sharjeelyunus/github-issues-dataset huggingface dataset:
Repository: create-react-app
Issue: Rethink decision to make react-scripts a dependency instead of a devDependency
Labels: issue: proposal,needs triage

### Is your proposal related to a problem?

<!--
  Provide a clear and concise description of what the problem is.
  For example, "I'm always frustrated when..."
-->

The decision to make react-scripts a dependency causes *a lot* of issues regarding perceived security vulnerabilities. Even though the issues themselves are technically harmless, these issues often break CI/CD flows and/or end up being reported here as actual issues.

### Describe the solution you'd like

<!--
  Provide a clear and concise description of what you want to happen.
-->

The decision to make react-scripts a dependency was in my opinion ill-conceived. There are issues with having react-scrips a devDependency as stated in the original [pull request](https://github.com/facebook/create-react-app/pull/2657):
* The distinction does not make sense. Nonetheless, tools like `npm audit` are dependent on this distinction.
* Apparently some people build on the production server? They shouldn't.
* An actual run-time dependency in the form of a polyfill is included. This could be a separate (and optional?) dependency.
* Eject crashes in some situations (issue #2655)
* Possibly other issues...

In my opinion, a shortcut was taken to work around some problems that should have been fixed separately.

### Describe alternatives you've considered

<!--
  Let us know about other solutions you've tried or researched.
-->

It's possible to move react-scripts to devDependencies by hand, or to eject your React application. Both solve the problem (afaict) but a lot of people are not willing to do this or are unaware of the possibility.

Another possibility would be for the developers to update dependencies whenever a vulnerability pops up as fast as possible, and/or to help developers of dependent package to fix their dependencies. Maybe get Facebook to throw some money behind a React Vulnerability Strike Team (tm) or something.

### Additional context

<!--
  Is there anything else you can add about the proposal?
  You might want to link to related issues here, if you haven't already.
-->

One way or another a solution is needed. Every time some vulnerability pops up I see a lot of frustration in the comments. Even though someone always politely explains the actual security implications, there are always a few people saying (and probably more people thinking) that you don't actually care that much about security. Rationally I know this not to be true, but I get frustrated as well sometimes (I'm only human after all).
Repository: flutter
Issue: Read gifs in Image.network on flutter web will have a lot memory impact in mac Safari  
Labels: engine,c: performance,platform-web,a: images,perf: memory,e: web_canvaskit,a: release,has reproducible steps,browser: safari-macos,P2,found in release: 2.2,team-web,triaged-web

Add fewer gifs use Image network on Safari 14.0.1, the page memory used a lot, go to 3.3gb memory at short time (more and more)
Tested on Chrome and Firefox, which are good.
memory snapshots with 20secs, flutter process name: dashboard.mochar.co:
![截圖 2021-06-14 下午9 07 06](https://user-images.githubusercontent.com/70039/121899436-fff41580-cd56-11eb-8ec4-8c5798262740.png)
![截圖 2021-06-14 下午9 07 25](https://user-images.githubusercontent.com/70039/121899445-02566f80-cd57-11eb-9227-d0775e70d75b.png)


My flutter doctor -v
```
[✓] Flutter (Channel master, 2.3.0-17.0.pre.345, on macOS 11.0.1 20B29
    darwin-x64, locale zh-Hant-TW)
    • Flutter version 2.3.0-17.0.pre.345 at
      /Users/felixchang/development/flutter1.17
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision f1542ace4f (12 hours ago), 2021-06-13 20:59:02 -0400
    • Engine revision ab2c00c771
    • Dart version 2.14.0 (build 2.14.0-208.0.dev)

[!] Android toolchain - develop for Android devices (Android SDK version 29.0.3)
    ✗ cmdline-tools component is missing
      Run `path/to/sdkmanager --install "cmdline-tools;latest"`
      See https://developer.android.com/studio/command-line for more details.
    ✗ Android license status unknown.
      Run `flutter doctor --android-licenses` to accept the SDK licenses.
      See https://flutter.dev/docs/get-started/install/macos#android-setup for
      more details.

[✓] Xcode - develop for iOS and macOS
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Xcode 12.4, Build version 12D4e
    • CocoaPods version 1.10.1

[✓] Chrome - develop for the web
    • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 3.6)
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin version 44.0.2
    • Dart plugin version 192.7761
    • Java version OpenJDK Runtime Environment (build
      1.8.0_212-release-1586-b4-5784211)

[✓] VS Code (version 1.57.0)
    • VS Code at /Applications/Visual Studio Code.app/Contents
    • Flutter extension version 3.23.0

[✓] Connected device (1 available)
    • Chrome (web) • chrome • web-javascript • Google Chrome 91.0.4472.101
```
Repository: vscode
Issue: Custom emmet snippets and issues with template languages
Labels: bug,emmet

