Repository navigation
chore: sync website v3.5.13 for Data Commons Platform 1.1.6 - #1
Merged
Merged
Conversation
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
## Issue [b/515782168](b/515782168) ## Related PR [Mixer: 1915](datacommonsorg/mixer#1915) ## Description Until the above PR, Mixer was unable to support the ability filter by terminal nodes in `v2/node` queries, and was thus unable to fetch translations for particular places by language. We could only over-fetch and request all translations for the places sent into the query, and then do the filtering in Flask. While this was inefficient, it did work when Mixer was backed by BT. However, when using Spanner, the overfetching frequently caused page overruns, and as a consequence, the response was truncated to the first page. This resulted in many pages and charts being only partially translated. With the linked PR in Mixer, we are now able to filter terminal nodes by the language query operator `$lang`. In website, we are now able to request translations for specific languages, resulting in much smaller responses from Mixer that rarely paginate (and when they do, paginate to a much lesser degree, resulting in less latency cost). ## Testing The following two pages demonstrate the issue: * `http://localhost:8080/place?hl=ru` (Russian locale place page). * `http://localhost:8080/place/country/JPN?q=Japan&hl=ja` (Japanese locale place page). When using a Spanner-enabled backend: * In master, these two pages will result in partial translations. On this branch, both will be fully translated. When using BT: * The translations will be complete on both master and this version.
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
This PR deletes the now-unused `run_experimental.sh` script from this codebase. As far as I can tell, it touches no other files or folders, (there is no longer an experimental folder), so no other files or folders are affected.
Removes the `draw*` functions from the datacommons JS library. The `draw*` functions are no longer used in the datacommons JS library (which instead uses the tiles as `Datacommons<type>Component`). This PR removes the following functions and their references: * drawRanking * drawBar * drawLine * drawMap
) ## Issue [b/515840750](b/515840750) ## Description The facet selection web driver test relied on the order of the facets as displayed in the facet selector (and therefore as given by Mixer) in order to choose what facet was selected. The order of the facets coming out of Spanner is different than BT, causing the selected index to no longer be the expected facet and thus causing the test to fail. This PR updates the test to choose the selected facet by looking at the description of the facet in the selector. Additionally, it makes other tweaks to how the test searches for and waits for content in order to tighten the test (this test was mostly reliable, but did occasionally fail on heavy flake-finding; it now always passes). ## Test ``` export WEBSITE_MIXER_API_ROOT=http://127.0.0.1:8081 ./run_test.sh -w --live --no_extract -k "test_bar_select_different_facet" --reruns 0 ```
Removes IITM related configurations. As far as we can tell, files related to the IITM custom DC are longer used. The IITM custom DC instance at https://datacommons.iitm.ac.in is down as well. This PR cleans up our codebase by removing these now-unused templates and configuration files. This also clears out some lingering references to our ranking pages, which are now being deprecated.
…e. (datacommonsorg#6355) ## Issue [b/522384579](b/522384579) ## Description The `use_v2_api` flag has been set to true for some time in all environments except for custom DC. With the upcoming turndowns, all environments, including custom DCs, will need to use `v2`. This PR drops the flag usage in the code itself, removing all code associated with the `v1` endpoints, and leaving all environments using `v2`. ## Notes This PR does not yet remove the flags themselves. This will be done in a subsequent PR. ## Testing For all environments where the flag had previously been set to true, this should be a noop. Areas that are potentially affected are be included are: * The stat var explorer * The visualization tools (with the embedded stat var hierarchy) * The NL search (i.e. a search for "Jobs in Texas")
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
…lfill variables (datacommonsorg#6344) This PR will be merged to switch staging and autopush to default use v2/resolve when resolving variables in detect-and-fulfill
…6358) ## Issue [b/522452016](b/522452016) ## Related PR [6328](datacommonsorg#6328) ## Description PR 6328 unified child place and type resolution into a new function that used containedInPlace+. However, some place-to-child relationships were not in the BT cache (causing this to give empty results for those parent/child combinations. This PR resolves this by switching that new function to direct containment (which aligns with functionality from before that earlier PR while keeping the efficiency optimization of that PR.
Temporarily disables ranking pages by returning HTTP 503 in the default case. In order to proceed with the migration off of v1 mixer APIs, we are temporarily turning down the ranking pages with an HTTP 503 response while we get v2 API and Spanner ready versions of the page ready. For more context, see [this doc](https://docs.google.com/document/d/1rn9Lw5Z8dp64Qv38RYxhXAVem3mYcQ6EOvBfSfaRSfI/edit?tab=t.0#heading=h.gyh1kbjcale2) (Google corp access required.) Now, when navigating to /ranking/*, we first check whether the `new_ranking_page` feature flag is enabled. -> If `new_ranking_page` is enabled, show the new v2/observation-backed tile-based ranking page. -> If `new_ranking_page` is NOT enabled, return a 503. The new 503 page looks like this: <img width="2560" alt="image" src="https://github.com/user-attachments/assets/88e9a69e-b70c-44ed-a894-7634fb7dbde3" /> Changes made: * Adds a return HTTP 503 to the /ranking/* route * Skips the ranking page webdriver tests * Removes links to the ranking pages from the place landing pages * Updates the place landing page webdriver tests to skip the check for ranking page links. Testing strategy: * Spin up a local server * Make sure `new_ranking_page` feature flag is set to `false` in `local.json` * Navigate to a ranking page like http://localhost:8083/ranking/Count_Person/County and see that a HTTP 503 is returned. * Navigate to http://localhost:8083/place and see that the page still renders but the ranking pages have been removed.
Set the `new_ranking_page` flag to `false` in all environments except dev. Because of the changes made in datacommonsorg#6353, we want the default behavior of the ranking pages to be a HTTP 503 unless we explicitly enable the new ranking pages for testing. We're leaving the flag to `true` in the dev environment to enable testing down the road. The custom and production environments already had this flag set to false.
