.19.X (Forge)
What is your mod's type?
Enhancement
What side dose your mod need to run on?
Both
Input a link to your suggested mod.
https://www.curseforge.com/minecraft/mc-mods/chunkpregenerator
What is your reasoning for including this mod?
Worldgen lag is a real issue. Even in Singleplayer, and worldpregeneration is actually a really important thing you should do.
This can turn it from "unplayable" to "playable" especially if your core count (including threads) is stuck at 4 or less or the CPU isn't the newest anymore... And even then its suggested to do so.
That's why I am suggestion ChunkPregenerator.
Which supports 1.4.7-1.7.x-1.8.9-1.10.x-1.11.x-1.12.x-1.14.x-1.15x-1.16x-1.18x-1.19.x
Also another mod that I would suggest is Chunky
Which is another pregenerator that provides a lot of performance gains and covers
forge-fabric-customservers
while chunkpregenerator is dedicated for forge.
(OPTIONAL) Give some extra information about the mod.
Chunk Pregenerator is a tool for generating your world before you actually play it.
It also includes maintenance tools such as:

Chunk Deletion/Trimming
Performance Tracking (up to 1.12)
World Maintenance tools (up to 1.12)
Retro-generation that isn't relying on the Player Itself.
Harddrive protection (1.14 or newer where it becomes nessesary)
Memory Leak fixes that become apparent when pregeneration.

And a few other things.

I've added your mod to performance mods as i think that is a better fit then Enhancement. Love your mods, Keep up the good work :D

@NordicGamerFE
Small extra note since i saw this.
Know issues + Fixes are actually tracked by myself.
Here you find both lists.
1.12 or older: https://github.com/TinyModularThings/Chunk-Pregenerator-Issue-Tracker/issues/1
1.14 or newer: https://github.com/TinyModularThings/Chunk-Pregenerator-Issue-Tracker/issues/2

authors: NordicGamerFE Speiger

repo: TheUsefulLists/UsefulMods


text:
[BUG]: Mute/Volume 0.0 not working while screen recording

Version
6.8.2
What platforms are you having the problem on?
Android
System Version
All
On what device are you experiencing the issue?
Real device
Architecture
Old architecture
What happened?
I encountered an issue, when I screen record my application using, react native video,

Screen Recorded video have the sound of the muted videos.
In some phone the file is corrupted or is a lot laggy
The saved video in the gallery have alot of sounds all over the components where the video is muted and volume is 0;

DO NOTE: the sound is not being played in the app itself, muting and unmuting is working in the app,
BUT on screen recording it, the sound of all those unpaused and muted video is there in the recorded video.
The code snippet is:
            video config=   Platform.select({
ios: {
  automaticallyWaitsToMinimizeStalling: false,
  bufferConfig: {
    minBufferMs: 2000,
    maxBufferMs: 5000,
    bufferForPlaybackMs: 1000,
    bufferForPlaybackAfterRebufferMs: 2000,
  },
},
android: {
  bufferConfig: {
    minBufferMs: 2000,
    maxBufferMs: 5000,
    bufferForPlaybackMs: 1000,
    bufferForPlaybackAfterRebufferMs: 2000,
  },
},

});
                       <Video
                            source={{
                                uri: videoUri,
                            }}
                            ref={ref => {
                                this.player = ref;
                            }}
                            onBuffer={this.onBuffer}
                            onError={this.videoError}
                            style={styles.thumbnailImage}
                            paused={isPaused}
                            repeat={true}
                            resizeMode="stretch"
                            muted={true}
                            {...videoConfig}
                        />

I even tried adding volume: 0, but it disnot work as well
Reproduction Link
Reproduction
Step to reproduce this bug are:

Initially when my video is paused nothing is happening,
But when video is changed from paused to played, the video sound is coming in the screen recording of my app,
DO NOTE: the sound is not being played in the app itself, muting and unmuting is working in the app,

BUT on screen recording it, the sound of all those unpaused and muted video is there in the recorded video.

look strange, but I don't know how we can fix it...
I usually use another package to control device volume instead of player volume :/
maybe switching to texture view can fix the issue. you can have a try I think.

Tried doing it on adding a viewType prop and changing it to textured view, still I am facing the same issue and sometimes the video is not openable by the phone, it says corrupted file or screen recording cannot be played, even on showing it on meet or any other screen sharing calls, It is creating an issue

Ok, another solution can be to unselect audio tracks I think

authors: AakashJaiswal-beta freeboub

repo: TheWidlarzGroup/react-native-video


text:
🛑 Jira is down

In 7f013b5, Jira (https://jira.internal.therapy-box.co.uk/) was down:

HTTP code: 503
Response time: 432 ms

Resolved: Jira is back up in 4ea34d0.

repo: TherapyBox/upptime


text:
Update Fadeless to 1.20.1

Currently, the mod is made for 1.20-Snapshot, and not 1.20.1.
Update to 1.20.1, when the update comes out.
Curse Forge Page

It works fine on 1.20.1, no update is required. Another mod it works well together with is remove reloading screen , which removes the resource pack reloading screen.

Great, I just noticed that it wasn't specifically for 1.20.1, so I figured that might cause issues.
Also yeah, that mod is also part of the pack :D

authors: DerpDerpling Therkelsen


text:
🛑 Outlook is down

In c0bad11, Outlook (https://outlook.live.com) was down:

HTTP code: 417
Response time: 118 ms

Resolved: Outlook is back up in a5fad8d after 12 minutes.

repo: Thexyz/Email-Monitoring


text:
Password Change logout handling

Currently, to destroy session button will log you out of your current device. It should log you out of all devices instead.

Session handling is a bit weird anyway. After the session times out, a reload redirects to https://identity.eurofurence.org/auth/choose. Clicking "Login with existing account" gets me directly to the dashboard without having to actually log in.

Hey @mowny
Thanks for your comment. Yes that is wanted as the openid connect Server saves a cookie depending on if you habe set the remember me.
The clients all got a limited session time. Although that session time does not end the cookie session at the idp.
E.x. the idp may have a cookie lifetime of 180 days meanwhile the apps only got an hour.
The right solution should be to redirect when the session times out.

Fixed by implementing #11, sessions are not concern of the idp. So session management can only be done by the idp for the IDP Apps not for the Reg as example. A fix for this could be backchannel logout.

authors: Thiritin mowny

repo: Thiritin/identity


text:
[GTA:SA] IVRadarScaling

Would it be possible to add the IVRadarScaling option to the GTA: San Andreas fix like in the Vice City and GTA 3 fixes?

