Kaggle-like machine learning competition platform

This README is still work in progress Machine learning competition platform Machine learning platform just like private Kaggle written in Ruby on Rails framework. Overall Architecture Demo environmen

Information

Category: Ruby / CMS
Watchers: 12
Star: 51
Fork: 6
Last update: Sep 16, 2023

Resource links

https://github.com/AillisInc/ml_competition_platform

README
Issues 12

This README is still work in progress

Machine learning competition platform

Machine learning platform just like private Kaggle written in Ruby on Rails framework.

Overall Architecture

Demo environment

URL

https://demo-ml-competition-platform.herokuapp.com/

Demo user account

ID	[email protected]
Password	^dvTT0JgIPS4V@RWW$Kw

Sample JSON file for submission

Developer's manual

Developer's manual is written in Github Wiki Page (Still WIP)

How to setup development environment

Deploy API server

Clone codes of API Server to calculate metrics for competition

git clone https://github.com/AillisInc/ml_competition_platform.git

Deploy API server according to the following steps
- https://github.com/AillisInc/ml_competition_api_server/blob/master/README.md

Setup environment variables.

cp .env.sample .env
vim .env

Copy the following text to .env file.

METRICS_API_ENDPOINT=http://host.docker.internal:8000/
METRICS_API_AUTH_KEY=secret_key  # In production environment, a strong key is recommended.

About `METRICS_API_AUTH_KEY`

METRICS_API_AUTH_KEY is used for authorization with API server to calculate metrics
Therefore, in production environment, it is recommended to use METRICS_API_AUTH_KEY value that cannot be easily guessed.
METRICS_API_AUTH_KEY value should be matched to API_KEY_TOKEN value in API server

Build docker container with docker-compose

$ docker-compose run web bundle install
$ docker-compose run web rails db:setup
$ docker-compose up

Create User Account

create admin account with the following command in rails console.

User.create(email: '[email protected]', password: 'password', name: "admin_user", role: "admin")

in case of creating normal user account, execute the following command.

User.create(email: '[email protected]', password: 'password', name: "test_user", role: "member")

Server URL for development environment

http://localhost:3000

Web API to calculate metrics

To calculate metrics to determine ranking of each competitor, Web API written in Flask should be also deployed.
The github code of this Web API server is here

License

MIT

7 Open More issues

Closed

Bump rack from 2.2.3 to 2.2.6.2

Bumps rack from 2.2.3 to 2.2.6.2.

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

[3.0.3] - 2022-12-07

Fixed

Rack::URLMap uses non-deprecated form of Regexp.new. (#1998, @weizheheng)

[3.0.2] -2022-12-05

Fixed

Utils.build_nested_query URL-encodes nested field names including the square brackets.

Allow Rack::Response to pass through streaming bodies. (#1993, [@ioquatix])

[3.0.1] - 2022-11-18

Fixed

MethodOverride does not look for an override if a request does not include form/parseable data.

Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call and to_path, forwarding to the body. (#1981, [@ioquatix])

[3.0.0] - 2022-09-06

No changes

[3.0.0.rc1] - 2022-09-04

SPEC Changes

Stream argument must implement << rack/rack#1959

close may be called on rack.input rack/rack#1956

rack.response_finished may be used for executing code after the response has been finished rack/rack#1952

[3.0.0.beta1] - 2022-08-08

Security

Do not use semicolon as GET parameter separator. (#1733, [@jeremyevans])

SPEC Changes

Response array must now be non-frozen.

Response status must now be an integer greater than or equal to 100.

Response headers must now be an unfrozen hash.

Response header keys can no longer include uppercase characters.

Response header values can be an Array to handle multiple values (and no longer supports \n encoded headers).

Response body can now respond to #call (streaming body) instead of #each (enumerable body), for the equivalent of response hijacking in previous versions.

... (truncated)

Commits

2606ac5 bumping version
f6d4f52 Fix ReDoS in Rack::Utils.get_byte_ranges
20bc90c bump version
3677f17 Update changelog
ee25ab9 Fix ReDoS vulnerability in multipart parser
19e49f0 Forbid control characters in attributes
ea39e49 Bump patch version.
c0f9de4 Rack::MethodOverride handle QueryParser::ParamsTooDeepError (#2011)
8312a2f Remove leading dot to fix compatibility with latest cgi gem. (#1988)
2a82c88 Update tests to work on latest Rubies. (#1999)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Jan 18, 2023 by dependabot[bot] 1

Closed

Bump rails-html-sanitizer from 1.3.0 to 1.4.3

Bumps rails-html-sanitizer from 1.3.0 to 1.4.3.

Release notes

Sourced from rails-html-sanitizer's releases.

1.4.3 / 2022-06-09

Address a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

Prevent the combination of select and style as allowed tags in SafeListSanitizer.

Fixes CVE-2022-32209

Mike Dalessio

1.4.2 / 2021-08-23

Slightly improve performance.

Assuming elements are more common than comments, make one less method call per node.

1.4.1 / 2021-08-18

Fix regression in v1.4.0 that did not pass comment nodes to the scrubber.

Some scrubbers will want to override the default behavior and allow comments, but v1.4.0 only passed through elements to the scrubber's keep_node? method.

This change once again allows the scrubber to make the decision on comment nodes, but still skips other non-elements like processing instructions (see #115).

Mike Dalessio

1.4.0 / 2021-08-18

Processing Instructions are no longer allowed by Rails::Html::PermitScrubber

Previously, a PI with a name (or "target") matching an allowed tag name was not scrubbed. There are no known security issues associated with these PIs, but similar to comments it's preferred to omit these nodes when possible from sanitized output.

Fixes #115.

Mike Dalessio

Changelog

Sourced from rails-html-sanitizer's changelog.

1.4.3 / 2022-06-09

Address a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

Prevent the combination of select and style as allowed tags in SafeListSanitizer.

Fixes CVE-2022-32209

Mike Dalessio

1.4.2 / 2021-08-23

Slightly improve performance.

Assuming elements are more common than comments, make one less method call per node.

Mike Dalessio

1.4.1 / 2021-08-18

Fix regression in v1.4.0 that did not pass comment nodes to the scrubber.

Some scrubbers will want to override the default behavior and allow comments, but v1.4.0 only passed through elements to the scrubber's keep_node? method.

This change once again allows the scrubber to make the decision on comment nodes, but still skips other non-elements like processing instructions (see #115).

Mike Dalessio

1.4.0 / 2021-08-18

Processing Instructions are no longer allowed by Rails::Html::PermitScrubber

Previously, a PI with a name (or "target") matching an allowed tag name was not scrubbed. There are no known security issues associated with these PIs, but similar to comments it's preferred to omit these nodes when possible from sanitized output.

Fixes #115.