…acommonsorg#6362) Bumps [@grpc/grpc-js](https://github.com/grpc/grpc-node) from 1.9.15 to 1.9.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-node/releases">@grpc/grpc-js's releases</a>.</em></p> <blockquote> <h2><code>@grpc/grpc-js</code> 1.9.16</h2> <ul> <li>Fix a bug that could cause servers to crash when handling malformed requests (<a href="https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2">advisory GHSA-5375-pq7m-f5r2</a>)</li> <li>Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (<a href="https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq">advisory GHSA-99f4-grh7-6pcq</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-node/commit/0acbec32a4fd6ca25b9135dfec3c03c8cafbbe25"><code>0acbec3</code></a> Merge pull request <a href="https://redirect.github.com/grpc/grpc-node/issues/3057">#3057</a> from murgatroid99/grpc-js_1.9.16</li> <li><a href="https://github.com/grpc/grpc-node/commit/dc863ba563e44414941bc0be2fc507378e80fd17"><code>dc863ba</code></a> Merge commit from fork</li> <li><a href="https://github.com/grpc/grpc-node/commit/51740913aaab4353579b151fbc66d2f0e2f10773"><code>5174091</code></a> Merge commit from fork</li> <li><a href="https://github.com/grpc/grpc-node/commit/343ef831c03306c1fd98a3f207d1d7f5d0e9b1c3"><code>343ef83</code></a> grpc-js: Bump version to 1.9.16</li> <li><a href="https://github.com/grpc/grpc-node/commit/f7d3eeca39f47823d391840d823af5a3282122c0"><code>f7d3eec</code></a> Make compression error a static string</li> <li><a href="https://github.com/grpc/grpc-node/commit/b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9"><code>b6dcfc3</code></a> Fix crashes when receiving malformed compressed data</li> <li><a href="https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7"><code>1cf4bfa</code></a> Fix server crash when handling invalid requests</li> <li><a href="https://github.com/grpc/grpc-node/commit/1aec8d899257a7bef0794584f728d3aa512550cd"><code>1aec8d8</code></a> Merge pull request <a href="https://redirect.github.com/grpc/grpc-node/issues/2992">#2992</a> from murgatroid99/grpc-js_fix_buffer_type_1.9.x</li> <li><a href="https://github.com/grpc/grpc-node/commit/b9797cf489b28b2ab68bc4b3d3143178d8de7a1a"><code>b9797cf</code></a> grpc-js: Declare buffer type to avoid build error</li> <li><a href="https://github.com/grpc/grpc-node/commit/ff204f7429cb9faeec47e2ec0e3e9e7512ed7f4d"><code>ff204f7</code></a> Merge pull request <a href="https://redirect.github.com/grpc/grpc-node/issues/2887">#2887</a> from murgatroid99/grpc-js-xds_preserve_type_state_1.9.x</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.9.15...@grpc/grpc-js@1.9.16">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/datacommonsorg/website/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… fix) in /static (datacommonsorg#6308) Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) from 6.0.2 to 7.0.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/yahoo/serialize-javascript/releases">serialize-javascript's releases</a>.</em></p> <blockquote> <h2>v7.0.5</h2> <h3>Fixes</h3> <ul> <li>Improve robustness and validation for array-like object serialization.</li> <li>Fix an issue where certain object structures could lead to excessive CPU usage.</li> </ul> <p>For more details, please see GHSA-qj8w-gfj5-8c6v.</p> <h2>v7.0.4</h2> <h2>What's Changed</h2> <ul> <li>release: v7.0.4 by <a href="https://github.com/okuryu"><code>@okuryu</code></a> in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/211">yahoo/serialize-javascript#211</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/yahoo/serialize-javascript/compare/v7.0.3...v7.0.4">https://github.com/yahoo/serialize-javascript/compare/v7.0.3...v7.0.4</a></p> <h2>v7.0.3</h2> <ul> <li>fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (<a href="https://redirect.github.com/yahoo/serialize-javascript/issues/207">#207</a>) 2e609d0</li> <li>build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (<a href="https://redirect.github.com/yahoo/serialize-javascript/issues/206">#206</a>) 42b7cdb</li> </ul> <hr /> <p><a href="https://github.com/yahoo/serialize-javascript/compare/v7.0.2...v7.0.3">https://github.com/yahoo/serialize-javascript/compare/v7.0.2...v7.0.3</a></p> <h2>v7.0.2</h2> <h2>What's Changed</h2> <ul> <li>ci: bump GitHub Actions to latest versions by <a href="https://github.com/okuryu"><code>@okuryu</code></a> in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/203">yahoo/serialize-javascript#203</a></li> <li>ci: setup trusted publishing workflow by <a href="https://github.com/okuryu"><code>@okuryu</code></a> in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/204">yahoo/serialize-javascript#204</a></li> <li>release: v7.0.2 by <a href="https://github.com/okuryu"><code>@okuryu</code></a> in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/205">yahoo/serialize-javascript#205</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/yahoo/serialize-javascript/compare/v7.0.1...v7.0.2">https://github.com/yahoo/serialize-javascript/compare/v7.0.1...v7.0.2</a></p> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>Add warning about using this package to send arbitrary data to worker threads by <a href="https://github.com/valadaptive"><code>@valadaptive</code></a> in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/200">yahoo/serialize-javascript#200</a></li> <li>security: sanitize function bodies by <a href="https://github.com/redonkulus"><code>@redonkulus</code></a> in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/199">yahoo/serialize-javascript#199</a></li> <li>docs: tweak README by <a href="https://github.com/okuryu"><code>@okuryu</code></a> in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/201">yahoo/serialize-javascript#201</a></li> <li>release: v7.0.1 by <a href="https://github.com/okuryu"><code>@okuryu</code></a> in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/202">yahoo/serialize-javascript#202</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/redonkulus"><code>@redonkulus</code></a> made their first contribution in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/199">yahoo/serialize-javascript#199</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/yahoo/serialize-javascript/compare/v7.0.0...v7.0.1">https://github.com/yahoo/serialize-javascript/compare/v7.0.0...v7.0.1</a></p> <h2>v7.0.0</h2> <h2>Breaking Changes</h2> <ul> <li>requires Node.js v20+</li> </ul> <h2>What's Changed</h2> <ul> <li>Bump mocha from 10.2.0 to 10.