I guess, but maybe later.


text:
🛑 Qbit is down

In b8a2115, Qbit (https://qbit.cond.dk) was down:

HTTP code: 502
Response time: 481 ms

Resolved: Qbit is back up in 95a4800 after 3 hours, 52 minutes.


text:
Update scalafmt-core to 3.7.11

About this PR
📦 Updates org.scalameta:scalafmt-core from 3.7.5 to 3.7.11
📜 GitHub Release Notes - Version Diff
Usage
✅ Please merge!
I'll automatically update this PR to resolve conflicts as long as you don't change it yourself.
If you'd like to skip this version, you can just close this PR. If you have any feedback, just mention me in the comments below.
Configure Scala Steward for your repository with a .scala-steward.conf file.
Have a fantastic day writing Scala!

⚙ Adjust future updates
Add this to your .scala-steward.conf file to ignore future updates of this dependency:
updates.ignore = [ { groupId = "org.scalameta", artifactId = "scalafmt-core" } ]

Or, add this to slow down future updates of this dependency:
dependencyOverrides = [{
  pullRequests = { frequency = "30 days" },
  dependency = { groupId = "org.scalameta", artifactId = "scalafmt-core" }
}]

labels: library-update, early-semver-patch, semver-spec-patch, commit-count:1

Superseded by #128.


text:
'in' can't be used as an identifier because it's a keyword.

iso 3166 country code of India have problem, as below:

Thanks for this issue. I will probably add a rename from in to indian

By the way, it is more common to use language codes. Or language code + country code. Using country code only is pretty rare

Fixed in 5.0.3.

By the way, it is more common to use language codes. Or language code + country code. Using country code only is pretty rare.
Also be aware that country codes must be in uppercase, e.g. CN not cn. Otherwise it is interpreted as language code like zh of zh-Hant-TW

Thanks a lot for the quick response, and We'll consider your suggestion. Thanks


text:
Api/sponsors implementation

I did it I think... I may have missed some good error handling and may have left a todo in there somewhere but I'll let you guys tell me if things still need to change

Unless I'm reading this wrong (which I definitely could be) the only travis errors I'm getting are for naming enum cases with a lowercase letter, which I do to match up with the variable name in the structs and the name of the api fields for decodable to work. Can we add a thing to ignore the rule for enums? I'm hoping that would be the easiest fix.

repo: TigerHacks/app-ios


text:
Allow raw installation outside of the context of PyPI.

If the package is installed outside of PyPI or an active checkout
(e.g. via pip install [some-path]), a version.py file might not be
created. Use a local version number in that case.

@thetorpedodog I've used python setup.py develop --user as my go-to for a while.  Are you trying to get it working from the top level repo folder without any install?

Figured out what spurred me to do this. It would cause an error if you pip-installed directly from git:
pip install --upgrade git+https://github.com/TileDB-Inc/TileDB-Cloud-Py.git@some-version-hash

repo: TileDB-Inc/TileDB-Cloud-Py


text:
Bump to 1.16.2 and update requirements

This PR does a few related things:

Bumps version to 1.16.2 (and resets build number to 0)
Builds for Python 3.12 (replaces #15 because 1.15.0 couldn't be built against 3.12)
Use the new conda-forge syntax to control and test the minimum supported Python version. Upstream supports >=3.10

Also note that this version 1.16.2 will not be able to be installed in the TileDB Cloud py39 environment since it requires py>=310. The goal is to install it in the updated py312 environment that is in progress

Confirmed that the version number is still working as expected (#12):
import: 'cellxgene_census'
+ python -c 'import cellxgene_census; print(cellxgene_census.__version__)'
1.16.2
+ pip check
No broken requirements found.

repo: TileDB-Inc/cellxgene-census-feedstock


text:
Fix security vulnerabilities

This PR fixes security vulnerabilities for current version of send-transform. All tests are passed.

If you're going to go the route of updating my fork, I'd rather keep it in sync with the original as much as possible.
That would mean applying my changes on top of the latest release of send. However, I notice you've updated some of the dependencies here to newer versions than those used by the latest release of send - does that mean the versions currently used by send have security vulnerabilities?

@TimBarham just a friendly ping on this.

authors: TimBarham ruslan-bikkinin

repo: TimBarham/send

license: mit


text:
fix: Do not throw an exception when the solution or entity classes are interfaces

The superclass of an interface is null. This caused this line of code to throw an exception for solution classes that are interface:
var superclass = bottomClass.getSuperclass();
lineageClassList.addAll(getAllAnnotatedLineageClasses(superclass, annotation));

Since getAllAnnotatedLineageClasses expected superclass to not be null. getAllAnnotatedLineageClasses now returns an empty list for null arguments.

I'm wondering if solutions as interfaces should be supported. What would be the use case? What would be the downsides?
Considering that in all the years we have not seen anyone ask us for this, maybe we don't need this.

authors: Christopher-Chianelli triceo

repo: TimefoldAI/timefold-solver


text:
replaced FocusTrap to TapRegion

I replaced FocusTrap to TapRegion because FocusTrap is not supporten now in Flutter 3.7.0 (https://github.com/flutter/flutter/pull/107262)

..

Hey @AurelVU, I'm sorry for closing your PR without merging it but I was already working on it.
The update is live on pub
Version 2.2.22

authors: AurelVU Tkko bugrevealingbme


text:
Update to 1.19.3

Update required libraries.

By the way, do you ever plan on uploading this to either or both Curseforge and Modrinth? Also, what about cutting off sharking from the mod if it keeps being unusable?

repo: Tlesis/SquakePlusPlus

license: Unlicense


text:
frame stepper doesnt work in geode

annoying

frame stepper isn't even a feature in the mod yet.

https://github.com/TobyAdd/GDH/issues/198

the feature is back in 4.6.4

authors: Chaotixu TobyAdd exploitle

repo: TobyAdd/GDH


text:
SQLite Testing Environment

Does this package work w/ a sqlite testing environment?
I'm getting the following error when using 'TEST' as the query string:
+errorInfo: array:3 [
        0 => "HY000"
        1 => 1
        2 => "near "'T%E%S%T%'": syntax error"
      ]

The query in my controller is as follows:
$query      = Searchy::search('products')
            ->fields('title', 'producer')
            ->query($q)
            ->getQuery()
            ->having('relevance', '>', 20)
            ->limit(20)
            ->pluck('id')
            ->toArray();

Unfortunately, this package only works with a MySQL database. It uses MySQL specific features to calculate match relevance.

authors: FutureFutureTo TomLingham

repo: TomLingham/Laravel-Searchy


text:
🛑 VTP.XYZ is down

In bef760f, VTP.XYZ (https://vtp.xyz/) was down:

HTTP code: 0
Response time: 0 ms

Resolved: VTP.XYZ is back up in bc4f774.