Mike Dalessio

Commits

f83f08c version bump to v1.4.3
924e3ab update CHANGELOG for v1.4.3
9b79253 Merge pull request #137 from rails/flavorjones-prevent-select-style-combinati...
45a5c10 fix: modify safelist option if it contains both select and style
045774a test: clean up tests by using the helpers
fe109c9 test: ensure we pass with libxml 2.9.14
9778c47 test: ensure tests pass when nokogiri uses system libxml2
9c421f0 ci: add coverage for system libxml2
984b82e ci: include coverage of ruby 3.1 and jruby 9.3
18f2f2c test: finally use the CSS hex encoding originally intended
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Jul 6, 2022 by dependabot[bot] 1

Closed

Bump nokogiri from 1.11.5 to 1.13.6

Bumps nokogiri from 1.11.5 to 1.13.6.

Release notes

Sourced from nokogiri's releases.

1.13.6 / 2022-05-08

Security

[CRuby] Address CVE-2022-29181, improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See GHSA-xh29-r2w5-wx8m for more information.

Improvements

{HTML4,XML}::SAX::{Parser,ParserContext} constructor methods now raise TypeError instead of segfaulting when an incorrect type is passed.

sha256:
58417c7c10f78cd1c0e1984f81538300d4ea98962cfd3f46f725efee48f9757a  nokogiri-1.13.6-aarch64-linux.gem
a2b04ec3b1b73ecc6fac619b41e9fdc70808b7a653b96ec97d04b7a23f158dbc  nokogiri-1.13.6-arm64-darwin.gem
4437f2d03bc7da8854f4aaae89e24a98cf5c8b0212ae2bc003af7e65c7ee8e27  nokogiri-1.13.6-java.gem
99d3e212bbd5e80aa602a1f52d583e4f6e917ec594e6aa580f6aacc253eff984  nokogiri-1.13.6-x64-mingw-ucrt.gem
a04f6154a75b6ed4fe2d0d0ff3ac02f094b54e150b50330448f834fa5726fbba  nokogiri-1.13.6-x64-mingw32.gem
a13f30c2863ef9e5e11240dd6d69ef114229d471018b44f2ff60bab28327de4d  nokogiri-1.13.6-x86-linux.gem
63a2ca2f7a4f6bd9126e1695037f66c8eb72ed1e1740ef162b4480c57cc17dc6  nokogiri-1.13.6-x86-mingw32.gem
2b266e0eb18030763277b30dc3d64337f440191e2bd157027441ac56a59d9dfe  nokogiri-1.13.6-x86_64-darwin.gem
3fa37b0c3b5744af45f9da3e4ae9cbd89480b35e12ae36b5e87a0452e0b38335  nokogiri-1.13.6-x86_64-linux.gem
b1512fdc0aba446e1ee30de3e0671518eb363e75fab53486e99e8891d44b8587  nokogiri-1.13.6.gem
1.13.5 / 2022-05-04

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-29824. See GHSA-cgx6-hpwq-fhv5 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated from v2.9.13 to v2.9.14.

Improvements

[CRuby] The libxml2 HTML4 parser no longer exhibits quadratic behavior when recovering some broken markup related to start-of-tag and bare < characters.

Changed

[CRuby] The libxml2 HTML4 parser in v2.9.14 recovers from some broken markup differently. Notably, the XML CDATA escape sequence <![CDATA[ and incorrectly-opened comments will result in HTML text nodes starting with <! instead of skipping the invalid tag. This behavior is a direct result of the quadratic-behavior fix noted above. The behavior of downstream sanitizers relying on this behavior will also change. Some tests describing the changed behavior are in test/html4/test_comments.rb.

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.13.6 / 2022-05-08

Security

[CRuby] Address CVE-2022-29181, improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See GHSA-xh29-r2w5-wx8m for more information.

Improvements

{HTML4,XML}::SAX::{Parser,ParserContext} constructor methods now raise TypeError instead of segfaulting when an incorrect type is passed.

1.13.5 / 2022-05-04

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-29824. See GHSA-cgx6-hpwq-fhv5 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated from v2.9.13 to v2.9.14.

Improvements

[CRuby] The libxml2 HTML parser no longer exhibits quadratic behavior when recovering some broken markup related to start-of-tag and bare < characters.

Changed

[CRuby] The libxml2 HTML parser in v2.9.14 recovers from some broken markup differently. Notably, the XML CDATA escape sequence <![CDATA[ and incorrectly-opened comments will result in HTML text nodes starting with <! instead of skipping the invalid tag. This behavior is a direct result of the quadratic-behavior fix noted above. The behavior of downstream sanitizers relying on this behavior will also change. Some tests describing the changed behavior are in test/html4/test_comments.rb.

1.13.4 / 2022-04-11

Security

Address CVE-2022-24836, a regular expression denial-of-service vulnerability. See GHSA-crjr-9rc5-ghw8 for more information.

[CRuby] Vendored zlib is updated to address CVE-2018-25032. See GHSA-v6gp-9mmm-c6p5 for more information.

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated to address CVE-2022-23437. See GHSA-xxx9-3xcr-gjj3 for more information.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated to address CVE-2022-24839. See GHSA-gx8x-g87m-h5q6 for more information.

Dependencies

[CRuby] Vendored zlib is updated from 1.2.11 to 1.2.12. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated from 2.12.0 to 2.12.2.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated from a fork of 1.9.21 to 1.9.22.noko2. This fork is now publicly developed at https://github.com/sparklemotion/nekohtml

... (truncated)

Commits

b7817b6 version bump to v1.13.6
61b1a39 Merge pull request #2530 from sparklemotion/flavorjones-check-parse-memory-ty...
83cc451 fix: {HTML4,XML}::SAX::{Parser,ParserContext} check arg types
22c9e5b version bump to v1.13.5
6155881 doc: update CHANGELOG for v1.13.5
c519a47 Merge pull request #2527 from sparklemotion/2525-update-libxml-2_9_14-v1_13_x
66c2886 dep: update libxml2 to v2.9.14
b7c4cc3 test: unpend the LIBXML_LOADED_VERSION test on freebsd
eac7934 dev: require yaml
f3521ba style(rubocop): pend Style/FetchEnvVar for now
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened May 18, 2022 by dependabot[bot] 1

Closed

Bump nokogiri from 1.11.5 to 1.13.4

Bumps nokogiri from 1.11.5 to 1.13.4.

Release notes

Sourced from nokogiri's releases.

1.13.4 / 2022-04-11

Security

Address CVE-2022-24836, a regular expression denial-of-service vulnerability. See GHSA-crjr-9rc5-ghw8 for more information.

[CRuby] Vendored zlib is updated to address CVE-2018-25032. See GHSA-v6gp-9mmm-c6p5 for more information.

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated to address CVE-2022-23437. See GHSA-xxx9-3xcr-gjj3 for more information.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated to address CVE-2022-24839. See GHSA-gx8x-g87m-h5q6 for more information.