<!-- ⚠️⚠️ Do Not Delete This! bug_report_template ⚠️⚠️ -->
<!-- Please read our Rules of Conduct: https://opensource.microsoft.com/codeofconduct/ -->
<!-- 🕮 Read our guide about submitting issues: https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions -->
<!-- 🔎 Search existing issues to avoid creating duplicates. -->
<!-- 🧪 Test using the latest Insiders build to see if your issue has already been fixed: https://code.visualstudio.com/insiders/ -->
<!-- 💡 Instead of creating your report here, use 'Report Issue' from the 'Help' menu in VS Code to pre-fill useful information. -->
<!-- 🔧 Launch with `code --disable-extensions` to check. -->
Does this issue occur when all extensions are disabled?: Yes.

<!-- 🪓 If you answered No above, use 'Help: Start Extension Bisect' from Command Palette to try to identify the cause. -->
<!-- 📣 Issues caused by an extension need to be reported directly to the extension publisher. The 'Help > Report Issue' dialog can assist with this. -->
- VS Code Version: 1.57
- OS Version: win7

Steps to Reproduce:

1. Load up [repro repo](https://github.com/BassOfBass/vscode-emmet-repro).
2. Install recommended extensions.
3. Type `button` in the `index.jinja2`.
4. First issue is it will only show snippets from custom collection, but not the ones coming with VSCode. Although typing `button:s` will still yield `<button type="submit"></button>`, so it seems to be a display issue rather than snippet files override.
5. Also this disables all variations of snippets with `:`. Type `a:` and it won't suggest anything, even though `a:link` will work fine.
6.  Go to `index.pug` and type `button`, it will show the default snippets, which means new snippets don't work. That's because I already had `"jinja-html": "html"` entry in the `"emmet.includeLanguages"` of workspace for jinja, so pug files require another entry.
7. Add `"jade": "html"` there (for whatever reason `"pug": "html"` doesn't work).
8. Emmet suggestion works now, with the same limitation as previously. However, it outputs html syntax instead of pug one.

So the problems are:

- How to view custom emmet snippets alongside default ones?
- How to enable custom emmet snippets in pug?
Repository: vscode
Issue: function "setBreakPointsRequest" in the Debug Adapter is triggered to much
Labels: bug,debug

<!-- ⚠️⚠️ Do Not Delete This! bug_report_template ⚠️⚠️ -->
<!-- Please read our Rules of Conduct: https://opensource.microsoft.com/codeofconduct/ -->
<!-- 🕮 Read our guide about submitting issues: https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions -->
<!-- 🔎 Search existing issues to avoid creating duplicates. -->
<!-- 🧪 Test using the latest Insiders build to see if your issue has already been fixed: https://code.visualstudio.com/insiders/ -->
<!-- 💡 Instead of creating your report here, use 'Report Issue' from the 'Help' menu in VS Code to pre-fill useful information. -->
<!-- 🔧 Launch with `code --disable-extensions` to check. -->
Does this issue occur when all extensions are disabled?: Yes

<!-- 🪓 If you answered No above, use 'Help: Start Extension Bisect' from Command Palette to try to identify the cause. -->
<!-- 📣 Issues caused by an extension need to be reported directly to the extension publisher. The 'Help > Report Issue' dialog can assist with this. -->
- VS Code Version: 1.56.0 (user setup)
- OS Version: Windows 10

Hello,

currently I´m working on a debug adapter extension for microcontrollers (gdb) and I want to remove some breakpoints with the function from the vscode API: "vscode.debug.removeBreakpoints()". If call the function "vscode.debug.removeBreakpoints()" with the current list of breakpoints, it triggers the "setBreakPointsRequest(response: DebugProtocol.SetBreakpointsResponse, args: DebugProtocol.SetBreakpointsArguments) " from the debug adapter as many times as breakpoints in the list. If remove one breakpoint it gets triggered one time, two breakpoints two times and so on. Is that the normal behavior, because I remove every breakpoint every time the "setBreakPointsRequest" is called as in the debug protocol specification specified?

Used debugger: gdb.