repo: TomsProject/uptime


text:
Questions on columnOrder API

Hi @TonyGermaneri,
Thanks for the quick feature release for columns sorting.
I've been playing around with it, and am able to retrieve the order using grid.columnOrder but cannot set the order. Looking over the docs, I assumed grid.columnOrder([1, 0 , 2, 3]) would work but got the error:
grid.columnOrder is not a function
May I get an example of how to set column order?
Thanks,
Louis
PS: Theres a duplicate entry for columnOrder in the API documentation https://tonygermaneri.github.io/canvas-datagrid/docs/#canvasDatagrid.columnOrder

All fixed!
https://tonygermaneri.github.io/canvas-datagrid/docs/#canvasDatagrid.columnOrder
Thanks again for pointing this out.

authors: LabShareLouie TonyGermaneri

repo: TonyGermaneri/canvas-datagrid


text:
Adds support for custom GYP include

When developers have libraries in non-standard locations (or don't wish
to dump them into System32 on Windows), they need to run "node-gyp
configure", edit the generated files to add include paths, and then run
"node-gyp install"
This is doubly painful when you wanted to "npm install" something, but
it depends on a library being in a default path on your system.
I've added the ability for users to include an additional ".gyp" file in
all node-gyp builds by setting an environment variable
(NODE_GYP_ADDITIONAL_CONFIG), which they can use to configure
include/library paths.  No longer must I manually install packages or
dump files into global include directories.

Has this been resolved in subsequent releases? I'm currently stuck trying to install packages that require libraries I've installed in custom locations.

The preferred way to do this is to add a common.gypi file to the root of your module. For example: https://github.com/TooTallNate/node-vorbis/blob/master/common.gypi

authors: TooTallNate anprogrammer bdunlay

repo: TooTallNate/node-gyp


text:
Proper Arc support for schematic and footprint

The arcs for the schematic and footprint are rarely properly placed. It needs to be correctly handled.
I pushed some work on the Fix_ARC branch, but I cannot figure out how to draw them, there are always components for which it does not work.
For now, I tried to use the GetCenterParam function, which is reversed from https://easyeda.com/editor/6.5.5/js/editorPCB.min.js
This function seems to return the coordinates of the center (or possibly the midpoint in some occasions ? ), and two angles, but when using theses to calculate the start point, end point and center, the result is inconsistent, sometimes it works, sometimes it doesn't.
The schematic equivalent is more consistent and seems to have less issues.
The following components have an arc in their footprint and could be used to test:
C55684 C185659 C86002 C312983 C1341701 C307522 C689358 C403695 C602208 C152951 C688068 C163798 C661330
This concern the h_ARC function in the footprint :
https://github.com/TousstNicolas/JLC2KiCad_lib/blob/b5c38c2beff6f710eb8ac427622384717539ce84/JLC2KiCadLib/footprint/footprint_handlers.py#L174-L278

I made my version of the code and it seems to be working pretty well so far:
https://github.com/Xyntexx/JLC2KiCad_lib/tree/my_ARC_Fixes

Thanks a lot for your work, merged in 12c6860aecd43dd8b4262347f74a3bb06de85959

authors: TousstNicolas Xyntexx


text:
USB Mass Storage mode - eMMC unrecognized with pinephoneA64

Successful Tow-Boot Install
- Tow-Boot 2021.10-004 was successfully installed on a pinephoneA64.
- I first verified booting pOS from eMMC.
- I then verified the Mass Storage mode successfully using a Windows10 host.
- USB device was recognized as a "PinePhone (A64)", and the eMMC partitions are viewable.

Mass Storage mode issue
- After install; rebooted phone with USB plug still plugged in, but battery out.
- Entered into Mass Storage mode, (blue LED).
- Windows host now reporting, "Unknown USB Device (Device Descriptor Request Failed)".

Mass Storage mode issue reoccurring across phone reboots
- Tried again by disconnecting USB cable, inserting battery, and rebooting phone.
- Entered into Mass Storage mode, (blue LED).
- Plugged in USB cable.
- Windows host still reporting, "Unknown USB Device (Device Descriptor Request Failed)".

@BCoyler
I was having very similar issue.
Turns out i connected my pinephone to USB 2.0 port of the host device.
Tried with different port(USB 3.0) port and device was recognized.
If you haven't already found the solution. Give above method a try maybe it will resolve your issue as well.

Had the same problem. For me, the problem cames from the provided (red) cable. Using another USB-C cable works at first try.

authors: BCoyler Disctanger Narann

repo: Tow-Boot/Tow-Boot


text:
how can I using with react native

as title, thanks

thanks a lots

repo: TowhidKashem/snapchat-clone


text:
fix/docs/chunk

@dcvz
I was a bit late to review your chunk operation. It's very nice but I found something was wrong with the doc. I made a test that explains why I'm changing it. Is this the behaviour you want?

@dcvz now it should have the right behaviour

repo: Tracel-AI/burn


text:
Using a standard .env file instead of config.yaml for docker deployment.

Refactoring docker image example docker deployments to take a standard .env file with variables defined in the docker-compose itself to simplify docker custom deployments (eg. on Portainer).
Description

You will customize the installation via .env file instead of YAML.

Related Issues

No direct issue, just a Discord conversation.
Solution and Design

This setup helps deployments via docker for users which have a production-like environment. It's focused on the docker installation, it will not impact non-docker usage.
Test Plan

Type of change

[ ] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[x] Breaking change (fix or feature that would cause existing functionality to change)
[ ] Docs update

Checklist

[x] My pull request is atomic and focuses on a single change.
[x] I have read the contributing guide and my code conforms to the guidelines.
[x] I have documented my changes clearly and comprehensively.
[ ] I have added the required tests.

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.