Dependencies

[CRuby] Vendored zlib is updated from 1.2.11 to 1.2.12. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated from 2.12.0 to 2.12.2.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated from a fork of 1.9.21 to 1.9.22.noko2. This fork is now publicly developed at https://github.com/sparklemotion/nekohtml

sha256sum:
095ff1995ed3dda3ea98a5f08bdc54bef02be1ce4e7c81034c4812e5e7c6e7e3  nokogiri-1.13.4-aarch64-linux.gem
7ebfc7415c819bcd4e849627e879cef2fb328bec90e802e50d74ccd13a60ec75  nokogiri-1.13.4-arm64-darwin.gem
41efd87c121991de26ef0393ac713d687e539813c3b79e454a2e3ffeecd107ea  nokogiri-1.13.4-java.gem
ab547504692ada0cec9d2e4e15afab659677c3f4c1ac3ea639bf5212b65246a1  nokogiri-1.13.4-x64-mingw-ucrt.gem
fa5c64cfdb71642ed647428e4d0d75ee0f4d189cfb63560c66fd8bdf99eb146b  nokogiri-1.13.4-x64-mingw32.gem
d6f07cbcbc28b75e8ac5d6e729ffba3602dffa0ad16ffac2322c9b4eb9b971fc  nokogiri-1.13.4-x86-linux.gem
0f7a4fd13e25abe3f98663fef0d115d58fdeff62cf23fef12d368e42adad2ce6  nokogiri-1.13.4-x86-mingw32.gem
3eef282f00ad360304fbcd5d72eb1710ff41138efda9513bb49eec832db5fa3e  nokogiri-1.13.4-x86_64-darwin.gem
3978610354ec67b59c128d23259c87b18374ee1f61cb9ed99de7143a88e70204  nokogiri-1.13.4-x86_64-linux.gem
0d46044eb39271e3360dae95ed6061ce17bc0028d475651dc48db393488c83bc  nokogiri-1.13.4.gem
1.13.3 / 2022-02-21

Fixed

[CRuby] Revert a HTML4 parser bug in libxml 2.9.13 (introduced in Nokogiri v1.13.2). The bug causes libxml2's HTML4 parser to fail to recover when encountering a bare < character in some contexts. This version of Nokogiri restores the earlier behavior, which is to recover from the parse error and treat the < as normal character data (which will be serialized as < in a text node). The bug (and the fix) is only relevant when the RECOVER parse option is set, as it is by default. [#2461]

SHA256 checksums:
025a4e333f6f903072a919f5f75b03a8f70e4969dab4280375b73f9d8ff8d2c0  nokogiri-1.13.3-aarch64-linux.gem
b9cb59c6a6da8cf4dbee5dbb569c7cc95a6741392e69053544e0f40b15ab9ad5  nokogiri-1.13.3-arm64-darwin.gem
e55d18cee64c19d51d35ad80634e465dbcdd46ac4233cb42c1e410307244ebae  nokogiri-1.13.3-java.gem
53e2d68116cd00a873406b8bdb90c78a6f10e00df7ddf917a639ac137719b67b  nokogiri-1.13.3-x64-mingw-ucrt.gem
b5f39ebb662a1be7d1c61f8f0a2a683f1bb11690a6f00a99a1aa23a071f80145  nokogiri-1.13.3-x64-mingw32.gem
7c0de5863aace4bbbc73c4766cf084d1f0b7a495591e46d1666200cede404432  nokogiri-1.13.3-x86-linux.gem
</tr></table> 

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.13.4 / 2022-04-11

Security

Address CVE-2022-24836, a regular expression denial-of-service vulnerability. See GHSA-crjr-9rc5-ghw8 for more information.

[CRuby] Vendored zlib is updated to address CVE-2018-25032. See GHSA-v6gp-9mmm-c6p5 for more information.

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated to address CVE-2022-23437. See GHSA-xxx9-3xcr-gjj3 for more information.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated to address CVE-2022-24839. See GHSA-gx8x-g87m-h5q6 for more information.

Dependencies

[CRuby] Vendored zlib is updated from 1.2.11 to 1.2.12. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

[JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated from 2.12.0 to 2.12.2.

[JRuby] Vendored nekohtml (org.cyberneko.html) is updated from a fork of 1.9.21 to 1.9.22.noko2. This fork is now publicly developed at https://github.com/sparklemotion/nekohtml

1.13.3 / 2022-02-21

Fixed

[CRuby] Revert a HTML4 parser bug in libxml 2.9.13 (introduced in Nokogiri v1.13.2). The bug causes libxml2's HTML4 parser to fail to recover when encountering a bare < character in some contexts. This version of Nokogiri restores the earlier behavior, which is to recover from the parse error and treat the < as normal character data (which will be serialized as < in a text node). The bug (and the fix) is only relevant when the RECOVER parse option is set, as it is by default. [#2461]

1.13.2 / 2022-02-21

Security

[CRuby] Vendored libxml2 is updated from 2.9.12 to 2.9.13. This update addresses CVE-2022-23308.

[CRuby] Vendored libxslt is updated from 1.1.34 to 1.1.35. This update addresses CVE-2021-30560.

Please see GHSA-fq42-c5rg-92c2 for more information about these CVEs.

Dependencies

[CRuby] Vendored libxml2 is updated from 2.9.12 to 2.9.13. Full changelog is available at https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.13.news

[CRuby] Vendored libxslt is updated from 1.1.34 to 1.1.35. Full changelog is available at https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.news

1.13.1 / 2022-01-13

Fixed

Fix Nokogiri::XSLT.quote_params regression in v1.13.0 that raised an exception when non-string stylesheet parameters were passed. Non-string parameters (e.g., integers and symbols) are now explicitly supported and both keys and values will be stringified with #to_s. [#2418]

Fix CSS selector query regression in v1.13.0 that raised an Nokogiri::XML::XPath::SyntaxError when parsing XPath attributes mixed into the CSS query. Although this mash-up of XPath and CSS syntax previously worked unintentionally, it is now an officially supported feature and is documented as such. [#2419]

1.13.0 / 2022-01-06

... (truncated)

Commits

4e2c4b2 version bump to v1.13.4
6a20ee4 Merge pull request #2510 from sparklemotion/flavorjones-encoding-reader-perfo...
b848031 Merge pull request #2509 from sparklemotion/flavorjones-parse-processing-inst...
c0ecf3b test: pend the LIBXML_LOADED_VERSION test on freebsd
e444525 fix(perf): HTML4::EncodingReader detection
1eb5580 style(rubocop): allow intentional use of empty initializer
0feac5a fix(dep): HTML parsing of processing instructions
db72b90 test: recent nekohtml versions do not consider 'a' to be inline
2af2a87 style(rubocop): allow intentional use of empty initializer
ba7a28c Merge pull request #2499 from sparklemotion/2441-xerces-2.12.2-backport-v1.13.x
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Apr 12, 2022 by dependabot[bot] 1

Closed

Bump nokogiri from 1.11.5 to 1.13.3

Bumps nokogiri from 1.11.5 to 1.13.3.

Release notes

Sourced from nokogiri's releases.