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/yahoo/serialize-javascript/pull/178">yahoo/serialize-javascript#178</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/yahoo/serialize-javascript/commit/df3f1c1fa9ca16b050ae893cb63ac23c91deed55"><code>df3f1c1</code></a> release: v7.0.5</li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b"><code>f147e90</code></a> Merge commit from fork</li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/eec32e08c5ac51bba2d8042101f6d2622c133110"><code>eec32e0</code></a> release: v7.0.4</li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/d50571505a7776191346d714618867455b3354c1"><code>d505715</code></a> 7.0.3</li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9"><code>2e609d0</code></a> fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (<a href="https://redirect.github.com/yahoo/serialize-javascript/issues/207">#207</a>)</li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/42b7cdbf32c289f42d7d9247fd3261dc7550e9ce"><code>42b7cdb</code></a> build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (<a href="https://redirect.github.com/yahoo/serialize-javascript/issues/206">#206</a>)</li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/44f544b85a8e2719890a0853184d83c4ecbc9bcb"><code>44f544b</code></a> release: v7.0.2 (<a href="https://redirect.github.com/yahoo/serialize-javascript/issues/205">#205</a>)</li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/bba0ddd954b5bcca48857f9cb5f16379aa143b26"><code>bba0ddd</code></a> ci: setup trusted publishing workflow (<a href="https://redirect.github.com/yahoo/serialize-javascript/issues/204">#204</a>)</li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/235f6ea0b827bdc1625046522b0bc50fd582c412"><code>235f6ea</code></a> ci: bump GitHub Actions to latest versions (<a href="https://redirect.github.com/yahoo/serialize-javascript/issues/203">#203</a>)</li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/f7fff15630a450dfcbcb88d33f7dc30b4f1e41f8"><code>f7fff15</code></a> release: v7.0.1 (<a href="https://redirect.github.com/yahoo/serialize-javascript/issues/202">#202</a>)</li> <li>Additional commits viewable in <a href="https://github.com/yahoo/serialize-javascript/compare/v6.0.2...v7.0.5">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for serialize-javascript since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/datacommonsorg/website/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…nsorg#6357) Bumps [torch](https://github.com/pytorch/pytorch) from 2.8.0 to 2.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytorch/pytorch/releases">torch's releases</a>.</em></p> <blockquote> <h1>PyTorch 2.12.0 Release Notes</h1> <ul> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#highlights">Highlights</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes">Backwards Incompatible Changes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#deprecations">Deprecations</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#new-features">New Features</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#improvements">Improvements</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes">Bug fixes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#performance">Performance</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#documentation">Documentation</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#developers">Developers</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#security">Security</a></li> </ul> <h1>Highlights</h1> <!-- raw HTML omitted --> <p>For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.</p> <h1>Backwards Incompatible Changes</h1> <h2>Build Frontend</h2> <ul> <li> <p>Strengthened SVE compile checks in <code>FindARM.cmake</code>, which may reject previously accepted but incorrect SVE configurations (<a href="https://redirect.github.com/pytorch/pytorch/pull/176646">#176646</a>)</p> <p>Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.</p> </li> <li> <p>Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (<a href="https://redirect.github.com/pytorch/pytorch/pull/178925">#178925</a>)</p> <p>Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure <code>CUDA_HOME</code> points to that installation.</p> <p>Version 2.11:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.4 python setup.py develop </code></pre> <p>Version 2.12:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.6 python setup.py develop </code></pre> </li> <li> <p>Enforced a C++20 minimum in CMake build files (<a href="https://redirect.github.com/pytorch/pytorch/pull/178662">#178662</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytorch/pytorch/commit/0d62256a2b23365f8e1604297eb23a6545102aa8"><code>0d62256</code></a> [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (<a href="https://redirect.github.com/pytorch/pytorch/issues/183346">#183346</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/7661cd9c6b841b62b7f411aa52ec51f05457263b"><code>7661cd9</code></a> [MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (<a href="https://redirect.github.com/pytorch/pytorch/issues/181886">#181886</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/9da6087ab64ab6a2118686420ca5353c90dd7e1f"><code>9da6087</code></a> Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes <a href="https://redirect.github.com/pytorch/pytorch/issues/182250">#182250</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182369">#182369</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/e4c37cc011d47246ce8ea4b99c9b28fb7f400224"><code>e4c37cc</code></a> Avoid raw stream name collisions in Inductor (<a href="https://redirect.github.com/pytorch/pytorch/issues/182178">#182178</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/822d047dc8dd8d919f83c3ad5c786e405075d1f0"><code>822d047</code></a> [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (<a href="https://redirect.github.com/pytorch/pytorch/issues/182285">#182285</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182311">#182311</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/5c5e523cd520e6986006e45be243b3ee927ea546"><code>5c5e523</code></a> Add enable_gqa parameter to SDPA MPS meta registration (<a href="https://redirect.github.com/pytorch/pytorch/issues/181550">#181550</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/eece52ead16886e5463c3dcee9b04db783cc68d5"><code>eece52e</code></a> [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...</li> <li><a href="https://github.com/pytorch/pytorch/commit/b39330bbe210b9628207e84d8ba2cabb7975fbac"><code>b39330b</code></a> [Inductor] Call latest c_shim version for versioned fallback ops (<a href="https://redirect.github.com/pytorch/pytorch/issues/181548">#181548</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/06f10d088229a25ac52bd14b6cacc04a4161f6ca"><code>06f10d0</code></a> Revert "[FSDP2] add fqn to communication ops" (<a href="https://redirect.github.com/pytorch/pytorch/issues/182100">#182100</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182157">#182157</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/449e3393139a1aca9afec120c9a63f98f12d55b0"><code>449e339</code></a> Revert "[Inductor] Improve materialization heuristic for a chain of computaio...