helloadhavan/github_issues huggingface dataset:
Repository: vercel/next.js
Pull request: Turbopack: document ModuleSideEffects better

<!-- Thanks for opening a PR! Your contribution is much appreciated.
To make sure your PR is handled as smoothly as possible we request that you follow the checklist sections below.
Choose the right checklist for the change(s) that you're making:

## For Contributors

### Improving Documentation

- Run `pnpm prettier-fix` to fix formatting issues before opening the PR.
- Read the Docs Contribution Guide to ensure your contribution follows the docs guidelines: https://nextjs.org/docs/community/contribution-guide

### Fixing a bug

- Related issues linked using `fixes #number`
- Tests added. See: https://github.com/vercel/next.js/blob/canary/contributing/core/testing.md#writing-tests-for-nextjs
- Errors have a helpful link attached, see https://github.com/vercel/next.js/blob/canary/contributing.md

### Adding a feature

- Implements an existing feature request or RFC. Make sure the feature request has been accepted for implementation before opening a PR. (A discussion must be opened, see https://github.com/vercel/next.js/discussions/new?category=ideas)
- Related issues/discussions are linked using `fixes #number`
- e2e tests added (https://github.com/vercel/next.js/blob/canary/contributing/core/testing.md#writing-tests-for-nextjs)
- Documentation added
- Telemetry added. In case of a feature if it's used or not.
- Errors have a helpful link attached, see https://github.com/vercel/next.js/blob/canary/contributing.md


## For Maintainers

- Minimal description (aim for explaining to someone not on the team to understand the PR)
- When linking to a Slack thread, you might want to share details of the conclusion
- Link both the Linear (Fixes NEXT-xxx) and the GitHub issues
- Add review comments if necessary to explain to the reviewer the logic behind a change

### What?

### Why?

### How?

Closes NEXT-
Fixes #

-->


Changed files:
filename: turbopack/crates/turbopack-core/src/module.rs
patch: @@ -15,11 +15,17 @@ pub enum StyleType {
 pub enum ModuleSideEffects {
     /// Analysis determined that the module evaluation is side effect free
     /// the module may still be side effectful based on its imports.
+    ///
+    /// This module might not be chunked after Turbopack performed a global analysis on the module
+    /// graph.
     ModuleEvaluationIsSideEffectFree,
     /// Is known to be side effect free either due to static analysis or some kind of configuration.
     /// ```js
     /// "use turbopack no side effects"
     /// ```
+    ///
+    /// This module might not even be parsed (and thus chunked) if no other module depends on any of
+    /// its exports.
     SideEffectFree,
     // Neither of the above, so we should assume it has side effects.
     SideEffectful,
Repository: facebook/react
Pull request: [Fizz] Include unit of threshold in rel=expect deopt error

We display kilobytes.

Changed files:
filename: packages/react-dom/src/__tests__/ReactDOMFizzServerEdge-test.js
patch: @@ -138,7 +138,7 @@ describe('ReactDOMFizzServerEdge', () => {
     if (gate(flags => flags.enableFizzBlockingRender)) {
       expect(errors.length).toBe(1);
       expect(errors[0].message).toContain(
-        'This rendered a large document (>512) without any Suspense boundaries around most of it.',
+        'This rendered a large document (>512 kB) without any Suspense boundaries around most of it.',
       );
     } else {
       expect(errors.length).toBe(0);

filename: packages/react-server/src/ReactFizzServer.js
patch: @@ -5946,7 +5946,7 @@ function flushCompletedQueues(
           const error = new Error(
             'This rendered a large document (>' +
               maxSizeKb +
-              ') without any Suspense ' +
+              ' kB) without any Suspense ' +
               'boundaries around most of it. That can delay initial paint longer than ' +
               'necessary. To improve load performance, add a <Suspense> or <SuspenseList> ' +
               'around the content you expect to be below the header or below the fold. ' +