1.13.3 / 2022-02-21

Fixed

[CRuby] Revert a HTML4 parser bug in libxml 2.9.13 (introduced in Nokogiri v1.13.2). The bug causes libxml2's HTML4 parser to fail to recover when encountering a bare < character in some contexts. This version of Nokogiri restores the earlier behavior, which is to recover from the parse error and treat the < as normal character data (which will be serialized as < in a text node). The bug (and the fix) is only relevant when the RECOVER parse option is set, as it is by default. [#2461]

SHA256 checksums:
025a4e333f6f903072a919f5f75b03a8f70e4969dab4280375b73f9d8ff8d2c0  nokogiri-1.13.3-aarch64-linux.gem
b9cb59c6a6da8cf4dbee5dbb569c7cc95a6741392e69053544e0f40b15ab9ad5  nokogiri-1.13.3-arm64-darwin.gem
e55d18cee64c19d51d35ad80634e465dbcdd46ac4233cb42c1e410307244ebae  nokogiri-1.13.3-java.gem
53e2d68116cd00a873406b8bdb90c78a6f10e00df7ddf917a639ac137719b67b  nokogiri-1.13.3-x64-mingw-ucrt.gem
b5f39ebb662a1be7d1c61f8f0a2a683f1bb11690a6f00a99a1aa23a071f80145  nokogiri-1.13.3-x64-mingw32.gem
7c0de5863aace4bbbc73c4766cf084d1f0b7a495591e46d1666200cede404432  nokogiri-1.13.3-x86-linux.gem
675cc3e7d7cca0d6790047a062cd3aa3eab59e3cb9b19374c34f98bade588c66  nokogiri-1.13.3-x86-mingw32.gem
f445596a5a76941a9d1980747535ab50d3399d1b46c32989bc26b7dd988ee498  nokogiri-1.13.3-x86_64-darwin.gem
3f6340661c2a283b337d227ea224f859623775b2f5c09a6bf197b786563958df  nokogiri-1.13.3-x86_64-linux.gem
bf1b1bceff910abb0b7ad825535951101a0361b859c2ad1be155c010081ecbdc  nokogiri-1.13.3.gem
1.13.2 / 2022-02-21

Security

[CRuby] Vendored libxml2 is updated from 2.9.12 to 2.9.13. This update addresses CVE-2022-23308.

[CRuby] Vendored libxslt is updated from 1.1.34 to 1.1.35. This update addresses CVE-2021-30560.

Please see GHSA-fq42-c5rg-92c2 for more information about these CVEs.

Dependencies

[CRuby] Vendored libxml2 is updated from 2.9.12 to 2.9.13. Full changelog is available at https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.13.news

[CRuby] Vendored libxslt is updated from 1.1.34 to 1.1.35. Full changelog is available at https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.news

SHA256 checksums:
63469a9bb56a21c62fbaea58d15f54f8f167ff6fde51c5c2262072f939926fdd  nokogiri-1.13.2-aarch64-linux.gem
2986617f982f645c06f22515b721e6d2613dd69493e5c41ddd03c4830c3b3065  nokogiri-1.13.2-arm64-darwin.gem
aca1d66206740b29d0d586b1d049116adcb31e6cdd7c4dd3a96eb77da215a0c4  nokogiri-1.13.2-java.gem
b9e4eea1a200d9a927a5bc7d662c427e128779cba0098ea49ddbdb3ffc3ddaec  nokogiri-1.13.2-x64-mingw-ucrt.gem
48d5493fec495867c5516a908a068c1387a1d17c5aeca6a1c98c089d9d9fdcf8  nokogiri-1.13.2-x64-mingw32.gem
62034d7aaaa83fbfcb8876273cc5551489396841a66230d3200b67919ef76cf9  nokogiri-1.13.2-x86-linux.gem
e07237b82394017c2bfec73c637317ee7dbfb56e92546151666abec551e46d1d  nokogiri-1.13.2-x86-mingw32.gem
</tr></table> 

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.13.3 / 2022-02-21

Fixed

[CRuby] Revert a HTML4 parser bug in libxml 2.9.13 (introduced in Nokogiri v1.13.2). The bug causes libxml2's HTML4 parser to fail to recover when encountering a bare < character in some contexts. This version of Nokogiri restores the earlier behavior, which is to recover from the parse error and treat the < as normal character data (which will be serialized as < in a text node). The bug (and the fix) is only relevant when the RECOVER parse option is set, as it is by default. [#2461]

1.13.2 / 2022-02-21

Security

[CRuby] Vendored libxml2 is updated from 2.9.12 to 2.9.13. This update addresses CVE-2022-23308.

[CRuby] Vendored libxslt is updated from 1.1.34 to 1.1.35. This update addresses CVE-2021-30560.

Please see GHSA-fq42-c5rg-92c2 for more information about these CVEs.

Dependencies

[CRuby] Vendored libxml2 is updated from 2.9.12 to 2.9.13. Full changelog is available at https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.13.news

[CRuby] Vendored libxslt is updated from 1.1.34 to 1.1.35. Full changelog is available at https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.news

1.13.1 / 2022-01-13

Fixed

Fix Nokogiri::XSLT.quote_params regression in v1.13.0 that raised an exception when non-string stylesheet parameters were passed. Non-string parameters (e.g., integers and symbols) are now explicitly supported and both keys and values will be stringified with #to_s. [#2418]

Fix CSS selector query regression in v1.13.0 that raised an Nokogiri::XML::XPath::SyntaxError when parsing XPath attributes mixed into the CSS query. Although this mash-up of XPath and CSS syntax previously worked unintentionally, it is now an officially supported feature and is documented as such. [#2419]

1.13.0 / 2022-01-06

Notes

Ruby

This release introduces native gem support for Ruby 3.1. Please note that Windows users should use the x64-mingw-ucrt platform gem for Ruby 3.1, and x64-mingw32 for Ruby 2.6–3.0 (see RubyInstaller 3.1.0 release notes).

This release ends support for:

Ruby 2.5, for which official support ended 2021-03-31.

JRuby 9.2, which is a Ruby 2.5-compatible release.

Faster, more reliable installation: Native Gem for ARM64 Linux

This version of Nokogiri ships experimental native gem support for the aarch64-linux platform, which should support AWS Graviton and other ARM Linux platforms. We don't yet have CI running for this platform, and so we're interested in hearing back from y'all whether this is working, and what problems you're seeing. Please send us feedback here: Feedback: Have you used the aarch64-linux native gem?

... (truncated)

Commits

7d74ced version bump to v1.13.3
5970fd9 fix: revert libxml2 regression with HTML4 recovery
49b8663 version bump to v1.13.2
4729133 Merge pull request #2457 from sparklemotion/flavorjones-libxml-2.9.13-v1.13.x
379f757 dev(package): work around gnome mirrors with expired certs
95cf66c dep: upgrade libxml2 2.9.12 → 2.9.13
d37dd02 dep: upgrade libxslt 1.1.34 → 1.1.35
59a9398 dep: upgrade mini_portile 2.7 to 2.8
e885463 dev(package): handle either .tar.gz or .tar.xz archive names
7957c7b style: rubocop
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Feb 26, 2022 by dependabot[bot] 1

Closed

Bump puma from 4.3.8 to 5.6.2

Bumps puma from 4.3.8 to 5.6.2.

Release notes

Sourced from puma's releases.