With the lastest release I'm having another issue here:
Traceback (most recent call last):
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/base.py", line 145, in __init__
    self._dbapi_connection = engine.raw_connection()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/base.py", line 3288, in raw_connection
    return self.pool.connect()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 452, in connect
    return _ConnectionFairy._checkout(self)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 1267, in _checkout
    fairy = _ConnectionRecord.checkout(pool)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 716, in checkout
    rec = pool._do_get()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/impl.py", line 284, in _do_get
    return self._create_connection()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 393, in _create_connection
    return _ConnectionRecord(self)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 678, in __init__
    self.__connect()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 902, in __connect
    with util.safe_reraise():
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/util/langhelpers.py", line 147, in __exit__
    raise exc_value.with_traceback(exc_tb)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 898, in __connect
    self.dbapi_connection = connection = pool._invoke_creator(self)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/create.py", line 637, in connect
    return dialect.connect(*cargs, **cparams)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/default.py", line 615, in connect
    return self.loaded_dbapi.connect(*cargs, **cparams)
  File "/opt/venv/lib/python3.10/site-packages/psycopg2/__init__.py", line 122, in connect
    conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
psycopg2.OperationalError: could not translate host name "super__postgres" to address: Name or service not known
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
  File "/opt/venv/bin/alembic", line 8, in <module>
    sys.exit(main())
  File "/opt/venv/lib/python3.10/site-packages/alembic/config.py", line 632, in main
    CommandLine(prog=prog).main(argv=argv)
  File "/opt/venv/lib/python3.10/site-packages/alembic/config.py", line 626, in main
    self.run_cmd(cfg, options)
  File "/opt/venv/lib/python3.10/site-packages/alembic/config.py", line 603, in run_cmd
    fn(
  File "/opt/venv/lib/python3.10/site-packages/alembic/command.py", line 385, in upgrade
    script.run_env()
  File "/opt/venv/lib/python3.10/site-packages/alembic/script/base.py", line 582, in run_env
    util.load_python_file(self.dir, "env.py")
  File "/opt/venv/lib/python3.10/site-packages/alembic/util/pyfiles.py", line 94, in load_python_file
    module = load_module_py(module_id, path)
  File "/opt/venv/lib/python3.10/site-packages/alembic/util/pyfiles.py", line 110, in load_module_py
    spec.loader.exec_module(module)  # type: ignore
  File "<frozen importlib._bootstrap_external>", line 883, in exec_module
  File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
  File "/app/migrations/env.py", line 94, in <module>
    run_migrations_online()
  File "/app/migrations/env.py", line 82, in run_migrations_online
    with connectable.connect() as connection:
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/base.py", line 3264, in connect
    return self._connection_cls(self)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/base.py", line 147, in __init__
    Connection._handle_dbapi_exception_noconnection(
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/base.py", line 2426, in _handle_dbapi_exception_noconnection
    raise sqlalchemy_exception.with_traceback(exc_info[2]) from e
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/base.py", line 145, in __init__
    self._dbapi_connection = engine.raw_connection()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/base.py", line 3288, in raw_connection
    return self.pool.connect()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 452, in connect
    return _ConnectionFairy._checkout(self)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 1267, in _checkout
    fairy = _ConnectionRecord.checkout(pool)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 716, in checkout
    rec = pool._do_get()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/impl.py", line 284, in _do_get
    return self._create_connection()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 393, in _create_connection
    return _ConnectionRecord(self)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 678, in __init__
    self.__connect()
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 902, in __connect
    with util.safe_reraise():
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/util/langhelpers.py", line 147, in __exit__
    raise exc_value.with_traceback(exc_tb)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/pool/base.py", line 898, in __connect
    self.dbapi_connection = connection = pool._invoke_creator(self)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/create.py", line 637, in connect
    return dialect.connect(*cargs, **cparams)
  File "/opt/venv/lib/python3.10/site-packages/sqlalchemy/engine/default.py", line 615, in connect
    return self.loaded_dbapi.connect(*cargs, **cparams)
  File "/opt/venv/lib/python3.10/site-packages/psycopg2/__init__.py", line 122, in connect
    conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) could not translate host name "super__postgres" to address: Name or service not known

Looks like alembic.ini has hardcoded db credentials.

We have a pr for this,
https://github.com/TransformerOptimus/SuperAGI/pull/1136
waiting on its review @andreacasarin

What if I make a new docker compose definition, something like: docker-compose.prod.yaml which has the preferred vector store and explicit env vars for production like deployments? I can let the example there and add a new one.
I think it would also be great to have a nginx image built so that you can actually deploy without pulling the whole repo.

Perfect then, I'll restore the example and go with docker-compose.prod.yaml, just a couple more questions:

which would be the preferred vector store?
i'd keep the env file minimal, just the required env vars to start the project, then if I got this right, the rest can be configured via gui, right?

Also, we still need https://github.com/TransformerOptimus/SuperAGI/pull/1149#issuecomment-1698503784 done to make it viable.

which would be the preferred vector store?

By default we are using redis vector store
keep .env.dist the same, because we can set variables from the gui, but the vector stores
in docker hub we have setup autobuilds so every push to main and dev gets build

which would be the preferred vector store?
By default we are using redis vector store

Ok, but does it work adding knowledge to that? Because in my installation it asks to configure a new vector store to add knowledge.

keep .env.dist the same, because we can set most variables from the gui, but the vector stores

I'm not sure I got it right, but I'll leave it like that if that is what you prefer. I'd only like to point out that it gets a bit overwhelming to have so many vars in there, especially since there are also 6 docker compose specifications.

in docker hub we have setup autobuilds so every push to main and dev gets build

Ok!

Pushed, it requires nginx/DockerfileNginx to be added to the autobuild as superagi/superagi-proxy.

Pushed, it requires nginx/DockerfileNginx to be added to the autobuild as superagi/superagi-proxy.

i'll add it

keep .env.dist the same, because we can set most variables from the gui, but the vector stores

I'm not sure I got it right, but I'll leave it like that if that is what you prefer. I'd only like to point out that it gets a bit overwhelming to have so many vars in there, especially since there are also 6 docker compose specifications.

To explain a bit more my point-of-view:

I'd go with 1 base docker compose with the bare minimum and then maybe a couple more which will be used to override the base one for different applications (like local dev, local llm, prod) they could only override the base one in specific keys;

we'll discuss more towards this, there are some issues with gui hmr

I'd add a .env.dist with the minimum variables needed to start the project and point out that you can actually configure all the rest from the gui.

The reason why I wanted to keep env.dist with all the keys is to let users know all the keys in the project in one place
we'll comment everything out other than the bare minimum

Just my 2 cents, I'll stop arguing :)

No issues

which would be the preferred vector store?
By default we are using redis vector store

Ok, but does it work adding knowledge to that? Because in my installation it asks to configure a new vector store to add knowledge.

sorry  forgot about knowledge, asked @Tarraann ( main contributor to knowledges )
to use knowledge for now only pinecone, weviate and qdrant are supported
so keeping the weviate commented out should be good for users to quickly set it up

keep .env.dist the same, because we can set most variables from the gui, but the vector stores

I'm not sure I got it right, but I'll leave it like that if that is what you prefer. I'd only like to point out that it gets a bit overwhelming to have so many vars in there, especially since there are also 6 docker compose specifications.

in docker hub we have setup autobuilds so every push to main and dev gets build

Ok!

keep .env.dist the same, because we can set most variables from the gui, but the vector stores

I'm not sure I got it right, but I'll leave it like that if that is what you prefer. I'd only like to point out that it gets a bit overwhelming to have so many vars in there, especially since there are also 6 docker compose specifications.

To explain a bit more my point-of-view:

I'd go with 1 base docker compose with the bare minimum and then maybe a couple more which will be used to override the base one for different applications (like local dev, local llm, prod) they could only override the base one in specific keys;

we'll discuss more towards this, there are some issues with gui hmr

👍

I'd add a .env.dist with the minimum variables needed to start the project and point out that you can actually configure all the rest from the gui.