filename: scripts/error-codes/codes.json
patch: @@ -546,5 +546,5 @@
   "558": "Client rendering an Activity suspended it again. This is a bug in React.",
   "559": "Expected to find a host node. This is a bug in React.",
   "560": "Cannot use a startGestureTransition() with a comment node root.",
-  "561": "This rendered a large document (>%s) without any Suspense boundaries around most of it. That can delay initial paint longer than necessary. To improve load performance, add a <Suspense> or <SuspenseList> around the content you expect to be below the header or below the fold. In the meantime, the content will deopt to paint arbitrary incomplete pieces of HTML."
+  "561": "This rendered a large document (>%s kB) without any Suspense boundaries around most of it. That can delay initial paint longer than necessary. To improve load performance, add a <Suspense> or <SuspenseList> around the content you expect to be below the header or below the fold. In the meantime, the content will deopt to paint arbitrary incomplete pieces of HTML."
 }
Repository: huggingface/transformers
Pull request: AutoTokenizer ignores config when model_type is None

when the model_type isn't in `TOKENIZER_MAPPING_NAMES` (ex. "llama"), `TOKENIZER_MAPPING_NAMES.get("llama", "")` -->  "". Then we compare `"" != "LlamaTokenizer"`  (the `tokenizer_class` in `tokenizer_config.json`). Since that's true we early exit and fallback to `TokenizerBackend`

Changed files:
filename: src/transformers/models/auto/tokenization_auto.py
patch: @@ -649,7 +649,8 @@ def from_pretrained(
             and tokenizer_config_class is not None
             and config_model_type is not None
             and config_model_type != ""
-            and TOKENIZER_MAPPING_NAMES.get(config_model_type, "").replace("Fast", "")
+            and TOKENIZER_MAPPING_NAMES.get(config_model_type) is not None
+            and TOKENIZER_MAPPING_NAMES.get(config_model_type).replace("Fast", "")
             != tokenizer_config_class.replace("Fast", "")
         ):
             # new model, but we ignore it unless the model type is the same

filename: tests/models/aria/test_processing_aria.py
patch: @@ -149,7 +149,7 @@ def test_process_interleaved_images_prompts_no_image_splitting(self):
         # Pad the first input to match the second input
         pad_len = len(expected_input_ids_2) - len(expected_input_ids_1)
 
-        expected_attention_mask = [ [1] * len(expected_input_ids_1) + [0] * pad_len, [1] * (len(expected_input_ids_2))]
+        expected_attention_mask = [ [0] * pad_len + [1] * len(expected_input_ids_1), [1] * (len(expected_input_ids_2))]
 
         self.assertEqual(
             inputs["attention_mask"],

filename: tests/models/auto/test_tokenization_auto.py
patch: @@ -621,15 +621,9 @@ def test_tokenization_class_priority(self):
             tok2 = AutoTokenizer.from_pretrained(tmp_dir)
             self.assertTrue(tok2.__class__ == HerbertTokenizer)
 
-        tok = AutoTokenizer.from_pretrained("HuggingFaceTB/SmolLM2-135M-Instruct")
-        self.assertTrue(tok.__class__ == TokenizersBackend)
-
         tok = AutoProcessor.from_pretrained("mistralai/Ministral-3-8B-Instruct-2512-BF16").tokenizer
         self.assertTrue(tok.__class__ == TokenizersBackend)
 
-        tok = AutoTokenizer.from_pretrained("HuggingFaceTB/SmolLM2-135M-Instruct")
-        self.assertTrue(tok.__class__ == TokenizersBackend)
-
     def test_custom_tokenizer_with_mismatched_tokenizer_class(self):
         nop_tokenizer_code = """
 import transformers
Repository: ollama/ollama
Pull request: ollamarunner: Suppress stack trace during memory allocation

Allocation failures can be a normal part of new memory estimates, so we shouldn't print a stack trace in this case.

Changed files:
filename: runner/ollamarunner/runner.go
patch: @@ -18,7 +18,6 @@ import (
 	"reflect"
 	"regexp"
 	"runtime"
-	"runtime/debug"
 	"strconv"
 	"strings"
 	"sync"
@@ -1101,9 +1100,13 @@ func (s *Server) allocModel(
 	// Convert memory allocation panics to errors
 	defer func() {
 		if r := recover(); r != nil {
-			debug.PrintStack()
 			if err, ok := r.(error); ok {
-				panicErr = err
+				var noMem ml.ErrNoMem
+				if errors.As(err, &noMem) {
+					panicErr = noMem
+				} else {
+					panic(r)
+				}
 			} else {
 				panic(r)
 			}
Repository: ggml-org/llama.cpp
Pull request: sync : ggml


Changed files:
filename: scripts/sync-ggml.last
patch: @@ -1 +1 @@
-a04eea0761a85d18f3f504d6ab970c5c9dce705f
+50634c28837c24ac68b380b5750b41e701c87d73
Repository: rust-lang/rust
Pull request: ci: add runners for vanilla LLVM 22

Ubuntu 26.04 has `llvm-22` packages that we can test with.
The `Dockerfile` is otherwise the same as the `llvm-21` runners.