5.6.1

Bugfixes

Reverted a commit which appeared to be causing occasional blank header values (see issue #2808) (#2809)

Full Changelog: https://github.com/puma/puma/compare/v5.6.0...v5.6.1

5.6.0 - Birdie's Version

Maintainer @nateberkopec had a daughter, nicknamed Birdie:

5.6.0 / 2022-01-25

Features

Support localhost integration in ssl_bind (#2764, #2708)

Allow backlog parameter to be set with ssl_bind DSL (#2780)

Remove yaml (psych) requirement in StateFile (#2784)

Allow culling of oldest workers, previously was only youngest (#2773, #2794)

Add worker_check_interval configuration option (#2759)

Always send lowlevel_error response to client (#2731, #2341)

Support for cert_pem and key_pem with ssl_bind DSL (#2728)

Bugfixes

Keep thread names under 15 characters, prevents breakage on some OSes (#2733)

Fix two 'old-style-definition' compile warning (#2807, #2806)

Log environment correctly using option value (#2799)

Fix warning from Ruby master (will be 3.2.0) (#2785)

extconf.rb - fix openssl with old Windows builds (#2757)

server.rb - rescue handling (Errno::EBADF) for @notify.close (#2745)

Refactor

server.rb - refactor code using @options[:remote_address] (#2742)

[jruby] a couple refactorings - avoid copy-ing bytes (#2730)

5.5.2

Re-allows UTF-8 in HTTP header values

5.5.1

https://github.com/puma/puma/security/advisories/GHSA-48w2-rm65-62xx

5.5.0 - Zawgyi

5.5.0 / 2021-09-19

Zawgyi (Burmese: ဇော်ဂျီ) is a semi-immortal human alchemist and mystic with supernatural powers and often seen with a magic stick and a red hat. Zawgyi is one of the supernatural figures in Burmese mythology and folklore. Name chosen by new (Myanma!) contributor @ye-lin-aung.

The headline feature of this release is a new integration with the localhost gem. Localhost takes care of creating a self-signed SSL certificate for you in development. Require it in your config.ru:
</tr></table> 

... (truncated)

Changelog

Sourced from puma's changelog.

5.6.2 / 2022-02-11

Bugfix/Security

Response body will always be closed. (GHSA-rmj8-8hhh-gv5h, related to #2809)

5.6.1 / 2022-01-26

Bugfixes

Reverted a commit which appeared to be causing occasional blank header values (#2809)

5.6.0 / 2022-01-25

Features

Support localhost integration in ssl_bind (#2764, #2708)

Allow backlog parameter to be set with ssl_bind DSL (#2780)

Remove yaml (psych) requirement in StateFile (#2784)

Allow culling of oldest workers, previously was only youngest (#2773, #2794)

Add worker_check_interval configuration option (#2759)

Always send lowlevel_error response to client (#2731, #2341)

Support for cert_pem and key_pem with ssl_bind DSL (#2728)

Bugfixes

Keep thread names under 15 characters, prevents breakage on some OSes (#2733)

Fix two 'old-style-definition' compile warning (#2807, #2806)

Log environment correctly using option value (#2799)

Fix warning from Ruby master (will be 3.2.0) (#2785)

extconf.rb - fix openssl with old Windows builds (#2757)

server.rb - rescue handling (Errno::EBADF) for @notify.close (#2745)

Refactor

server.rb - refactor code using @options[:remote_address] (#2742)

[jruby] a couple refactorings - avoid copy-ing bytes (#2730)

5.5.2 / 2021-10-12

Bugfixes

Allow UTF-8 in HTTP header values

5.5.1 / 2021-10-12

Feature (added as mistake - we don't normally do this on bugfix releases, sorry!)

Allow setting APP_ENV in preference to RACK_ENV or RAILS_ENV (#2702)

Security

Do not allow LF as a line ending in a header (CVE-2021-41136)

5.5.0 / 2021-09-19

Features

Automatic SSL certificate provisioning for localhost, via localhost gem (#2610, #2257)

... (truncated)

Commits

c6340d1 5.6.2 (#2821)
e0753de 2.6.1
7008a61 Revert "Always send lowlevel_error response to client (#2731)" (#2809)
61ebbbe 5.6.0
d20915d Fix two 'old-style-definition' compile warning (#2807)
930e5b4 Fix typo in CONTRIBUTING (#2805)
c38d61c CONTRIBUTING: file limits
aa732fd Updates for OpenSSL 3 (#2800)
ca2128f Log environment using option value (#2799)
3f3c2f6 Adds a --silent option to the CLI (#2803)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Feb 11, 2022 by dependabot[bot] 1

Open

Bump rack from 2.2.3 to 2.2.6.3

Bumps rack from 2.2.3 to 2.2.6.3.

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

[Unreleased]

SPEC Changes

rack.input is now optional. (#1997, [@ioquatix])

Changed

rack.input is now optional, and if missing, will raise an error. Use this to fail on multipart parsing a request without an input body. (#2018, [@ioquatix])

Introduce module Rack::BadRequest which is included in multipart and query parser errors. (#2019, [@ioquatix])

MIME type for JavaScript files (.js) changed from application/javascript to text/javascript (1bd0f15)

[3.0.4.1] - 2023-01-17

[CVE-2022-44571] Fix ReDoS vulnerability in multipart parser

[CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges

[CVE-2022-44572] Forbid control characters in attributes (also ReDoS)

[3.0.4] - 2023-01-17

Rack::Request#POST should consistently raise errors. Cache errors that occur when invoking Rack::Request#POST so they can be raised again later. (#2010, [@ioquatix])

Fix Rack::Lint error message for HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH. (#2007, @byroot)

Extend Rack::MethodOverride to handle QueryParser::ParamsTooDeepError error. (#2006, @byroot)

[3.0.3] - 2022-12-27

Fixed

Rack::URLMap uses non-deprecated form of Regexp.new. (#1998, @weizheheng)

[3.0.2] -2022-12-05

Fixed

Utils.build_nested_query URL-encodes nested field names including the square brackets.

Allow Rack::Response to pass through streaming bodies. (#1993, [@ioquatix])

[3.0.1] - 2022-11-18

Fixed

MethodOverride does not look for an override if a request does not include form/parseable data.

Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call and to_path, forwarding to the body. (#1981, [@ioquatix])

[3.0.0] - 2022-09-06

... (truncated)

Commits

d6b5b2b bump version
9aac375 Limit all multipart parts, not just files
2606ac5 bumping version
f6d4f52 Fix ReDoS in Rack::Utils.get_byte_ranges
20bc90c bump version
3677f17 Update changelog
ee25ab9 Fix ReDoS vulnerability in multipart parser
19e49f0 Forbid control characters in attributes
ea39e49 Bump patch version.
c0f9de4 Rack::MethodOverride handle QueryParser::ParamsTooDeepError (#2011)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Mar 8, 2023 by dependabot[bot] 0

Open

Bump globalid from 0.4.2 to 1.0.1

Bumps globalid from 0.4.2 to 1.0.1.