Steps to reproduce:
1. read the current list of breakpoints with "vscode.debug.breakpoints"
2. remove the breakpoints with "vscode.debug.removeBreakpoints()"


Screenshot of debug console:
![image](https://user-images.githubusercontent.com/84393343/121908951-c2c75d80-cd2d-11eb-9f91-41fe3fe884af.png)
Repository: node
Issue: Writable does not check if stream has been destroyed during _final and _write
Labels: stream,semver-major,good first issue

Not sure if this is a problem but I think we should at least add a comment in the code that this case has been considered.
Repository: flutter
Issue: TalkBack outline with a FlutterFragment is buggy
Labels: platform-android,engine,a: accessibility,a: existing-apps,has reproducible steps,P2,found in release: 2.2,found in release: 2.3,team-android,triaged-android

## Steps to Reproduce

1. Create an Android App from scratch in Android Studio.
2. Create a new Flutter module.
3. Bind MainActivity to a new FlutterFragment using [Flutter documentation](https://flutter.dev/docs/development/add-to-app/android/add-flutter-fragment#add-a-flutterfragment-to-an-activity-with-a-new-flutterengine).
4. Launch it and activate Talkback.

**Expected results:** 
- The accessibility outline should be inside the Fragment, over the title "Flutter Demo Home Page"
- Navigating through screen with Talkback, the accessibility outline should point to each Widget in the FlutterFragment.

**Actual results:** 
- The accessibility outline is shown behind the Fragment.
- Navigating through screen with Talkback, the accessibility outline points almost the exact position where the Flutter Widget should be.
- To see this more clearly, add some padding to the Fragment, to make it smaller.


Current Flutter version. But I have reproduced this same issue with previous versions.
```
Flutter (Channel stable, 2.0.6, on macOS 11.1 20C69 darwin-x64, locale
    en-GB)
    • Flutter version 2.0.6
    • Framework revision 1d9032c7e1 (7 weeks ago), 2021-04-29 17:37:58 -0700
    • Engine revision 05e680e202
    • Dart version 2.12.3
```

This totally works if instead using a FlutterFragment use a FlutterActivity.
Repository: go
Issue: x/exp/cmd/txtar: expansion of environment variables and writing outside of the current directory seems risky
Labels: help wanted,NeedsFix

The x/exp/cmd/txtar command does not limit the scope of files it might overwrite, which seems risky (e.g., see https://snyk.io/research/zip-slip-vulnerability). Additionally, the expansion of environment variables could make it even easier for attackers to construct malicious files:

```
$ go install golang.org/x/exp/cmd/txtar@latest
$ cat hmm.txt
-- $HOME/.ssh/not_authorized_keys --
hmm
$ txtar -x < hmm.txt
$ cat ~/.ssh/not_authorized_keys
hmm
```

(Being plain text gives a small advantage that it's a bit harder to hide the malicious path, but for sufficiently large txtar files, a user is unlikely to review all of the file paths.)

I'd recommend that x/exp/cmd/txtar default to only writing to files within the current directory. If any resolve outside of the current directory, txtar should exit with an error. (I think exiting without writing any files would be safest, but it seems fine to still write in-scope files if that happens to be easier with txtar's implementation.) A flag can be provided to allow expansion to arbitrary file paths.

I'd also recommend not expanding environment variables by default, instead requiring a flag for that functionality.

/cc @bcmills @rsc @FiloSottile
Repository: rust
Issue: Better documentation of our MIR dialects
Labels: C-enhancement,T-compiler,A-MIR

We like to pretend that MIR is a single language, but that is not actually true. There are at least two different languages represented by MIR; I will call them MIR "dialects" in the following:
* Pre-drop-elaboration MIR: this dialect *implicitly* keeps a drop flag for each local variable. `Move` operands and calling `Drop` sets that flag. The `Drop` and `DropAndReplace` terminators honor that flag and do not call `drop_in_place` when the drop flag indicates this variable has already been moved/dropped.
* Post-drop-elaboration MIR: this dialect has no implicit drop flags, and each `Drop` terminator indicates an unconditional call to `drop_in_place`. (`DropAndReplace` terminators AFAIK cannot exist any more in this dialect.)

The problem with multiple dialects is that they can have different rules for interpreters, code generators, and optimizations, so we need to be careful not to use the wrong optimization with the wrong dialect.

Miri can only interpret the latter dialect. All our optimizations run post-drop-elaboration, so I assume they are all correct only for that second dialect (though some might also be correct for the first one).

I'd like to propose that we treat these dialects more explicitly: a `mir::Body` should indicate which dialect it is written in, such that optimizations, codegen, and Miri can ensure they are working with MIR of the right dialect. This becomes more pressing since https://github.com/rust-lang/rust/pull/86155 is suggesting to add yet another dialect.

Cc @oli-obk -- there is some overlap here with the "phase" in the MIR validator, but I don't think this is entirely the same concept. Different dialects correspond to different phases, but we might have phases within a dialect where certain instructions are being lowered without changing the operational semantics of the language.