Changed files:
filename: src/ci/docker/host-x86_64/x86_64-gnu-llvm-22/Dockerfile
patch: @@ -0,0 +1,66 @@
+FROM ubuntu:26.04
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  bzip2 \
+  g++ \
+  gcc-multilib \
+  make \
+  ninja-build \
+  file \
+  curl \
+  ca-certificates \
+  python3 \
+  git \
+  cmake \
+  sudo \
+  gdb \
+  llvm-22-tools \
+  llvm-22-dev \
+  libedit-dev \
+  libssl-dev \
+  pkg-config \
+  zlib1g-dev \
+  xz-utils \
+  nodejs \
+  mingw-w64 \
+  # libgccjit dependencies
+  flex \
+  libmpfr-dev \
+  libgmp-dev \
+  libmpc3 \
+  libmpc-dev \
+  && rm -rf /var/lib/apt/lists/*
+
+# Install powershell (universal package) so we can test x.ps1 on Linux
+# FIXME: need a "universal" version that supports libicu74, but for now it still works to ignore that dep.
+RUN curl -sL "https://github.com/PowerShell/PowerShell/releases/download/v7.3.1/powershell_7.3.1-1.deb_amd64.deb" > powershell.deb && \
+    dpkg --ignore-depends=libicu72 -i powershell.deb && \
+    rm -f powershell.deb
+
+COPY scripts/sccache.sh /scripts/
+RUN sh /scripts/sccache.sh
+
+# We are disabling CI LLVM since this builder is intentionally using a host
+# LLVM, rather than the typical src/llvm-project LLVM.
+ENV NO_DOWNLOAD_CI_LLVM 1
+ENV EXTERNAL_LLVM 1
+
+# Using llvm-link-shared due to libffi issues -- see #34486
+ENV RUST_CONFIGURE_ARGS \
+      --build=x86_64-unknown-linux-gnu \
+      --llvm-root=/usr/lib/llvm-22 \
+      --enable-llvm-link-shared \
+      --set rust.randomize-layout=true \
+      --set rust.thin-lto-import-instr-limit=10
+
+COPY scripts/shared.sh /scripts/
+
+COPY scripts/x86_64-gnu-llvm.sh /scripts/
+COPY scripts/x86_64-gnu-llvm2.sh /scripts/
+COPY scripts/x86_64-gnu-llvm3.sh /scripts/
+COPY scripts/stage_2_test_set1.sh /scripts/
+COPY scripts/stage_2_test_set2.sh /scripts/
+
+ENV SCRIPT "Must specify DOCKER_SCRIPT for this image"

filename: src/ci/github-actions/jobs.yml
patch: @@ -406,6 +406,31 @@ auto:
       DOCKER_SCRIPT: x86_64-gnu-llvm3.sh
     <<: *job-linux-4c
 
+  # The x86_64-gnu-llvm-22 job is split into multiple jobs to run tests in parallel.
+  # x86_64-gnu-llvm-22-1 skips tests that run in x86_64-gnu-llvm-22-{2,3}.
+  - name: x86_64-gnu-llvm-22-1
+    env:
+      RUST_BACKTRACE: 1
+      IMAGE: x86_64-gnu-llvm-22
+      DOCKER_SCRIPT: stage_2_test_set2.sh
+    <<: *job-linux-4c
+
+  # Skip tests that run in x86_64-gnu-llvm-22-{1,3}
+  - name: x86_64-gnu-llvm-22-2
+    env:
+      RUST_BACKTRACE: 1
+      IMAGE: x86_64-gnu-llvm-22
+      DOCKER_SCRIPT: x86_64-gnu-llvm2.sh
+    <<: *job-linux-4c
+
+  # Skip tests that run in x86_64-gnu-llvm-22-{1,2}
+  - name: x86_64-gnu-llvm-22-3
+    env:
+      RUST_BACKTRACE: 1
+      IMAGE: x86_64-gnu-llvm-22
+      DOCKER_SCRIPT: x86_64-gnu-llvm3.sh
+    <<: *job-linux-4c
+
   - name: x86_64-gnu-nopt
     <<: *job-linux-4c
Repository: ollama/ollama
Pull request: llm: Don't try to load split vision models in the Ollama engine