Release notes

Sourced from globalid's releases.

v1.0.1

Possible ReDoS based DoS vulnerability in GlobalID

There is a ReDoS based DoS vulnerability in the GlobalID gem. This vulnerability has been assigned the CVE identifier CVE-2023-22799.

Versions Affected: >= 0.2.1 Not affected: NOTAFFECTED Fixed Versions: 1.0.1

Impact

There is a possible DoS vulnerability in the model name parsing section of the GlobalID gem. Carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The FIXED releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Credits

Thank you ooooooo_k for reporting this!

1.0.0

Stable API release.

The code is the same as the 0.6.0 release.

0.6.0

Add ActiveRecord::FixtureSet.signed_global_id helper to generate signed ids inside fixtures.

v0.5.2

Add back Ruby 2.5 support so gem install rails works out of the box, thereby satisfying Rails' Ruby version requirement. See rails/rails#42931

v0.5.1

New: Allow expiration to be turned off globally rails/globalid#128

Fixed: Support for ruby-head rails/globalid#132

Maintainance: Drop support for EOL'ed Rubies (< 2.6.0) and Rails 4.2

Commits

574b99f Bump version for release
4a75ecb Fix ReDoS vulnerability in name parsing
42f5ea6 Prepare for 1.0.0
beab3e4 Prepare to 0.6.0
29e12cb Upgrade all development gems
c894a43 Add devcontainer to allow contributors to have a working environment
b3ec8b9 Move ActiveRecord::FixtureSet.signed_global_id to this gem
e9d6ed9 Merge pull request #137 from rails/dependabot/bundler/nokogiri-1.12.5
a565d31 Bump nokogiri from 1.11.7 to 1.12.5
9b1a4d2 Why u no love me?
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Jan 19, 2023 by dependabot[bot] 0

Open

Bump rails-html-sanitizer from 1.3.0 to 1.4.4

Bumps rails-html-sanitizer from 1.3.0 to 1.4.4.

Release notes

Sourced from rails-html-sanitizer's releases.

1.4.4 / 2022-12-13

Address inefficient regular expression complexity with certain configurations of Rails::Html::Sanitizer.

Fixes CVE-2022-23517. See GHSA-5x79-w82f-gw8w for more information.

Mike Dalessio

Address improper sanitization of data URIs.

Fixes CVE-2022-23518 and #135. See GHSA-mcvf-2q2m-x72m for more information.

Mike Dalessio

Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

Fixes CVE-2022-23520. See GHSA-rrfc-7g8p-99q8 for more information.

Mike Dalessio

Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

Fixes CVE-2022-23519. See GHSA-9h9g-93gc-623h for more information.

Mike Dalessio

1.4.3 / 2022-06-09

Address a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

Prevent the combination of select and style as allowed tags in SafeListSanitizer.

Fixes CVE-2022-32209

Mike Dalessio

1.4.2 / 2021-08-23

Slightly improve performance.

Assuming elements are more common than comments, make one less method call per node.

1.4.1 / 2021-08-18

Fix regression in v1.4.0 that did not pass comment nodes to the scrubber.

Some scrubbers will want to override the default behavior and allow comments, but v1.4.0 only passed through elements to the scrubber's keep_node? method.

... (truncated)

Changelog

Sourced from rails-html-sanitizer's changelog.

1.4.4 / 2022-12-13

Address inefficient regular expression complexity with certain configurations of Rails::Html::Sanitizer.

Fixes CVE-2022-23517. See GHSA-5x79-w82f-gw8w for more information.

Mike Dalessio

Address improper sanitization of data URIs.

Fixes CVE-2022-23518 and #135. See GHSA-mcvf-2q2m-x72m for more information.

Mike Dalessio

Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

Fixes CVE-2022-23520. See GHSA-rrfc-7g8p-99q8 for more information.

Mike Dalessio

Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

Fixes CVE-2022-23519. See GHSA-9h9g-93gc-623h for more information.

Mike Dalessio

1.4.3 / 2022-06-09

Address a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

Prevent the combination of select and style as allowed tags in SafeListSanitizer.

Fixes CVE-2022-32209

Mike Dalessio

1.4.2 / 2021-08-23

Slightly improve performance.

Assuming elements are more common than comments, make one less method call per node.

... (truncated)

Commits

fd63dea version bump to v1.4.4
48ae90a dep: bump dependency on loofah
0713caf fix: escape CDATA nodes using Loofah's escaping methods
e6d52d3 revert 45a5c10
d1223a2 fix: use Loofah's scrub_uri_attribute method
f0e3347 fix: replace slow regex attribute check with Loofah method
df03f2f ci: pin system lib test to 20.04
3e2a0f3 Merge pull request #145 from rails/flavorjones-get-14x-green
11752a6 tests: handle libxml 2.10.0 incorrectly-opened comment parsing
f83f08c version bump to v1.4.3
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Dec 14, 2022 by dependabot[bot] 0

Open

Bump loofah from 2.5.0 to 2.19.1

Bumps loofah from 2.5.0 to 2.19.1.

Release notes

Sourced from loofah's releases.

2.19.1 / 2022-12-13

Security

Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh for more information.

Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx for more information.

Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm for more information.

2.19.0 / 2022-09-14

Features

Allow SVG 1.0 color keyword names in CSS attributes. These colors are part of the CSS Color Module Level 3 recommendation released 2022-01-18. [#243]

2.18.0 / 2022-05-11

Features

Allow CSS property aspect-ratio. [#236] (Thanks, @louim!)

2.17.0 / 2022-04-28

Features

Allow ARIA attributes. [#232, #233] (Thanks, @nick-desteffen!)

2.16.0 / 2022-04-01

Features

Allow MathML elements menclose and ms, and MathML attributes dir, href, lquote, mathsize, notation, and rquote. [#231] (Thanks, @nick-desteffen!)

2.15.0 / 2022-03-14

Features

Expand set of allowed protocols to include sms:. [#228] (Thanks, @brendon!)

2.14.0 / 2022-02-11

Features

The #to_text method on Loofah::HTML::{Document,DocumentFragment} replaces <br> line break elements with a newline. [#225]

... (truncated)

Changelog

Sourced from loofah's changelog.

2.19.1 / 2022-12-13

Security

Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh for more information.

Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx for more information.

Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm for more information.

2.19.0 / 2022-09-14

Features

Allow SVG 1.0 color keyword names in CSS attributes. These colors are part of the CSS Color Module Level 3 recommendation released 2022-01-18. [#243]

2.18.0 / 2022-05-11

Features

Allow CSS property aspect-ratio. [#236] (Thanks, @louim!)

2.17.0 / 2022-04-28

Features

Allow ARIA attributes. [#232, #233] (Thanks, @nick-desteffen!)

2.16.0 / 2022-04-01

Features

Allow MathML elements menclose and ms, and MathML attributes dir, href, lquote, mathsize, notation, and rquote. [#231] (Thanks, @nick-desteffen!)

2.15.0 / 2022-03-14

Features

Expand set of allowed protocols to include sms:. [#228] (Thanks, @brendon!)