</li> <li>Additional commits viewable in <a href="https://github.com/pytorch/pytorch/compare/v2.8.0...v2.12.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/datacommonsorg/website/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [torch](https://github.com/pytorch/pytorch) from 2.8.0 to 2.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytorch/pytorch/releases">torch's releases</a>.</em></p> <blockquote> <h1>PyTorch 2.12.0 Release Notes</h1> <ul> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#highlights">Highlights</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes">Backwards Incompatible Changes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#deprecations">Deprecations</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#new-features">New Features</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#improvements">Improvements</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes">Bug fixes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#performance">Performance</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#documentation">Documentation</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#developers">Developers</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#security">Security</a></li> </ul> <h1>Highlights</h1> <!-- raw HTML omitted --> <p>For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.</p> <h1>Backwards Incompatible Changes</h1> <h2>Build Frontend</h2> <ul> <li> <p>Strengthened SVE compile checks in <code>FindARM.cmake</code>, which may reject previously accepted but incorrect SVE configurations (<a href="https://redirect.github.com/pytorch/pytorch/pull/176646">#176646</a>)</p> <p>Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.</p> </li> <li> <p>Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (<a href="https://redirect.github.com/pytorch/pytorch/pull/178925">#178925</a>)</p> <p>Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure <code>CUDA_HOME</code> points to that installation.</p> <p>Version 2.11:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.4 python setup.py develop </code></pre> <p>Version 2.12:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.6 python setup.py develop </code></pre> </li> <li> <p>Enforced a C++20 minimum in CMake build files (<a href="https://redirect.github.com/pytorch/pytorch/pull/178662">#178662</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytorch/pytorch/commit/0d62256a2b23365f8e1604297eb23a6545102aa8"><code>0d62256</code></a> [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (<a href="https://redirect.github.com/pytorch/pytorch/issues/183346">#183346</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/7661cd9c6b841b62b7f411aa52ec51f05457263b"><code>7661cd9</code></a> [MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (<a href="https://redirect.github.com/pytorch/pytorch/issues/181886">#181886</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/9da6087ab64ab6a2118686420ca5353c90dd7e1f"><code>9da6087</code></a> Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes <a href="https://redirect.github.com/pytorch/pytorch/issues/182250">#182250</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182369">#182369</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/e4c37cc011d47246ce8ea4b99c9b28fb7f400224"><code>e4c37cc</code></a> Avoid raw stream name collisions in Inductor (<a href="https://redirect.github.com/pytorch/pytorch/issues/182178">#182178</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/822d047dc8dd8d919f83c3ad5c786e405075d1f0"><code>822d047</code></a> [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (<a href="https://redirect.github.com/pytorch/pytorch/issues/182285">#182285</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182311">#182311</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/5c5e523cd520e6986006e45be243b3ee927ea546"><code>5c5e523</code></a> Add enable_gqa parameter to SDPA MPS meta registration (<a href="https://redirect.github.com/pytorch/pytorch/issues/181550">#181550</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/eece52ead16886e5463c3dcee9b04db783cc68d5"><code>eece52e</code></a> [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...</li> <li><a href="https://github.com/pytorch/pytorch/commit/b39330bbe210b9628207e84d8ba2cabb7975fbac"><code>b39330b</code></a> [Inductor] Call latest c_shim version for versioned fallback ops (<a href="https://redirect.github.com/pytorch/pytorch/issues/181548">#181548</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/06f10d088229a25ac52bd14b6cacc04a4161f6ca"><code>06f10d0</code></a> Revert "[FSDP2] add fqn to communication ops" (<a href="https://redirect.github.com/pytorch/pytorch/issues/182100">#182100</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182157">#182157</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/449e3393139a1aca9afec120c9a63f98f12d55b0"><code>449e339</code></a> Revert "[Inductor] Improve materialization heuristic for a chain of computaio...</li> <li>Additional commits viewable in <a href="https://github.com/pytorch/pytorch/compare/v2.8.0...v2.12.0">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | torch | [< 2, > 1.12.1] | </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/datacommonsorg/website/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
…org#6370) ## Description It is sometimes helpful when debugging webdriver tests to be able to run them in "headful" mode (i.e., to see the tests running in an instance of the browser). There were instructions in the `webdriver.md` file for running the webdriver tests this way involving editing the `base_utils.py` file temporarily. This PR gives an alternative to make this process easier by adding a `--non-headless` flag to the tests.
…ia audit fix) in /static" (datacommonsorg#6372) Reverts datacommonsorg#6308
## Issue [b/519184012](b/519184012) ## Related PR [Mixer: 1937](datacommonsorg/mixer#1937) ## Description The related Mixer PR updates facet definitions so that the provenance id is included. While the provenance id has typically been the import name prefixed with `dc/base/`, this will soon no longer always be the case. This PR updates the metadata endpoints to use the provenance id directly, only falling back to the prefixed import name if the provenance id is not available. ## Notes For this PR to have effect, you must be using a version of mixer that contains the updates in the linked PR. 🚨 This PR should not be merged in until the corresponding Mixer PR is merged in.