If a model with a split vision projector is loaded in the Ollama engine, the projector will be ignored and the model will hallucinate a response. Instead, fallback and try to load the model in the llama engine.

Changed files:
filename: llm/server.go
patch: @@ -149,7 +149,11 @@ func NewLlamaServer(gpus discover.GpuInfoList, modelPath string, f *ggml.GGML, a
 	var textProcessor model.TextProcessor
 	var err error
 	if envconfig.NewEngine() || f.KV().OllamaEngineRequired() {
-		textProcessor, err = model.NewTextProcessor(modelPath)
+		if len(projectors) == 0 {
+			textProcessor, err = model.NewTextProcessor(modelPath)
+		} else {
+			err = errors.New("split vision models aren't supported")
+		}
 		if err != nil {
 			// To prepare for opt-out mode, instead of treating this as an error, we fallback to the old runner
 			slog.Debug("model not yet supported by Ollama engine, switching to compatibility mode", "model", modelPath, "error", err)
Repository: vercel/next.js
Pull request: fix: use Buffer.indexOf in uint8array helpers for faster byte scanning (3/8)

## Summary

Use `Buffer.indexOf` when available in `uint8array-helpers.ts` for faster byte sequence scanning. Falls back to the existing manual loop on non-Node environments.

## Test plan

- [x] `pnpm test-unit test/unit/stream-utils/uint8array-helpers.test.ts` passes

Changed files:
filename: packages/next/src/server/stream-utils/uint8array-helpers.ts
patch: @@ -5,6 +5,14 @@ export function indexOfUint8Array(a: Uint8Array, b: Uint8Array) {
   if (b.length === 0) return 0
   if (a.length === 0 || b.length > a.length) return -1
 
+  // Use Node's native implementation when available.
+  if (typeof Buffer !== 'undefined') {
+    const haystack = Buffer.isBuffer(a)
+      ? a
+      : Buffer.from(a.buffer, a.byteOffset, a.byteLength)
+    return haystack.indexOf(b)
+  }
+
   // start iterating through `a`
   for (let i = 0; i <= a.length - b.length; i++) {
     let completeMatch = true
@@ -50,8 +58,8 @@ export function removeFromUint8Array(a: Uint8Array, b: Uint8Array) {
   if (tagIndex === 0) return a.subarray(b.length)
   if (tagIndex > -1) {
     const removed = new Uint8Array(a.length - b.length)
-    removed.set(a.slice(0, tagIndex))
-    removed.set(a.slice(tagIndex + b.length), tagIndex)
+    removed.set(a.subarray(0, tagIndex))
+    removed.set(a.subarray(tagIndex + b.length), tagIndex)
     return removed
   } else {
     return a

filename: test/unit/stream-utils/uint8array-helpers.test.ts
patch: @@ -0,0 +1,42 @@
+import {
+  indexOfUint8Array,
+  isEquivalentUint8Arrays,
+  removeFromUint8Array,
+} from 'next/dist/server/stream-utils/uint8array-helpers'
+
+describe('uint8array-helpers', () => {
+  it('finds the start index of a nested sequence', () => {
+    const haystack = new Uint8Array([1, 2, 3, 4, 5, 6])
+    const needle = new Uint8Array([3, 4, 5])
+    expect(indexOfUint8Array(haystack, needle)).toBe(2)
+  })
+
+  it('handles Buffer input as Uint8Array', () => {
+    const haystack = Buffer.from([9, 8, 7, 6, 5, 4])
+    const needle = new Uint8Array([7, 6])
+    expect(indexOfUint8Array(haystack, needle)).toBe(2)
+  })
+
+  it('returns -1 when not found', () => {
+    const haystack = new Uint8Array([1, 2, 3, 4])
+    const needle = new Uint8Array([4, 5])
+    expect(indexOfUint8Array(haystack, needle)).toBe(-1)
+  })
+
+  it('removes a matching sequence from the middle', () => {
+    const haystack = new Uint8Array([10, 20, 30, 40, 50])
+    const needle = new Uint8Array([30, 40])
+
+    const result = removeFromUint8Array(haystack, needle)
+
+    expect(isEquivalentUint8Arrays(result, new Uint8Array([10, 20, 50]))).toBe(
+      true
+    )
+  })
+
+  it('returns original reference when no match exists', () => {
+    const haystack = new Uint8Array([1, 2, 3])
+    const needle = new Uint8Array([4, 5])
+    expect(removeFromUint8Array(haystack, needle)).toBe(haystack)
+  })
+})
Repository: ollama/ollama
Pull request: llm: Enable new memory estimates by default