The reason why I wanted to keep env.dist with all the keys is to let users know all the keys in the project in one place we'll comment everything out other than the bare minimum

I see, looks fine to me, I took the time to rearrange the variables there and put them under some comment headings, that might help this process.

repo: TransformerOptimus/SuperAGI


text:
🛑 MeVuelo Packages Availability (ASU - Mobile) is down

In 9f20848, MeVuelo Packages Availability (ASU - Mobile) (https://api.packages.production.travelonux.com/v1/mevuelo/frontend/packages/healthcheck?departure=ASU&api_key=ebfc5bcd-c798-4a53-a45a-5118f8a1e377&resolution=1) was down:

HTTP code: 0
Response time: 0 ms

Resolved: MeVuelo Packages Availability (ASU - Mobile) is back up in 603fbac after 20 minutes.

repo: Travelonux/upptime


text:
Pañol-->Salida Herramientas: quitar el cartel "Ningún dato disponible en esta tabla"

Ambiente test - v2.0.15.3
Descripción
Al agregar el registro de los datos cargados el sistema muestra el cartel de aviso de "ningún dato disponible.." cuando lo correspondiente es que desaparezca al mostrar Los Datos

Pasos para reproducir

En Pañol
Clic en Salida Herramientas
Completar los campos obligatorios
Clic en el botón "Agregar"

Solucionado - v2.0.16

repo: Trazalog/traz-comp-pan


text:
如何设置背景颜色为透明？

Description
如何设置背景颜色为透明？
Suggested solution
如何设置背景颜色为透明？
Alternative
No response
Additional context
No response
Validations

[X] I agree to follow this project's Code of Conduct
[X] Read the Contributing Guidelines.
[X] Read the docs.
[X] Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.

Ok its <TresCanvas clearColor: ' '>

repo: Tresjs/tres


text:
Features/challenge4/userprofile

PR Template
Purpose

...

Does this introduce a breaking change?

[ ] Yes
[ ] No

Pull Request Type
What kind of change does this Pull Request introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

Test the code

What to Check
Verify that the following are valid

...

Other Information

NG


text:
Multiple Charge Controllers

Sorry for raising an issue for this, but I have multiple Charge controllers.  You can assign them numbers.  I don't see anywhere in the code where it's referencing the unit number (It's 1 by default)
Is it possible to specify that in the protocol?

Not a problem!
The charge controller is referenced in the hex code string sent over UART by the ESP32. Look for this code block in your YAML file:
  time:     - platform: homeassistant       id: esptime       on_time:         - seconds: 0,30           then:             - uart.write:                 id: uart_bus                 data: [ 0x01, 0xB3, 0x01, 0x00, 0x00, 0x00, 0x00, 0xB5 ] # Reads only real-time data
I think the controller address is the first hex block so you would need to change that and recalculate the checksum. That part is pretty easy. The bigger part of the work is that you would need to duplicate the ampinvt.h file to create separate sensors for each charge controller. If you don't need or want all the sensors then you could cut a lot of it out and just keep the sensors you did want but essentially, you have two parts to this; 1) sending the command to each controller (easy and quick) and 2) processing the response from each controller (harder and more time).

Thanks, I'll go ahead an give it a shot.  I currently have 6 of these, and was hoping to not have to purchase 6 ESP32's.   Lot's of cabling and mess.
Two questions

I'm a Network Engineer who only dabbles in Computer Science.  How would I calculate the checksum?
If I were to duplicate only specific sensors, how would I differentiate between which charge controller it was coming from?  I do not see a reference to the controller address in the ampinvt.h file.

Thanks,
PS. I'm ok with being told it's too far over my head, in that case I'll just purchase more  ESP32's and do it that way.  ESP32 I have setup connect to one of my charge controllers has been rock solid this entire time during testing.

One ESP32 will do the job and even 1 ampinvt.h file but what you will need is to setup the ampinvt.h to read 6 x sensor sets and replicate all those custom sensors in your YAML file.
If you go the 6 x ESP32 setup, you will still need to recode the sensors because they all come together in HA and HA will not know how to process 6 instances of the same sensors. When you figure out the renaming for those, just work backwards to the ampinvt sensor naming.

authors: TripitakaBC spilegi


text:
Team groups going off edge of page.

Most likely known of but here: http://i.imgur.com/c4aJxd0.png

its a Known Bug <B

Would love This Fixed https://surl.im/i/8qvwj

authors: ItzDan TheSpaceArmy

repo: Tromino/PolyExtend


text:
编辑文档，图片上传成功了，uploads下对应的文件夹已经生成，但是图片没有移动到指定的路径下，日志也没有报错信息

请按照一下格式提交issue，谢谢！

你当前使用的是哪个版本的 BookStack?

你当前使用的是什么操作系统?

你是如何操作的？

你期望得到什么结果?

当前遇到的是什么结果?

我在本地使用local，没有用oss，也遇到同样的问题解决了。
是运行目录与uploads不在一个层级。
比如 这样执行就不行
[root@xxx~] /www/wwwroot/BookStack/BookStack
比如cd /www/wwwroot/BookStack 然后 ./BookStack 运行，否则无法找到 uploads文件夹。

我用的自己写的docker-compose和dockerfile，代码路径存放的路径不对，导致读取文件的时候读取不到，但是在读文件的时候没把异常信息抛出来，已修复

@cai-ti 我采用了https://github.com/willzhang/docker-bookstackcn的方法，也碰到了相同的问题，请问该怎么解决啊？
麻烦帮我看看啊，谢谢！！！
`FROM buildkite/puppeteer:10.0.0
ENV BOOKSTACK_VERSION=2.10
LANG=C.UTF-8
QTWEBENGINE_CHROMIUM_FLAGS="--no-sandbox"
WORKDIR /bookstack
RUN apt-get update -y
&& apt-get install -y tzdata git
&& ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
&& apt-get install -y ttf-wqy-zenhei fonts-wqy-microhei
&& apt-get install -y python3 unzip xz-utils
&& wget -qO /usr/local/bin/envsubst https://github.com/a8m/envsubst/releases/download/v1.2.0/envsubst-Linux-x86_64 \
&& chmod +x /usr/local/bin/envsubst
&& wget -nv -O- https://download.calibre-ebook.com/linux-installer.sh | sh /dev/stdin
&& wget https://github.com/TruthHun/BookStack/releases/download/v${BOOKSTACK_VERSION}/BookStack-V${BOOKSTACK_VERSION}_Linux_amd64.zip
&& unzip BookStack-V${BOOKSTACK_VERSION}_Linux_amd64.zip
&& chmod +x BookStack
&& rm -rf BookStack-V${BOOKSTACK_VERSION}_Linux_amd64.zip
&& rm -rf /var/lib/apt/lists/* /var/cache/apt/*
COPY conf/ /tmp/conf
COPY entrypoint.sh /
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
EXPOSE 8181
CMD ["/bookstack/BookStack"]`

authors: cai-ti kpeng2016 vogin

repo: TruthHun/BookStack


text:
[WIP] ✨ use markdown-it for markdown previews

refs https://github.com/TryGhost/Ghost/pull/8451

replaces SimpleMDE's default marked rendering with markdown-it
adds markdown-it plugins to more closely match legacy Showdown behaviour

footnotes
highlight/mark
named headers
don't require a space after the # for headers

adds ember-browserify so that markdown plugins that only provide CommonJS modules can be imported

Coverage decreased (-0.2%) to 71.556% when pulling f190198f49cb38b32133abd721f528564f89d1d1 on kevinansfield:markdown-it into fbb46dc72c4380a632e73db37c4ae8f2370b2087 on TryGhost:master.