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
…org#6378) Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.12.1 to 2.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.13.0</h2> <h1>PyJWT 2.13.0 — Security Release</h1> <p>This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.</p> <h2>Security</h2> <ul> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"><code>GHSA-xgmm-8j9v-c9wx</code></a> — JWK JSON accepted as HMAC secret (algorithm confusion).</strong> <code>HMACAlgorithm.prepare_key</code> previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in <code>algorithms=[…]</code> and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. <em>Reported by <a href="https://github.com/aradona91"><code>@aradona91</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"><code>GHSA-jq35-7prp-9v3f</code></a> — Algorithm allow-list bypass with <code>PyJWK</code> / <code>PyJWKClient</code>.</strong> When verifying with a <code>PyJWK</code>, the caller's <code>algorithms=[…]</code> allow-list was checked against the token header <code>alg</code> as a string only; actual verification used the algorithm bound to the <code>PyJWK</code>. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header <code>alg</code> to match the <code>PyJWK</code>'s algorithm before verification. <em>Reported by <a href="https://github.com/sushi-gif"><code>@sushi-gif</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"><code>GHSA-w7vc-732c-9m39</code></a> — DoS via base64 decode of unused payload segment when <code>b64=false</code>.</strong> For detached-payload JWS (<code>b64=false</code>), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied <code>detached_payload</code>. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. <em>Reported by <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"><code>GHSA-993g-76c3-p5m4</code></a> — <code>PyJWKClient</code> accepts non-HTTP(S) URIs.</strong> <code>PyJWKClient.fetch_data</code> passed its URI to <code>urllib.request.urlopen</code>, which by default also handles <code>file://</code>, <code>ftp://</code>, and <code>data:</code> schemes. An application that fed an attacker-influenced URI into <code>PyJWKClient</code> could be coerced into reading local files or reaching other unintended schemes. <code>PyJWKClient</code> now rejects any URI whose scheme isn't <code>http</code> or <code>https</code>. <em>Reported by <a href="https://github.com/KEIJOT"><code>@KEIJOT</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"><code>GHSA-fhv5-28vv-h8m8</code></a> — <code>PyJWKClient</code> cache wiped on fetch error.</strong> A <code>finally</code>-block <code>put(jwk_set=None)</code> cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. <em>Reported by <a href="https://github.com/eddieran"><code>@eddieran</code></a>.</em></p> </li> </ul> <h2>Fixed</h2> <ul> <li>Reject empty HMAC keys outright in <code>HMACAlgorithm.prepare_key</code> with <code>InvalidKeyError</code> instead of accepting them with only a warning. Defends against the <code>os.getenv("JWT_SECRET", "")</code> footgun. <em>Thanks to <a href="https://github.com/SnailSploit"><code>@SnailSploit</code></a> and <a href="https://github.com/spartan8806"><code>@spartan8806</code></a> for the reports.</em></li> <li>Forward per-call <code>options</code> (including <code>enforce_minimum_key_length</code>) from <code>PyJWT.decode</code> through to <code>PyJWS._verify_signature</code>. The option was previously silently dropped between the two layers, so it only took effect when set on the <code>PyJWT</code> instance. <em>Thanks to <a href="https://github.com/WLUB"><code>@WLUB</code></a> for the report.</em></li> <li><strong>RFC 7797 §3 compliance for <code>b64=false</code>:</strong> the encoder now auto-adds <code>"b64"</code> to <code>crit</code>, and the decoder rejects tokens that set <code>b64=false</code> without listing it in <code>crit</code>. <em>Thanks to <a href="https://github.com/MachineLearning-Nerd"><code>@MachineLearning-Nerd</code></a> for the report.</em></li> </ul> <h2>Changed</h2> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups, by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1152">#1152</a>.</li> </ul> <h2>Upgrade notes</h2> <p>Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:</p> <ul> <li><strong>Empty HMAC keys now raise.</strong> If your app passed <code>""</code> or <code>b""</code> as a secret (often via a missing env var, e.g. <code>os.getenv("JWT_SECRET", "")</code>), <code>encode</code>/<code>decode</code> will now raise <code>InvalidKeyError</code>. This is the intended behavior — fix the configuration.</li> <li><strong><code>PyJWK</code> decoding now requires the token's <code>alg</code> to match the JWK's algorithm.</strong> Previously a mismatch was silently honored if the header <code>alg</code> appeared in the allow-list. Tokens that relied on this mismatch will now fail with <code>InvalidAlgorithmError</code>.</li> <li><strong><code>PyJWKClient</code> now rejects non-HTTP(S) URIs at construction time.</strong> Tests or dev environments that fetched JWKS from <code>file://</code> URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct <code>PyJWKSet.from_dict(...)</code> directly).</li> <li><strong><code>b64=false</code> tokens are now strictly RFC 7515 / 7797 compliant.</strong> Tokens with a non-empty compact-form payload segment, or that omit <code>"b64"</code> from <code>crit</code>, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.</li> <li><strong><code>enforce_minimum_key_length</code> set per-call now takes effect.</strong> Callers who passed <code>options={"enforce_minimum_key_length": True}</code> to <code>jwt.decode()</code> previously got no enforcement; they will now get <code>InvalidKeyError</code> on undersized keys, as documented.</li> </ul> <p><strong>Full changelog:</strong> <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0></code>__</h2> <p>Security</p> <pre><code> - Reject JWK JSON documents passed as raw HMAC secrets in ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that the existing PEM/SSH guard did not cover. Reported by @aradona91 in `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__. - Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during verification so the caller's ``algorithms=[...]`` allow-list cannot be bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__. - Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker- influenced URIs cannot read local files or reach unintended schemes via urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__. - Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``. The previous ``finally``-block ``put(None)`` pattern cleared the cache on any transient outage, turning one bad JWKS request into application- wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__. - Skip the unconditional base64 decode of the compact-form payload segment when ``b64=false`` is set in the protected header, and require that segment to be empty (RFC 7515 Appendix F detached form). Closes an unauthenticated DoS amplifier. Reported by @thesmartshadow in `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__. <p>Fixed</p> <pre><code> - Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with ``InvalidKeyError`` instead of accepting them with only a warning. Thanks to @SnailSploit and @spartan8806 for independently flagging the footgun. - Forward per-call ``options`` (including ``enforce_minimum_key_length``) from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the option actually takes effect when set at the call site rather than only on the ``PyJWT`` instance. Thanks to @WLUB for the report. - RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects tokens that set ``b64=false`` without listing it in ``crit``. Thanks to @MachineLearning-Nerd for the report. Changed </code></pre> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <code>[datacommonsorg#1152](jpadilla/pyjwt#1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;</code>__ </code></pre></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff"><code>7144e45</code></a> Apply ruff format</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab"><code>d2f4bec</code></a> Restore <code>cast()</code> calls with cross-version <code>type: ignore</code> for <code>prepare_key</code></li> <li><a href="https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774"><code>22f478c</code></a> Remove redundant casts in <code>RSAAlgorithm.prepare_key</code> and `ECAlgorithm.prepare...</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81"><code>95791b1</code></a> Bundle security fixes and hardening into 2.13.0</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508"><code>dcc27a9</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1155">#1155</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a"><code>9d08a9a</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1146">#1146</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64"><code>b87c100</code></a> Bump codecov/codecov-action from 5 to 6 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1154">#1154</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812"><code>40e3147</code></a> Migrate development extras to dependency groups (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1152">#1152</a>)</li> <li>See full diff in <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/datacommonsorg/website/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Dan Noble <dwnoble@google.com>