New memory estimates (see #11090 for more information) are now enabled automatically for all models running on the Ollama engine, improving both stability and performance through more accurate sizing and allocation. Models running on the llama engine will continue to use the original style of memory estimation.

Changed files:
filename: envconfig/config.go
patch: @@ -185,8 +185,6 @@ var (
 	ContextLength = Uint("OLLAMA_CONTEXT_LENGTH", 4096)
 	// Auth enables authentication between the Ollama client and server
 	UseAuth = Bool("OLLAMA_AUTH")
-	// Enable the new memory estimation logic
-	NewMemoryEstimates = Bool("OLLAMA_NEW_ESTIMATES")
 )
 
 func String(s string) func() string {
@@ -272,7 +270,6 @@ func AsMap() map[string]EnvVar {
 		"OLLAMA_MULTIUSER_CACHE":   {"OLLAMA_MULTIUSER_CACHE", MultiUserCache(), "Optimize prompt caching for multi-user scenarios"},
 		"OLLAMA_CONTEXT_LENGTH":    {"OLLAMA_CONTEXT_LENGTH", ContextLength(), "Context length to use unless otherwise specified (default: 4096)"},
 		"OLLAMA_NEW_ENGINE":        {"OLLAMA_NEW_ENGINE", NewEngine(), "Enable the new Ollama engine"},
-		"OLLAMA_NEW_ESTIMATES":     {"OLLAMA_NEW_ESTIMATES", NewMemoryEstimates(), "Enable the new memory estimation logic"},
 
 		// Informational
 		"HTTP_PROXY":  {"HTTP_PROXY", String("HTTP_PROXY")(), "HTTP proxy"},

filename: llm/server.go
patch: @@ -162,11 +162,6 @@ func NewLlamaServer(gpus discover.GpuInfoList, modelPath string, f *ggml.GGML, a
 		}
 	}
 
-	newEstimates := textProcessor != nil && envconfig.NewMemoryEstimates()
-	if newEstimates {
-		slog.Info("enabling new memory estimates")
-	}
-
 	// Verify the requested context size is <= the model training size
 	trainCtx := f.KV().ContextLength()
 	if opts.NumCtx > int(trainCtx) && trainCtx > 0 {
@@ -434,7 +429,7 @@ func NewLlamaServer(gpus discover.GpuInfoList, modelPath string, f *ggml.GGML, a
 			}
 		}()
 
-		if newEstimates {
+		if textProcessor != nil {
 			return &ollamaServer{llmServer: s}, nil
 		} else {
 			return &llamaServer{llmServer: s, ggml: f}, nil
Repository: nodejs/node
Pull request: doc: clarify build environment is trusted in threat model

## Summary

- Add build system attacks to the "Examples of non-vulnerabilities" section in SECURITY.md
- Clarify that the build environment (environment variables, filesystem, locally installed tools) is a trusted element
- Command injection via env vars in build scripts (`CC`, `CXX`, `PKG_CONFIG`, `RUSTC`), path hijacking in build output directories, and file permissions of build artifacts are not considered vulnerabilities

This addresses a recurring class of HackerOne reports that claim vulnerabilities in `configure.py` or other build scripts by manipulating environment variables or the local filesystem. These scenarios require the attacker to already control the build environment, which is a trusted element per the existing threat model.