Coverage decreased (-0.2%) to 71.556% when pulling 0f7dd8a26025fd7a05a389190746bebcc077cee1 on kevinansfield:markdown-it into 627a71e1a4ea95a9d0b61dd92b90c0d822c2f907 on TryGhost:master.

authors: coveralls kevinansfield

repo: TryGhost/Ghost-Admin


text:
[API] Ordering by meta_title is not possible

Issue Summary
It's not possible to make an API request (internally or externally) that sorts by meta_title. Moreover, sorting by a related table (e.g. posts_meta) is allowed, but the request fails. I think this is a regression from 2.x, after the post metadata got split out into a new table.
Technical details:

Ghost Version: 3.13.1
Forum Ref: https://forum.ghost.org/t/order-by-meta-title-doesnt-seem-to-work/13349
Possible related issue:

The model base parseOrderOptions pulls in a list of permitted attributes from the child modal, including allowed relations. This allows you to set the order to one of those relations, which kind-of breaks the API request. For example, ordering by authors asc will give you a 400, but title asc works perfectly fine, and potato asc succeeds because you can’t sort by potatoes, and therefore the order is ignored.

Might be related to this issue - https://github.com/TryGhost/Ghost/issues/11572, should be checked when investigated deeper.

After deeper digging into the issue, confirming that problem is how we create the order query here and the way Post model's permittedAttributes function returns only posts table specific fields ignoring posts_meta fields.
A closest candidate to explore a solution is tinkering bookshelf-relations plugin, which should be able to abstract the table split in a way that permittedAttributes gives back correct fields from posts_meta .

This issue needs appetite do dig into possible solution through bookshelf-relations. Guesstimating 1 day.

Note, while loading up on the context have observed another place which will need an update when the ordering is implemented - pagination plugin. Specifically, options.order should most likely come with resolved tableName because pagination plugin should not know about relations and not do the tableName + '.' + property concatenation.

Braindump after playing extensively with ordering
There are 2 separate problems that this issue raises:

Main one - cannot order post resource by a legitimate field, which comes from a 1:1 relation (posts:posts_meta tables).
Ordering behaves inconsistently for fields that are not meant to be ordered by: ignores unknown properties and returns 400 when trying to order by property like authors, which comes from a relation name. In case of any field that can't be ordered by, it should consistently ignore that field (throwing a validation error would break API compatibility, so this is a no-go)

The key to both problems is how parseOrderOption function relies on permittedAttributes to calculate all the fields that could be ordered upon.
(pt.1) Ordering by fields which come from 1:1 relation
The missing piece here is a mechanism in model layer which would recognize a 1:1 relation and extract "orderable" fields out of related table. Additionally, the fields  would have to come in a format that includes related table name so that pagination plugin could correctly form the query, e.g: ['posts_meta.meta_title ASC'] instead of ['meta_title ASC'].
The solution I'm thinking of here is adding a orderAttributes method which would be used instead of permittedAttributes in  parseOrderOption. orderAttributes would have the same values as permittedAttributes for tables with no additional relations logic, and would have special overrides on each model with "expanded" field names coming from related table.
To make above solution more maintainable would need to create a declarative way of describing which fields from related model the orderAttributes could be taken from. One of the possible directions to explore is expanding hasOne relation in bookshelf-relations - plan to timebox this direction to half a day tomorrow (cc @matthanley).
(pt. 2) Treating all non-orderable fields the same
The solution here somewhat relates to the solution from pt. 1. When parsing order options the function should not rely on permittedAttributes because those are not the same fields that could be "ordered" upon. Adding a orderAttributes method to the base model would possibly solve the problem.

Thoughts on holistically solving posts<>posts_meta ordering/filtering/change detection problems
I've dug through bookshelf-relations aiming to figure out an abstraction which would allow solving current ordering, related filtering, and change-detection(1) problems(2). I have not found a way that would solve all of them in a holistic way.
These are 3 distinct areas that have some or no relation to bookshelf-relations:

Ordering - has to do with findPage method from pagination plugin and depends on buggy/outdated handling in parseOrderOption function. Nothing to do with bookshelf-relations because the ordering fields should be calculated independently IMO not just for Post model but all other models that have relations.
Filtering - problems here stem from lack of explicit NQL configuration for posts_meta table in combination with mapping posts_meta filter fields to correct ones (using posts_meta. prefix). This kind of mapping should be done in serialization layer same way other field mappings are done there.
Change detection - to fix this problem on a deeper level (the fix that was done through override to wasChanged() was a "patch") we could look into fixing bookshelf-relations change tracking. This might come through some special parameter passed with hasOne relation that posts_meta is declared with or invent a whole new relation for this specific situation. New relation could also help with elimination of patchwork that has to be done in Post model. This needs to be researched.

Additional note, bookshelf-relations inherently deals with create/update/delete operations only and doesn't have anything to do with read operations that are needed in case of ordering and filtering.
Conclusion with regards to current issue
Two problems that were described in the comment above should be solved outside of bookshelf-relations. This proposed solution:

adding a orderAttributes method which would be used instead of permittedAttributes in parseOrderOption. orderAttributes would have the same values as permittedAttributes for tables with no additional relations logic, and would have special overrides on each model with "expanded" field names coming from related table.

seems like the most viable solution for now and would solve both problems.
@matthanley would love to know if you have any feedback on this? I estimate implementing the proposed solution would take about a day.

adding a orderAttributes method which would be used instead of permittedAttributes in parseOrderOption. orderAttributes would have the same values as permittedAttributes for tables with no additional relations logic, and would have special overrides on each model with "expanded" field names coming from related table