2.14.0 / 2022-02-11

Features

The #to_text method on Loofah::HTML::{Document,DocumentFragment} replaces <br> line break elements with a newline. [#225]

... (truncated)

Commits

3f88063 version bump to v2.19.1
9a8dadb docs: preserve the context and decision record
86f7f63 fix: replace recursive approach to cdata with escaping solution
415677f fix: do not allow "image/svg+xml" in data URIs
84ca20c refactor: extract scrub_uri_attribute for downstream use
47a835a ci: pin psych to v4 until v5 builds properly on CI
a6e0a1a fix: replace slow regex attribute check with crass parser
ea853aa Merge pull request #247 from flavorjones/flavorjones-downstream-test-rhs
e1f2a4b ci: test downstream rails-html-sanitizer
79d65a0 Merge pull request #245 from flavorjones/flavorjones-fix-ruby-2.5-ci
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Dec 14, 2022 by dependabot[bot] 0

Open

Bump nokogiri from 1.11.5 to 1.13.9

Bumps nokogiri from 1.11.5 to 1.13.9.

Release notes

Sourced from nokogiri's releases.

1.13.9 / 2022-10-18

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-2309, CVE-2022-40304, and CVE-2022-40303. See GHSA-2qc6-mcvw-92cw for more information.

[CRuby] Vendored zlib is updated to address CVE-2022-37434. Nokogiri was not affected by this vulnerability, but this version of zlib was being flagged up by some vulnerability scanners, see #2626 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.10.3 from v2.9.14.

[CRuby] Vendored libxslt is updated to v1.1.37 from v1.1.35.

[CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

Fixed

[CRuby] Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks, @eightbitraptor and @peterzhu2118!)

[CRuby] Document#remove_namespaces! now defers freeing the underlying xmlNs struct until the Document is GCed. Previously, maintaining a reference to a Namespace object that was removed in this way could lead to a segfault. [#2658]

sha256 checksums:
9b69829561d30c4461ea803baeaf3460e8b145cff7a26ce397119577a4083a02  nokogiri-1.13.9-aarch64-linux.gem
e76ebb4b7b2e02c72b2d1541289f8b0679fb5984867cf199d89b8ef485764956  nokogiri-1.13.9-arm64-darwin.gem
15bae7d08bddeaa898d8e3f558723300137c26a2dc2632a1f89c8574c4467165  nokogiri-1.13.9-java.gem
f6a1dbc7229184357f3129503530af73cc59ceba4932c700a458a561edbe04b9  nokogiri-1.13.9-x64-mingw-ucrt.gem
36d935d799baa4dc488024f71881ff0bc8b172cecdfc54781169c40ec02cbdb3  nokogiri-1.13.9-x64-mingw32.gem
ebaf82aa9a11b8fafb67873d19ee48efb565040f04c898cdce8ca0cd53ff1a12  nokogiri-1.13.9-x86-linux.gem
11789a2a11b28bc028ee111f23311461104d8c4468d5b901ab7536b282504154  nokogiri-1.13.9-x86-mingw32.gem
01830e1646803ff91c0fe94bc768ff40082c6de8cfa563dafd01b3f7d5f9d795  nokogiri-1.13.9-x86_64-darwin.gem
8e93b8adec22958013799c8690d81c2cdf8a90b6f6e8150ab22e11895844d781  nokogiri-1.13.9-x86_64-linux.gem
96f37c1baf0234d3ae54c2c89aef7220d4a8a1b03d2675ff7723565b0a095531  nokogiri-1.13.9.gem
1.13.8 / 2022-07-23

Deprecated

XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2's xmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use #attribute_hash instead. [#2598]

Improvements

XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node from XML::Reader. [#2598, #2599]

Fixed

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.13.9 / 2022-10-18

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-2309, CVE-2022-40304, and CVE-2022-40303. See GHSA-2qc6-mcvw-92cw for more information.

[CRuby] Vendored zlib is updated to address CVE-2022-37434. Nokogiri was not affected by this vulnerability, but this version of zlib was being flagged up by some vulnerability scanners, see #2626 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.10.3 from v2.9.14.

[CRuby] Vendored libxslt is updated to v1.1.37 from v1.1.35.

[CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

Fixed

[CRuby] Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks, @eightbitraptor and @peterzhu2118!)

[CRuby] Document#remove_namespaces! now defers freeing the underlying xmlNs struct until the Document is GCed. Previously, maintaining a reference to a Namespace object that was removed in this way could lead to a segfault. [#2658]

1.13.8 / 2022-07-23

Deprecated

XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2's xmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use #attribute_hash instead. [#2598]

Improvements

XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node from XML::Reader. [#2598, #2599]

Fixed

[CRuby] Calling XML::Reader#attributes is now safe to call. In Nokogiri <= 1.13.7 this method may segfault. [#2598, #2599]

1.13.7 / 2022-07-12

Fixed

XML::Node objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2578] (Thanks, @eightbitraptor!)

1.13.6 / 2022-05-08

Security

[CRuby] Address CVE-2022-29181, improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See GHSA-xh29-r2w5-wx8m for more information.

... (truncated)

Commits

897759c version bump to v1.13.9
aeb1ac3 doc: update CHANGELOG
c663e49 Merge pull request #2671 from sparklemotion/flavorjones-update-zlib-1.2.13_v1...
212e07d ext: hack to cross-compile zlib v1.2.13 on darwin
76dbc8c dep: update zlib to v1.2.13
24e3a9c doc: update CHANGELOG
4db3b4d Merge pull request #2668 from sparklemotion/flavorjones-namespace-scopes-comp...
73d73d6 fix: Document#remove_namespaces! use-after-free bug
5f58b34 fix: namespace nodes behave properly when compacted
b08a858 test: repro namespace_scopes compaction issue
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Oct 20, 2022 by dependabot[bot] 0

Open

Bump tzinfo from 1.2.7 to 1.2.10

Bumps tzinfo from 1.2.7 to 1.2.10.

Release notes

Sourced from tzinfo's releases.

v1.2.10

Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.

Ignore the SECURITY file from Arch Linux's tzdata package. #134.

TZInfo v1.2.10 on RubyGems.org

v1.2.9

Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

TZInfo v1.2.9 on RubyGems.org

v1.2.8

Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.

Rubinius is no longer supported.

TZInfo v1.2.8 on RubyGems.org

Changelog

Sourced from tzinfo's changelog.

Version 1.2.10 - 19-Jul-2022

Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.

Ignore the SECURITY file from Arch Linux's tzdata package. #134.

Version 1.2.9 - 16-Dec-2020

Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

Version 1.2.8 - 8-Nov-2020

Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.

Rubinius is no longer supported.