Changed files:
filename: SECURITY.md
patch: @@ -335,6 +335,21 @@ the community they pose.
   proper security boundaries between trusted application logic and untrusted
   user input.
 
+#### Build System Attacks Requiring Control of the Build Environment (CWE-78, CWE-114, CWE-276)
+
+* The Node.js build system (e.g., `configure`, `configure.py`, `Makefile`,
+  `vcbuild.bat`) is designed to run in a trusted build environment.
+  The build environment, including environment variables, the file system,
+  and locally installed tools, is a trusted element in the Node.js threat model.
+* Reports about command injection via environment variables in build scripts
+  (e.g., `CC`, `CXX`, `PKG_CONFIG`, `RUSTC`), path hijacking in build output
+  directories, or file permissions of build artifacts are **not** considered
+  vulnerabilities. These scenarios require the attacker to already have control
+  over the build environment, which means the system is already compromised.
+* Build scripts are not a security boundary. They are expected to execute
+  tools and scripts specified by the environment, and to trust the
+  file system they operate on.
+
 #### Unhandled 'error' Events on EventEmitters (CWE-248)
 
 * EventEmitters that can emit `'error'` events require the application to
Repository: ollama/ollama
Pull request: Flash attention & KV cache quantization validation fixes

Our validation checks for flash attention and KV cache quantization currently enable models that aren't supported and also create spurious warnings.

Changed files:
filename: fs/ggml/ggml.go
patch: @@ -883,6 +883,10 @@ func (f GGML) SupportsFlashAttention() bool {
 		return false
 	}
 
+	if arch := f.KV().Architecture(); slices.Contains([]string{"gemma2"}, arch) {
+		return false
+	}
+
 	// Check head counts match and are non-zero
 	headCountK := f.KV().EmbeddingHeadCountK()
 	headCountV := f.KV().EmbeddingHeadCountV()
Repository: electron/electron
Pull request: fix: uaf in non-client hittest during view teardown

Backport of #50042

See that PR for details.


Notes: fix shutdown crash on windows when hidden titlebar is enabled

Changed files:
filename: shell/browser/api/electron_api_web_contents_view.cc
patch: @@ -83,13 +83,17 @@ void WebContentsView::ApplyBorderRadius() {
 
 int WebContentsView::NonClientHitTest(const gfx::Point& point) {
   if (api_web_contents_) {
+    auto* iwc = api_web_contents_->inspectable_web_contents();
+    if (!iwc)
+      return HTNOWHERE;
     // Convert the point to the contents view's coordinate space rather than
     // the InspectableWebContentsView's coordinate space, because the draggable
     // region is relative to the web content area. When DevTools is docked
     // (e.g. to the left), the contents view is offset within the parent,
     // so we need to account for that offset.
-    auto* inspectable_view =
-        api_web_contents_->inspectable_web_contents()->GetView();
+    auto* inspectable_view = iwc->GetView();
+    if (!inspectable_view)
+      return HTNOWHERE;
     auto* contents_view = inspectable_view->GetContentsView();
     gfx::Point local_point(point);
     views::View::ConvertPointFromWidget(contents_view, &local_point);

filename: shell/browser/ui/inspectable_web_contents.cc
patch: @@ -343,6 +343,10 @@ InspectableWebContents::InspectableWebContents(
 }
 
 InspectableWebContents::~InspectableWebContents() {
+  // Explicitly destroy the view first to ensure that any callbacks triggered
+  // during view teardown (like NonClientHitTest) does not access a
+  // partially-destroyed view.
+  view_.reset();
   // Unsubscribe from devtools and Clean up resources.
   if (GetDevToolsWebContents())
     WebContentsDestroyed();

filename: spec/fixtures/crash-cases/frameless-windows-close/index.js
patch: @@ -0,0 +1,26 @@
+const { app, BrowserWindow } = require('electron');
+
+if (process.platform !== 'win32') {
+  process.exit(0);
+}
+
+app.on('window-all-closed', () => {
+  app.quit();
+});
+
+app.whenReady().then(() => {
+  let win = new BrowserWindow({
+    frame: false,
+    show: true
+  });
+
+  win.loadURL('about:blank');
+
+  setTimeout(() => {
+    win.close();
+  }, 5000);
+
+  win.on('closed', () => {
+    win = null;
+  });
+});