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
Fixes the missing website and mixer githashes on /version in custom DC and local. ## Context & Problem In Custom Data Commons (CDC) deployments, both the Website and Mixer commit hashes are missing (displaying as empty or "None") on the `/version` page. This occurs because the CDC services docker image (`datacommons-services`) is built without passing or defining the `WEBSITE_HASH` and `MIXER_HASH` environment variables at build-time. While base Data Commons resolves and injects these variables at the Kubernetes/Pod level during GKE deployments, Custom DC's single-container deployment lacks this runtime injection mechanism. Resolving this is important for helping custom DC users verify they are on the correct and/or supported version. Similarly, the Website commit hashes don't work on the `/version` page when running the website server locally. ## Proposed Changes This PR plumbs the git commit hashes from the source code and build triggers into the Docker container image environment variables. ### 1. Dockerfile Updates * **build/cdc_services/Dockerfile:** Declared `MIXER_HASH` and `WEBSITE_HASH` build arguments (`ARG`) and mapped them to container environment variables (`ENV`) in the final runtime stage. ### 2. Google Cloud Build Pipelines * **build/ci/cloudbuild.push_cdc_services_image.yaml & build/ci/cloudbuild.push_image.yaml:** * Added a `resolve-hashes` step. If the pipeline runs with a `.git` metadata folder (automated repository builds), it queries git for both hashes. If `.git` is ignored (manual submissions), it falls back to substitutions. * Passed the resolved hashes as `--build-arg`s during the docker build step. ### 3. Local & Wrapper Scripts * **run_server.sh:** Resolves and exports both hashes locally when running the web server natively, preventing "None" from displaying during local dev. * **run_cdc_dev_docker.sh & scripts/build_and_tag_cdc_image.sh:** Queries local git and passes hashes to local `docker build` commands. * **scripts/push_image.sh & scripts/push_cdc_services_image.sh:** Resolves local hashes and passes them as Cloud Build substitutions (`_WEBSITE_HASH`, `_MIXER_HASH`). Separated `WEBSITE_HASH` from the docker image tag to prevent "dev-" prefixes from breaking the version links. ## Verification 1. Local Runtime Verification: Started the custom DC services container locally via Docker using: ``` ./run_cdc_dev_docker.sh --actions build_run --image local-test-services:test-fix --container service ``` and checked the `/version` endpoint. Both hashes render correctly under "Website Commit" and "Mixer Commit" with correct link destinations. 3. Local Native Verification: Started the base DC website server via `./run_server.sh` and verified hashes display correctly. ## Screenshots Before: <img width="1706" height="1328" alt="image" src="https://github.com/user-attachments/assets/bed90bd2-1973-4b38-bf1e-efc100599b22" /> After: <img width="1706" height="1328" alt="image" src="https://github.com/user-attachments/assets/918a783e-a930-411a-829a-131bce62fffa" />
Starting for M0.5 and onwards, we will only support Spanner embeddings for DCP.
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
…ebsite hash (datacommonsorg#6666) we no longer deploy nl server images, the current deployment failed trying to read nl server image by website hash We remove the CI/CD of nl server from datacommonsorg#6660 based on the NL server deprecation plan in https://docs.google.com/document/d/1uvj0RwNAmxIQ5WwiKldFnSz2qqp46MY4XvVCH2xNGr4/edit?tab=t.0#heading=h.5bmtjewhx944
This PR does below: Remove the logic to invoke NL server Remove the NL root completely Remove the logic that involves feature flag use_v2_resolve_for_nl_search_vars The Golden change is for the case of DETAILED_ACTION which is only allowed in mode=strict. It's no-op in prod. I tested the website both locally and deployed to dev on direct query, SV tools Map tools plot tools time-series tools All the tools looks fine as before --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
…nabled, and stops deploying nl images to website (datacommonsorg#6668) This PR update the deployment to not deploy nl service as well as not send nl-configs. Tested deployment with dev env as in this screenshot https://screenshot-v2.corp.google.com/07tttabc6utqg confirmed no nl deployment Tests the query and tools for dev website and functional as before
…graph which is always true. (datacommonsorg#6669) ### Summary - **Connect DCP Mixer to Redis**: Passes `--use_redis=true` and `--redis_info` to Mixer in `build/cdc_services/run.sh` whenever `REDIS_HOST` and `REDIS_PORT` are configured, enabling L2 Redis caching for V2/V3 Mixer endpoints (`/core/api/*`, MCP queries, and topic hierarchy cache). - **Always enable Spanner Graph in `datacommons-services`**: Removes the `USE_SPANNER_GRAPH == "true"` conditional in `build/cdc_services/run.sh` since Spanner Graph is now always enabled in DCP deployments. We deployed this in gmechali-latest and verified the cache hit! Paired with https://github.com/datacommonsorg/datacommons/compare/useSpannerGraph
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
…sorg#6670) This is part of a series of PRs to enable authentication in the Redis caches. The code is added to all respective binaries that require it: - website: datacommonsorg#6670 (this PR) - mixer: datacommonsorg/mixer#2122 - ingestion-helper: datacommonsorg/import#778 And the DCP Terraform will start propagating the env vars, starting with datacommonsorg/datacommons#286 In addition to password authentication, these PRs also enable in-transit TLS encryption (transit_encryption_mode = "SERVER_AUTHENTICATION", controlled via redis_enable_tls and defaulted to true) on the Memorystore instance and propagate the instance's CA certificate (REDIS_CA_CERT) to Mixer, Flask, and dc-ingestion-helper so all Redis traffic and AUTH handshakes are encrypted and server-verified over TLS (rediss://). When REDIS_CA_CERT is unset (such as in Base DC), all clients automatically fall back to standard unencrypted TCP connections. This was tested by deploying all these artifacts and terraform changes to gmechali-latest, and inspecting logs to confirm the caches are being hit by both the flask level calls, and mixer level calls. Additionally, the cache flush from ingestion helper succeeded post ingestion. Note that these changes would take effect with the soonest DCP release for customers that enable redis. For base DC, the passwords will remain unset for now, and the calls to the cache should be unaffected as the cache remains unauthenticated.
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
This pull request updates the golden files automatically via Cloud Build. Please review the changes carefully. [Cloud Build Log](https://console.cloud.google.com/cloud-build/builds/86d63536-ffe3-4b1d-975c-eb90040f4866?project=datcom-ci) Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com> Co-authored-by: Xiao Shi <shixiao@google.com>
…he build artifacts for nl server (datacommonsorg#6672) This PR drops the sidecar for all dc-mixer pods inside the datcom-website-*deployments and cleans up the unused image tagging and skaffold build artifact.