Commits

0814dcd Fix the release date.
fd05e2a Preparing v1.2.10.
b98c32e Merge branch 'fix-directory-traversal-1.2' into 1.2
ac3ee68 Remove unnecessary escaping of + within regex character classes.
9d49bf9 Fix relative path loading tests.
394c381 Remove private_constant for consistency and compatibility.
5e9f990 Exclude Arch Linux's SECURITY file from the time zone index.
17fc9e1 Workaround for 'Permission denied - NUL' errors with JRuby on Windows.
6bd7a51 Update copyright years.
9905ca9 Fix directory traversal in Timezone.get when using Ruby data source
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened Jul 22, 2022 by dependabot[bot] 0

:art: Winning solution for the Painter by Numbers competition on Kaggle

Winning Solution to the Kaggle Days Paris offline competition

Kaggle Competition, Instance Segmentation

Freesound Audio Tagging 2019

For someone who is new at Kaggle

Kaggle Landmark Recognition 2020 competition: Winner solution

The exact codes used by the team "liveinparis" at the kaggle football competition ranked 8th/1141

The 3rd place solution for competition "Lyft Motion Prediction for Autonomous Vehicles" at Kaggle

Winning solution of the Indoor Location & Navigation Kaggle competition

Code for 15th place in Kaggle Google AI Open Images - Object Detection Track

Official Kaggle API

Jeff Heaton's Kaggle Utilities

Code for 3rd place solution in Kaggle Human Protein Atlas Image Classification Challenge.

Code for 3rd place solution in Kaggle Humpback Whale Identification Challenge.

Machine learning beginner to Kaggle competitor in 30 days.

Pairwise model for commonlit competition

This repository is for Competition for ML_data class. Based on mmsegmentatoin,mainly using swin transformer to completed the competition.

ML.NET is an open source and cross-platform machine learning framework for .NET.

Easy Machine Learning is a general-purpose dataflow-based system for easing the process of applying machine learning algorithms to real world tasks.

Kaggle | Instacart Market Basket Analysis🥕🥉

Kaggle | Web Traffic Forecasting 📈

Share this repo

Related Repos

CMS

265

Haven is a Self-hostable private blogging built with Ruby on Rails

Haven is a simple blog application (formerly called SimpleBlog) built with Ruby on Rails

CMS

386

Wreeto is an open source note-taking, knowledge management and wiki system.

{{ twitter ~ reddit }} Introduction Wreeto is an open source note-taking, knowledge management and wiki system built on top of Ruby on Rails framework. Initially this was built because I didn't like the note-taking

CMS

Kaggle-like machine learning competition platform

This README is still work in progress Machine learning competition platform Machine learning platform just like private Kaggle written in Ruby on Rails framework. Overall Architecture Demo environmen

CMS

1.8k

Self-hosted, super simple photo stream

CMS

1.5k

A free, open source, self-hosted customer feedback tool 🦊

Try the online demo! What is Astuto? Requirements Installation Post-installation notes Contributing What is Astuto? Astuto is a free, open source, self-hosted customer feedback tool. It h

CMS

550

A free open source platform for selling digital downloads such as ebooks

Zipsell Zipsell helps you set up an online store for selling digital products such as ebooks, music, videos, source code etc. Zipsell handles payment processing via stripe and sends customers secure expiring Amazon S3 links to

Popular

CMS

21k

Where programmers share ideas and help each other grow

DEV Community 👩‍💻 👨‍💻 The Human Layer of the Stack Welcome to the dev.to codebase. We are so excited to have you. With your help, we can build out DE

CMS

A mini Social-Network created with Rails!! 💎💎

Rails-Mini-Social-Network A Mini Social-Network created with Rails!! No longer maintained. Another Versions React Version Vue Version Golang Version Quick Links Screenshots Usage Scree

CMS

1.9k

A modern, responsive admin framework for Ruby on Rails

Trestle Demo Site | Demo Source Code A modern, responsive admin framework for Ruby on Rails Getting Started To start using Trestle, first add it to your application's Gemfile: gem 'trestle' Run b

Popular

CMS

43.9k

Your self-hosted, globally interconnected microblogging community

Mastodon Mastodon is a free, open-source social network server. A decentralized solution to commercial platforms, it avoids the risks of a single company monopolizing your communication. Anyone can run Mastodon and partic

Popular

CMS

7.3k

OpenProject is the leading open source project management software.

OpenProject OpenProject is a web-based project management software. Its key features are: Work Package Tracking Project Timelines Wikis Forums Via plugins, it also supports: Meeting Management Scrum Process

CMS

Link aggregation web app similar with Reddit in Ruby on Rails

RoRdit RoRdit is a link aggregation web application like Reddit and Hacker News. It uses number of technologies: Ruby on Rails for the back-end, VueJS for the front-end, PostgreSQL for database management, Elasticsearch for sea

CMS

Thymble is an Ruby on Rails 5 community-based news platform.

Thymble Thymble is a Ruby on Rails 5 community-based news platform. Much like Reddit or Hacker News, users are identified by pseudonyms and all content posted is generated by users. Visit thymble.org for a working demo. Google,

CMS

931

The original wiki rewritten as a single page application

remodeling The original wiki rewritten as a single page application We were closed for one week with the following explaination. We're open now and continuing to improve. http://c2.com/wiki/closed.html process We wi

CMS

2.7k

ComfortableMexicanSofa is a powerful Ruby on Rails 5.2+ CMS (Content Management System) En...

ComfortableMexicanSofa ComfortableMexicanSofa is a powerful Ruby on Rails 5.2+ CMS (Content Management System) Engine Features Simple drop-in integration with Rails 5.2+ apps with minimal configuration CMS

Kaggle-like machine learning competition platform

Machine learning competition platform

Overall Architecture

Demo environment

URL

Demo user account

Sample JSON file for submission

Developer's manual

How to setup development environment

Deploy API server

Setup environment variables.

About METRICS_API_AUTH_KEY

Build docker container with docker-compose

Create User Account

Server URL for development environment

Web API to calculate metrics

License

Changelog

[3.0.3] - 2022-12-07

Fixed

[3.0.2] -2022-12-05

Fixed

[3.0.1] - 2022-11-18

Fixed

[3.0.0] - 2022-09-06

[3.0.0.rc1] - 2022-09-04

SPEC Changes

[3.0.0.beta1] - 2022-08-08

Security

SPEC Changes

1.4.3 / 2022-06-09

1.4.2 / 2021-08-23

1.4.1 / 2021-08-18

1.4.0 / 2021-08-18

1.4.3 / 2022-06-09

1.4.2 / 2021-08-23

1.4.1 / 2021-08-18

1.4.0 / 2021-08-18

1.13.6 / 2022-05-08

Security

Improvements

1.13.5 / 2022-05-04

Security

Dependencies

Improvements

Changed

1.13.6 / 2022-05-08

Security

Improvements

1.13.5 / 2022-05-04

Security

Dependencies

Improvements

Changed

1.13.4 / 2022-04-11

Security

Dependencies

1.13.4 / 2022-04-11

Security

Dependencies

1.13.3 / 2022-02-21

Fixed

1.13.4 / 2022-04-11

Security

Dependencies

1.13.3 / 2022-02-21

Fixed

1.13.2 / 2022-02-21

Security

Dependencies

1.13.1 / 2022-01-13

Fixed

1.13.0 / 2022-01-06

1.13.3 / 2022-02-21

Fixed

1.13.2 / 2022-02-21

Security

Dependencies

1.13.3 / 2022-02-21

Fixed

About `METRICS_API_AUTH_KEY`