Cc @bjorn3 @rust-lang/wg-mir-opt
Repository: flutter
Issue: Support customize typography style.
Labels: framework,a: typography,P3,team-framework,triaged-framework

I would like to support custom typography, to decide on line breaks and size measurements.

![image](https://user-images.githubusercontent.com/11473691/121930067-8408c600-cd74-11eb-94b1-4da646a3e377.png)

code: 

```dart

import 'package:flutter/material.dart';

void main() => runApp(MyApp());

class MyApp extends StatelessWidget {
  static const String _title = 'Flutter Code Sample';

  @override
  Widget build(BuildContext context) {
    var data =
        'Subscribed, tap button to Unsubscribe, if you have any questions, please leave a message here.';
    print(data.length);
    return MaterialApp(
      title: _title,
      home: Scaffold(
        body: Container(
          alignment: Alignment.center,
          color: Colors.lightBlueAccent,
          width: 590,
          child: Center(
            child: ColoredBox(
              color: Colors.redAccent,
              child: Text(data),
            ),
          ),
        ),
      ),
    );
  }
}


```
Repository: kubernetes
Issue: Windows Pod with RunAsUserName and a Projected Volume does not honor file permissions in the volume
Labels: kind/bug,priority/important-soon,sig/windows,lifecycle/frozen,needs-triage

#### What happened:

When a Windows Pod is created with a Projected Volume and `RunAsUserName` set, file permissions are not handled in the projected volume. In addition if a Windows Pod is created with a Projected Volume and `RunAsUser` set, 
```yaml
    securityContext:
      runAsUser: 1000640000
      windowsOptions:
        runAsUserName: ContainerAdministrator
```
the Pod will be stuck at `ContainerCreating`:
```
E0611 17:38:46.666139    2260 atomic_writer.go:404] pod win-webserver/win-webserver-6dd6cd7d9-ng62b volume kube-api-access-62z59: unable to change file c:\var\lib\kubelet\pods\a7bddda2-a355-48cd-8ee2-71776d6de78f\volumes\kubernetes.io~projected\kube-api-access-62z59\..2021_06_11_17_38_46.035861910\token with owner 1000640000: chown c:\var\lib\kubelet\pods\a7bddda2-a355-48cd-8ee2-71776d6de78f\volumes\kubernetes.io~projected\kube-api-access-62z59\..2021_06_11_17_38_46.035861910\token: not supported by windows
E0611 17:38:46.666139    2260 atomic_writer.go:175] pod win-webserver/win-webserver-6dd6cd7d9-ng62b volume kube-api-access-62z59: error writing payload to ts data directory c:\var\lib\kubelet\pods\a7bddda2-a355-48cd-8ee2-71776d6de78f\volumes\kubernetes.io~projected\kube-api-access-62z59\..2021_06_11_17_38_46.035861910: chown c:\var\lib\kubelet\pods\a7bddda2-a355-48cd-8ee2-71776d6de78f\volumes\kubernetes.io~projected\kube-api-access-62z59\..2021_06_11_17_38_46.035861910\token: not supported by windows
```

#### What you expected to happen:

The Pod should go to `Running` with the project volume files having the correct container user ownership.

#### How to reproduce it (as minimally and precisely as possible):

Create a Windows Pod with a Projected Volume and `runAsUserName` set (optionally with runAsUser to cause the stuck at `ContainerCreating` issue).

#### Anything else we need to know?:

The KEP, [proposal for file permission handling in projected service account volume](https://github.com/kubernetes/enhancements/pull/1598) and its [implementation](https://github.com/kubernetes/kubernetes/commit/3db7275b549559696c42c0b5f51c9a2397e9571d) did not take Windows in to account. An [os.Chown()](https://github.com/kubernetes/kubernetes/commit/3db7275b549559696c42c0b5f51c9a2397e9571d#diff-f4218ebfe0ced84087844da9d87b126752414e347e727c0455687d69e8e3d912R403) was introduced which is not supported on Windows. In addition `RunAsUserName` being set on Windows Pods was not taken into account.