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
…monsorg#6678) ## Description This PR groups facet options in the standard facet selector modal by provenance (rather than `importName`, which is no longer guaranteed to be part of the payload). ## Testing The PR added a unit test in `static/js/shared/facet_selector/facet_selector_standard_content.test.tsx` verifying that facets with numeric IDs sharing a `provenanceId` are grouped together when `importName` is omitted. ## Screenshots ### Before <img width="1242" height="2226" alt="image" src="https://github.com/user-attachments/assets/1770e5f3-77b5-4118-a44a-bfb40743cbff" /> ### After <img width="1678" height="1388" alt="image" src="https://github.com/user-attachments/assets/e60906b4-7924-4384-9212-829bbb845261" />
…atacommonsorg#6676) Coupled with datacommonsorg/import#782, we now resolved all critical vulnerabilities, and 88% of actionable vulnerabilities. See drop of reported issues: https://screenshot-v2.corp.google.com/2i0gbf769m2so
This PR update the scripts to run local websites, tested against local website with ./run_server.sh -m and the local website could function properly
…f importName (datacommonsorg#6680) ## Description This PR makes the Stat Var Explorer resilient to provenance summaries that do not include `importName`, which is no longer guaranteed to be part of the payload. Previously, a missing `importName` would have left the provenance card header blank, and sorting the cards would have thrown a type errorwhenever a stat var had two or more sources. * Added `getProvenanceDisplayName` in `provenance.tsx`, which returns `importName` when present and otherwise falls back to the last segment of the provenance ID (e.g. `dc/base/CensusPEP` → `CensusPEP`). The card header and the card sort order both use it, so they stay consistent. * Marked `ProvenanceSummary.importName` as optional in `shared/types.ts`. `importName` is still preferred when present, because importName may, in the future, provide human-readable names. ## Tests * Added a unit test in `static/js/tools/stat_var/explorer.test.tsx` that renders three sources, two of which lack `importName`, and verifies that the cards render without throwing, that the headers fall back to the provenance ID segment, and that the cards are sorted by display name. * Compared `/tools/statvar#sv=Count_Person` locally against master. ## Testing This should be a no-op in terms of functionality (because we still do have the importName). [localhost](http://localhost:8080/tools/statvar#sv=Count_Person) [prod](https://datacommons.org/tools/statvar#sv=Count_Person) The above two should look the same. A note about that comparison: there is a race condition which causes the source URL to always appear. If the source URL appears in local but not in prod, this is not related to this PR (and will be fixed in a subsequent PR). ## Related PRs This PR was preceeded by a related fix: [6678](datacommonsorg#6678) This PR will be followed up with further importName resilience fixes.
…monsorg#6682) ## Description This PR fixes a race condition in the Stat Var Explorer that prevented provenance `Source:` links from reliably rendering. * Updated `fetchSummary` in `static/js/tools/stat_var/page.tsx` to wait for the provenance URL request to resolve before calling `setState`. ## Tests * Added a unit test in `static/js/tools/stat_var/page.test.tsx` where the provenance URL request resolves after the summary and sources requests, with no subsequent state updates, and verified that the provenance card renders the `Source:` link. ## Testing [local](http://localhost:8080/tools/statvar#sv=Count_Person) Locally on master, if you refresh this page multiple times, you will see the Source link sometimes appear and sometimes not. With this fix, the link will reliably appear ## Screenshots ### Before <img width="2770" height="1038" alt="image" src="https://github.com/user-attachments/assets/193ffba4-3e68-4528-a692-6044bac7df5c" /> ### After <img width="2569" height="634" alt="image" src="https://github.com/user-attachments/assets/e00c9116-e64a-4710-93c2-a91db0c7ffec" />
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
Saw some Goldens need rebase today, this looks like data changes
…ng of importName (datacommonsorg#6684) ## Description This PR makes the Map Tool's time-slider legend bounds resilient to facets from `/api/observation-dates` (Mixer `/v2/observation`) that do not include `importName`, which is no longer guaranteed to be part of the payload. Previously, `useComputeLegendDomain` joined facets from `/api/observation-dates` with `StatVarSummary.provenanceSummary` using a string key from `getMetaText` that started with `[importName]`. A missing `importName` on the facet caused the facet key to become `[undefined]...` while the summary key remained `[CensusACS5YearSurvey]...`. Because the keys never matched, `useComputeLegendDomain` returned `null` and the map fell back to a per-date legend whose min/max rescaled every time the time slider advanced. * Updated `getMetaText` in `static/js/tools/map/util.ts` to prefix the key with `metadata.provenanceId` instead of `metadata.importName`. * Updated `useComputeLegendDomain` in `static/js/tools/map/compute/legend.ts` and `getLegendBounds` in `static/js/tools/map/util.ts` to pass the `provenanceSummary` key (`provId`) as `provenanceId`. * Updated the `provenanceSummary` parameter type on `getLegendBounds` from `ProvenanceSummary` to `Record<string, ProvenanceSummary>` to match `StatVarSummary.provenanceSummary`. (`getLegendBounds` currently has no callers; it is updated here for consistency and unit test coverage, with removal left for a follow-up.) `provenanceId` is present on every facet (required in Spanner; Bigtable synthesizes `dc/base/<importName>`), and `provId` is always the summary key. There is deliberately no `importName` fallback, because falling back when only one side has `importName` would reintroduce the mismatch. The metatext string is only used within a single render (the URL `src` parameter stores the facet ID), so changing its format has no compatibility impact. ## Tests * Added unit tests in `static/js/tools/map/util.test.ts` verifying that `getMetaText` prefixes with `provenanceId`, that `getLegendBounds` matches facets lacking `importName` against `provenanceSummary` entries that still carry `importName`, and that missing place types return empty bounds. ## Testing [localhost](http://localhost:8080/tools/map#&sv=Median_Income_Person&pc=0&pd=country/USA&ept=State&ts=1) [prod](https://datacommons.org/tools/map#&sv=Median_Income_Person&pc=0&pd=country/USA&ept=State&ts=1) Note that in production, the colors are rescaled with each year. Also note: the time slider functionality causes significant "turbulence" in the page because the explore other facets button does not maintain a constant height. This will be fixed in a separate PR. ## Related PRs This PR was preceded by related fixes: * [6678](datacommonsorg#6678) * [6680](datacommonsorg#6680) This PR will be followed up with further `importName` resilience fixes.