@naz this looks like a reasonable approach to me 👍

After implementing the ordering idea I had in mind, got faced with a Bookshelf limitation I completely forgot existed. Have my experimentation available on this spike branch - https://github.com/TryGhost/Ghost/compare/master...naz:ordering-for-posts-meta-fields.
To sum up the problem. In pagination plugin, when self.fetchAll is done it doesn't have post_meta table loaded into the query and it fails with "no such column" error (when trying to order by posts_meta.meta_title for example). The problem of not having loaded relations when fetching records in Bookshelf is summed up with references here - https://github.com/bookshelf/bookshelf/issues/1707#issuecomment-351026830.
There are two possible ways to get around this problem which I've been thinking of:

Extend pagination with detection of relations and build in a join to related table when the ordering query is built. We extend the query in similar way in filtering plugin through NQL (it adds joins and filters records at the same stage). The downside for this method, is possibly keeping yet another configuration that might be similar to one in filter. This could end up hard to maintain longterm.
Explore fixing/extending Bookshelf itself and load up relations like posts_meta into the queryBuilder automatically. This potentially, would be a more maintainable approach. The downside is, I have no clue how hard this would be to achieve, would need to dive into bookshelf codebase to understand more. The problem seems to have been around in Bookshelf since 2014.

@matthanley the point Hannah made earlier about approaching the problem through bookshelf-relations is now clearer to me. Probably the limitation I've rediscovered was the reason. This issue could become a scope creep, so I think approaching it by timeboxing and researching possible directions would be best approach forward. I'm thinking of timeboxing first approach above to half a day and see what comes out and then if we really end up with need for configs would research the second approach. Let me know what you think or have any questions about the issue itself!

Summary of the discussion around future plan for this issue
Short term plan (to be done now) would be implementing a solution which expands query builder object inside of pagination (or ordering) plugin based on additional configurations similar to ones done with NQL/filtering.
Long term, aiming to develop a maintainable solution which is not based on configuration but rather on special relation type coming from Bookshelf or some other fix which might also address https://github.com/bookshelf/bookshelf/issues/202. Will timebox 1 day for research to figure out right questions and maybe possible solutions. A solution that is in mind right now is expansion of  hasOne relation with an "alwaysFetched" parameter - this might be done through a plugin or from within bookshelf itself (needs digging around).

Extend pagination with detection of relations and build in a join to related table when the ordering query is built. We extend the query in similar way in filtering plugin through NQL (it adds joins and filters records at the same stage). The downside for this method, is possibly keeping yet another configuration that might be similar to one in filter. This could end up hard to maintain longterm.

This solution has landed in master through https://github.com/TryGhost/Ghost/pull/12226.
Next up will be pushing pt. 2 and figuring out more generic way to handle relation inclusion in query builder object through Bookshelf/special plugin. This should help solve filtering/ordering and attribute change tracking all together.

authors: gargol matthanley naz vikaspotluri123

repo: TryGhost/Ghost


text:
Impersonation tokens do signup action if no account is found

Issue Summary
When a user is deleted it is expected that all tokens associated with that account are revoked. This is currently not the case.
Creating a token before deleting a user creates the account again when pasted into the browser.
Steps to Reproduce

Create an access token for an account.
Delete that account.
Paste that token into your browser.
User is created again.

The user should NOT be created again and all tokens should be revoked when a user is deleted.
Ghost Version
4.44.0
Node.js Version
16.14.2
How did you install Ghost?
OS - Debian 11 with MariaDB 10.5.15
Database type
MySQL 8
Browser & OS version
No response
Relevant log / error output
No response
Code of Conduct

[X] I agree to be friendly and polite to people in this repository

Hey there @guidefox. Ghost's magic links are based on JWTs, the tokens aren't stored and there's not really a concept of revocation here. What's happening is that the magic link has a fall back behaviour of creating a new account if no matching account is found.
I realise that's a little jarring, but it's a brand new account that is created, not an old one being restored.
I think it would make sense to pin the impersonation links to only be allowed to do signin, rather than falling back to signup, to make this a little less weird.

Ah, that makes more sense. I think that the current behavior can be improved because it is a little bit jarring right now.
Perhaps a dedicated button for having impersonation tokens re-create the account instead of doing it automatically would be a better solution.
And maybe make the tokens one use only? or at least provide the option to have it expire after one use.

This has cropped up in other forms recently, and is something we want to prioritise fixing.

authors: ErisDS guidefox


text:
Make this site private - not working in Chrome and Opera

Issue Summary
Change or delete the row 58:
versions/5.54.4/core/frontend/apps/private-blogging/lib/middleware.js
return session({
           name: 'ghost-private',
           maxAge: constants.ONE_MONTH_MS,
           signed: false,
           sameSite: 'lax'     <----- row 58: instead of 'none' or delete row
       })(req, res, next);

Or you can delete the row 58 because sameSite: 'Lax' is the default value.
You can't code 'secure' within an object - secure: true will not work.
Works now in Chrome and Opera.
See https://web.dev/i18n/en/samesite-cookies-explained

Steps to Reproduce
See https://forum.ghost.org/t/make-this-site-private-not-working/39938/1
Ghost Version
5.54.4
Node.js Version
v18.15.0
How did you install Ghost?
local, macos
Database type
SQLite3
Browser & OS version
No response
Relevant log / error output
No response
Code of Conduct

[X] I agree to be friendly and polite to people in this repository

In core/frontend/apps/private-blogging/lib/middleware.js:
´´´
const privateBlogging = {
    …
    return session({
        name: 'ghost-private',
        maxAge: constants.ONE_MONTH_MS,
        signed: false,
  //      sameSite: 'none'    <——— replace this with 2 lines below
          sameSite: urlUtils.isSSL(config.get('url')) ? 'none' : 'lax',
          secure: urlUtils.isSSL(config.get('url'))
    })(req, res, next);
},

´´´
and all is fine!
Implement in the same way as you did in
core/server/services/auth/session/express-session.js

Hey there, thank you so much for the detailed bug report.
That does look like something that shouldn't happen! A PR to fix this issue would be very welcome 🙂

I have made the PR

Hi, I am facing the same issue in the latest version of Ghost, unable to login to the private site using Chrome based browsers.

It's nearly three month later ... an nothing happened. But for me it closed, because I'm working locally  :-)
https://forum.ghost.org/t/make-this-site-private-not-working/39938

It's nearly three month later ... an nothing happened. But for me it closed, because I'm working locally :-) https://forum.ghost.org/t/make-this-site-private-not-working/39938

yeah, they didn't care to merge it. but I appreciate you for your troubleshooting and the fix.
I think just a rerun would be required to pass the build, otherwise the PR is already approved:
https://github.com/TryGhost/Ghost/actions/runs/6057836235/job/16821076886?pr=17938

I have made my first PR.
I think the 2. one failed: Merge branch 'main' into joe-blocher-patch-1 https://github.com/TryGhost/Ghost/pull/17938/commits/ae0f64eb578f4aa43248da1b3e807a1f0c3b9bef
I don't really know what is for and how I can delete this PR...