#### Environment:
- Kubernetes version (use `kubectl version`): 1.21.1
- Cloud provider or hardware configuration: AWS / Azure 
- OS: Windows Server 2019 1809
- Kernel:
Repository: flutter
Issue: Devicelab test harnesses should automatically symbolize native crashes
Labels: a: tests,team,team-infra,P2,triaged-infra

/cc @keyonghan @godofredoc 

We're grabbing more logs now, but we print out unsymbolized stack traces. It'd be great to just grab the symbols as part of setup or the test and symbolize the logs automatically.
Repository: rust
Issue: Recover from `|` -> `=>` typo
Labels: C-enhancement,A-diagnostics,A-parser,P-low,T-compiler,D-papercut

It is not uncommon when reworking `match` arms or adding a new variant to have in-progress code that looks like

```rust
match foo {
    Enum::Variant1(x) => {
    Enum::Variant1(x) => {
    }
    _ => {}
}
```

by copying the existing line when trying to get to 

```rust
match foo {
    Enum::Variant2(x) |
    Enum::Variant1(x) => {
    }
    _ => {}
}
```

The parser could detect cases like these and avoid further parse errors after this point.
Repository: vscode
Issue: NotebookCellData.mime
Labels: feature-request,api,api-proposal

## Problem

The notebooks api has the concept of markup cells. The intent is that these cells are rendered as html by default, unlike code cells which are displayed as editors by default with their rendered output below them.

Currently we only support markdown markup cells. However we'd also like to support other markup languages, including ones that an extension may invent. However there's currently no way to set the mime type of a markup cell, which is needed for a custom renderer to be able to support it

## Proposal
Add a new `NotebookCellData.mime` field. If not explicitly provided, this would default to `text/plain` (or `text/markdown` it the cell's `language` is `markdown`)

The `mime` field would only be used when rendering the cell. The existing `language` field would still be used to determine which type of editor to display for the cell
Repository: material-ui
Issue: [SliderUnstyled] TypeError Cannot read property 'getBoundingClientRect' of null
Labels: bug 🐛,component: slider

When using controlled sliders, while interacting with them, I continuously get errors on this line:
https://github.com/mui-org/material-ui/blob/2d4d0663ff1ed732e6952705d0e23eda13ae25ea/packages/material-ui-unstyled/src/SliderUnstyled/SliderUnstyled.js#L384

Due to this call:
https://github.com/mui-org/material-ui/blob/2d4d0663ff1ed732e6952705d0e23eda13ae25ea/packages/material-ui-unstyled/src/SliderUnstyled/SliderUnstyled.js#L460

It seems to be related to the slider being unmounted while event callbacks related to the notch being dragged are still triggered, for example in a Tooltip:
https://codesandbox.io/s/unstyledslider-material-demo-forked-7yzjd?file=/demo.js
![Screen Shot 2021-06-14 at 3 03 37 PM](https://user-images.githubusercontent.com/6577822/121945579-eb495a80-cd21-11eb-9286-f8d901dc0e30.png)
I hold the notch, slide it three or four times, and suddenly move the cursor away while still holding the notch, forcing the tooltip to close, and after some tries, it throws the error:
![Screen Shot 2021-06-14 at 3 04 09 PM](https://user-images.githubusercontent.com/6577822/121945590-ee444b00-cd21-11eb-93ca-6f5743346d20.png)
Repository: vscode
Issue: Workspace Trust - Declared Untrusted Folders
Labels: feature-request,workspace-trust

<!-- ⚠️⚠️ Do Not Delete This! feature_request_template ⚠️⚠️ -->
<!-- Please read our Rules of Conduct: https://opensource.microsoft.com/codeofconduct/ -->
<!-- Please search existing issues to avoid creating duplicates. -->

<!-- Describe the feature you'd like. -->
Personally speaking when I'm working in folder workspaces or cloning repositories to open, I trust what I'm working with, however when dealing with items I don't trust, I typically sandbox them to their own folders or open them from zip files instead.

The workspace trust feature is handy, however with this workflow it tends to become a hindrance as everything I open *is* trusted except for a select set. Would it be possible to configure a set of locations (or partial locations via wildcard) to *not* trust and trust everything else? (Or just trust specific folders)

Ideally, folders declared as always untrusted would automatically be loaded into restricted mode by default, even if a user marks the file as trusted, it would return to untrusted on the next launch.

Hope this can be considered!
Repository: flutter
Issue: "Jump to Source" does not work for integration tests
Labels: a: tests,c: new feature,framework,c: proposal,f: integration_test,P3,team-framework,triaged-framework

*@stevemessick commented on May 28, 2021, 4:11 PM UTC:*

Run an integration test then double-click its name in the `Run` tool window. The editor should display the source code for the test (which works for unit tests). It shows `widget_test.dart` instead.

*This issue was moved by [stevemessick](https://github.com/stevemessick) from [flutter/flutter-intellij#5525](https://github.com/flutter/flutter-intellij/issues/5525).*
Repository: create-react-app
Issue: import-plugin-helpers
Labels: stale,needs triage

it is possible to enable the configuration of eslint-plugin-import-helpers in a project created with CRA. If it's possible how can I make these changes.