This PR automatically updates the `mixer` and `import` submodules to their latest `master` branches. Co-authored-by: datacommons-robot-author <datacommons-robot-author@users.noreply.github.com>
DCP 1.1.6 ships website 9852134 (v3.5.13) with mixer 8118587 and import e17d3a3, the pins this commit takes. dev was a snapshot of upstream 28f31e5 with no shared history, so this merge replays upstream's 28f31e5..9852134 change onto dev and records 9852134 as a second parent. Later syncs are ordinary merges of upstream tags. The 1.1.6 Terraform module stops setting USE_SPANNER_GRAPH, and upstream run.sh no longer gates the Spanner graph and feature-flag arguments on it. DFO's --genai_client_location flag moves into the unconditional MIXER_ARGS. The Next.js stage, the start.sh hook and the nginx include carry over unchanged in effect. This image also runs on the 1.1.5 module, which sets every variable run.sh reads.
dev follows the DCP version infra deploys. `just dcp-pair <version>` reads the website and mixer commits from the datacommons-services:<version> image's build args, and `just sync <version>` merges that website commit, pins mixer to the image's commit and import to the website's pin. sync-resolve and sync-finish complete a conflicted sync; check-overrides compares the range a sync covered. CONTRIBUTING-DFO.md and custom_dc/dfo/README.md describe the flow, and the process lists match build/cdc_services/run.sh.
build/cdc_services/run.sh at v3.5.13 resolves GCP_PROJECT_ID and the Spanner ids on every boot and exits without the project id. just env fills GCP_PROJECT_ID, GCP_SPANNER_INSTANCE_ID and GCP_SPANNER_DATABASE_NAME with the dfo-dev values when missing, and _check-env refuses to run without them. sync stops with exit 1 on conflicts. sync-resolve lists every path still unmerged and exits 1 while any remain, and .dfo-protected-paths covers every DFO-modified path outside custom_dc/dfo/. sync-finish checks out the recorded submodule commits with git submodule update. The image's mixer hash resolves in the mixer submodule against upstream master, and dcp-pair's registry calls time out after 30s.
.github/workflows/ is DFO-owned. sync and sync-finish reset it to dev's version, so a workflow upstream adds or changes never lands on the fork, and list what upstream changed there. sync registers the merge=ours driver README.md relies on, and sync-finish detects leftover conflict markers in every staged file, Markdown included. PRs into dev land as merge commits, since a sync's second parent keeps dev's history shared with upstream. just env writes fixed dfo-dev values for the Spanner ids and REGION, ignoring the shell, and push no longer requires them. The local principal needs roles/aiplatform.user for mixer's Vertex embedder. custom_dc/api_server no longer exists. Docs and prototype comments point to the apis repository, the Dockerfile names the prototype routes that read GEMINI_API_KEY, and the CI comments describe the current build stages.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings
devto upstream website v3.5.13 (9852134) with mixer8118587and importe17d3a3, the commits Data Commons Platform 1.1.6 builds its services image from.devwas a snapshot of upstream28f31e522with no shared history, so50e4a777ereplays upstream's28f31e522..9852134change ontodevand records9852134as a second parent. From here a sync is an ordinary merge, and this repository is a GitHub fork ofdatacommonsorg/website.The seam files carry DFO's hooks on top of upstream's v3.5.13 versions. Upstream
build/cdc_services/run.shno longer gates the Spanner graph and feature-flag arguments onUSE_SPANNER_GRAPH, which the 1.1.6 Terraform module stops setting, so--genai_client_locationsits in the unconditionalMIXER_ARGS. The Next.js stage inbuild/cdc_services/Dockerfile, thestart.shhook and the nginx include are unchanged in effect. Outsidecustom_dc/,git diff 9852134 HEADand the pre-sync DFO deltagit diff 28f31e522 1d2c0b81ftouch the same paths with the same changes, apart fromrun.shand the mixer pin. The image boots under both the 1.1.5 module (which sets every variable run.sh reads) and 1.1.6, so this merges and deploys before the infra upgrade.just sync <dcp-version>tracks DCP releases.just dcp-pairreads the website and mixer commits from thedatacommons-services:<version>image's build args.syncregisters themerge=oursdriver, merges that website commit, pins mixer to the image's commit (resolved in the mixer submodule against upstream master) and import to the website's pin, and exits 1 on conflicts..github/workflows/is DFO-owned:syncandsync-finishreset it todev's version and list what upstream changed there, so an upstream workflow never runs on the fork.sync-finishrefuses leftover conflict markers in any staged file, and.dfo-protected-pathscovers every DFO-modified path outsidecustom_dc/dfo/. This PR, and every PR intodev, must land as a merge commit, since the second parent is what keeps the fork's history shared with upstream.CONTRIBUTING-DFO.mdandcustom_dc/dfo/README.mddescribe the flow.v3.5.13's
run.shexits on boot withoutGCP_PROJECT_IDand builds a Vertex AI embedder for--host_project.just envwrites fixed dfo-dev values for the project, Spanner ids andREGION, andcustom_dc/dfo/README.mdlists the local roles (roles/spanner.databaseReader,roles/aiplatform.user).custom_dc/api_serverno longer exists, so docs and prototype comments point to the apis repository and the Dockerfile names the prototype routes that readGEMINI_API_KEY.Merging deploys to dfo-dev through
deploy-dev.yml; no workflow builds the image before merge. Rollback is the previous Cloud Run revision.Testing: prototypes typecheck and 686 tests pass.
just dcp-pairreturns the right pairs for 1.1.6, 1.1.5 and 1.1.2.just syncran end to end in throwaway clones: a conflicted sync touching protected and unprotected paths, and a clean 1.1.2 sync where the image's mixer differs from the website's pin.bash -npasses on the extracted recipe scripts. The image was not built locally andjust run-localwas not run.