Am 16.10.2023 um 08:45 schrieb Hussain @.***>:
It's nearly three month later ... an nothing happened. But for me it closed, because I'm working locally :-) https://forum.ghost.org/t/make-this-site-private-not-working/39938 https://forum.ghost.org/t/make-this-site-private-not-working/39938
yeah, they didn't care to merge it. but I appreciate you for your troubleshooting and the fix.
I think just a rerun would be required to pass the build, otherwise the PR is already approved:
https://github.com/TryGhost/Ghost/actions/runs/6057836235/job/16821076886?pr=17938 https://github.com/TryGhost/Ghost/actions/runs/6057836235/job/16821076886?pr=17938
https://user-images.githubusercontent.com/4962633/275414297-2abc6c33-ed0c-442d-9e81-9cdbd0e405cd.png
—
Reply to this email directly, view it on GitHub https://github.com/TryGhost/Ghost/issues/17514#issuecomment-1763832578, or unsubscribe https://github.com/notifications/unsubscribe-auth/AWHNLAX5ONSU2FFFUG6MRN3X7TJZDANCNFSM6AAAAAA2ZM7QIU.
You are receiving this because you modified the open/close state.

Maybe @daniellockyer can help

You did't fix the error: Make this site private - not working not working in Chrome and Opera

SOLUTION - it told you in August 2023 and I have made the PR!
versions/5.82.2/core/frontend/apps/private-blogging/lib/middleware.js
`const privateBlogging = {
....
    return session({
        name: 'ghost-private',
        maxAge: constants.ONE_MONTH_MS,
        signed: false,

        sameSite:   urlUtils.isSSL(config.get('url')) ? 'none' : 'lax',  <------------ insert this
        secure: urlUtils.isSSL(config.get('url'))  <------------------------------ insert this
        //sameSite: 'none' <------------------------------------------  row 58: remove
    })(req, res, next);
},`

The pull request still not merged in version 5.82.2:
Fixed private mode cookie for local development #17938

What makes you say the PR wasn't merged? The commit shows that it's been in releases starting from 5.70.0.

I've downloaded the code:
versions/5.82.2/core/frontend/apps/private-blogging/lib/middleware.js
But the code is still the same:
` return session({
name: 'ghost-private',
maxAge: constants.ONE_MONTH_MS,
signed: false,
sameSite: 'none' <------------------------------------------  why this?
})(req, res, next);
},``

The code being the same does not mean your PR was not merged. In this case it looks like this change ended up possibly breaking something else so it was reverted:
https://github.com/TryGhost/Ghost/pull/19298

The code being the same does not mean your PR was not merged. In this case it looks like this change ended up possibly breaking something else so it was reverted:
#19298

OK so that means it is still a problem. I am running 5.79.6 (released Feb 26) and cannot make the site private because of this bug. What's the ETA on solving this?

The code being the same does not mean your PR was not merged. In this case it looks like this change ended up possibly breaking something else so it was reverted:
#19298

OK so that means it is still a problem. I am running 5.79.6 (released Feb 26) and cannot make the site private because of this bug. What's the ETA on solving this?

My solution:
I change always the code by myself, when I install an update. You have to change only 2 lines.
The first time I reported the solution in August 2023.
Maybe they will fix the bug sometimes ...

Hey guys, any update on this one? I couldn't access the links behind why the commit was reverted. So not sure on the details or complexity of the bug, is there any progress towards figuring it out? Thanks, and I'm a huge Ghost fan 😊

Downloaded version 5.89.1 - this bug still not fixed
You have to change only 2 lines in your code.
The first time I reported the solution in August 2023.
Why this is impossible?

@daniellockyer  this is disappointing that this is still an issue exp with docker involved.

I can confirm that I have no access via chromium, chrome and edge. Works with firefox. Will tell that to my customers not.

Hey, I'm sorry that it wasn't made clear when the related PR was reverted. Unfortunately the fix broke the theme preview in Ghost admin for private sites, when the admin and site URLs are configured differently (the recommended configuration).
We are clearly missing some test coverage there, as the PR looked good to merge.
In the meantime, whilst trying to understand this issue I wasn't able to reproduce it in Arc, Chrome or Chromium.
There's something really janky going on here, because whilst there are clearly a couple of people here on this issue experiencing the problem, there's not a lot of wider noise despite private sites being used widely very successfully.
Meanwhile, when we merged the PR and broke the theme preview for private sites, we heard about it instantly from many people.
So there has to be a caveat that's not being covered here in the reproduction steps. I have a feeling that is something to do with SSL, which shouldn't be impacting production sites.
I'm going to close this bug as it stands. If anyone has the detailed reproduction case, feel free to open a new issue and we can work through what cases should and shouldn't work & making sure that fixing this issue doesn't cause a more widespread issue for private site users.

I wasn't able to reproduce it in Arc, Chrome or Chromium.

You're right!
I've updated Chrome and the bug disappeared.
It was a bug in Chrome with the error-message:

OK, many thanks

authors: ErisDS Grasume TheLaurenBarger daniellockyer davedub hussainb joe-blocher kilmarnock vikaspotluri123


text:
Ajax call from external website - Response 200 but no posts

Issue Summary
I’d like to fetch blog posts into my website client-side.
When I fetch posts, I get this response, and no response body:
ok: true
redirected: false
status: 200
statusText: "OK"
type: "cors"
url: "http://my_website/ghost/api/v0.1/posts/?limit=3&client_id=ghost-frontend&client_secret=MY_SECRET

To Reproduce

Follow this guide: https://api.ghost.org/docs/ajax-calls-from-an-external-website
Try to fetch posts from an external website.

Expected behaviour is to get a list of posts. When I curl it works fine.
Technical details:

Ghost Version:  1.25.1
Node Version: 6.14.3
Browser/OS: Chrome 67.0.3396.99 on the client, backend running on Ubuntu 16.04.5 (aws ec2 t2.micro)
Database: mysql

Thanks for looking into it :)

Hey @c0derabbit 👋 We ask that you please do not use GitHub for help or support, the default issue template pointed you to our forum for this type of question 😄 We use GitHub solely for bug-tracking and on-going feature development so we try to keep it noise free.
Many questions can be answered by reviewing our docs for self-hosters, our theme API, or our public API. If you can't find an answer then our forum is a great place to get community support, plus it helps create a central location for searching problems/solutions.
FYI: Many projects have their own support guidelines and GitHub will highlight them for you, or the project owners will use issue templates to point you in the right direction, please read them before opening issues

Hi @kevinansfield, I started there but no response, also it seems to me more like a bug than a question, as I did follow the instructions, and I suspect it's either not working as it should, or there's a missing step in the docs.