vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can use a toolchain secret reference for this parameter. For more information about secret references, see [Protecting your sensitive data in Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_secure_credentials). 
 secret_filter optional, updatable String secret_filter A regular expression to filter the list of secret names that are returned from your HashiCorp Vault instance. 
 secret_id optional, updatable Password secret_id The authentication secret ID for your HashiCorp Vault instance when you use the approle authentication method. This parameter is ignored for other authentication methods. You can use a toolchain secret reference for this parameter. For more information about secret references, see [Protecting your sensitive data in Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_secure_credentials). 
 server_url required, updatable String server_url The server URL for your HashiCorp Vault instance. 
 token optional, updatable Password token The authentication token for your HashiCorp Vault instance when you use the github and token authentication methods. This parameter is ignored for other authentication methods. You can use a toolchain secret reference for this parameter. For more information about secret references, see [Protecting your sensitive data in Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_secure_credentials). 
 username optional, updatable String username The authentication username for your HashiCorp Vault instance when you use the userpass authentication method. This parameter is ignored for other authentication methods. 







 Learn more about HashiCorp Vault 

To learn more about HashiCorp Vault, see [HashiCorp Vault](https://www.vaultproject.io/).
For more information about using the custom resource to install models, see [Installing Watson Speech to Text](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=text-installing-watson-speech).

Security vulnerabilities addressed
: The following security vulnerabilities associated with Apache Log4j have been fixed:



* [Security Bulletin: Vulnerability in Apache Log4j may affect IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-4104)](https://www.ibm.com/support/pages/node/6551170)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)](https://www.ibm.com/support/pages/node/6551168)







 20 December 2021 (Version 4.0.4) 

Version 4.0.4 is now available
: Speech to Text for IBM Cloud Pak for Data version 4.0.4 is now available. This version supports IBM Cloud Pak for Data version 4.x and Red Hat OpenShift versions 4.6 and 4.8. For more information about installing and managing the service, see [Installing Watson Speech to Text](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=text-installing-watson-speech).

Important: Changes to properties for disabling the storage and logging of user data
: Important: The names of the properties of the Speech services custom resource that specify whether user data is stored and logged have changed. The custom resource formerly contained the following properties:


 Anonymize logs

sttRuntime:
anonymizeLogs: "false" If true, disables storage and logging of user data
sttAMPatcher:
anonymizeLogs: "false" If true, disables storage and logging of user data
ttsRuntime:
For example, if you specify purple unicorn in the Secret field, you might add code similar to this:

const jwt = require('jsonwebtoken');
...
const token = request.headers.authentication; // grab the "Authentication" header
try {
const decoded = jwt.verify(token, 'purple unicorn');
} catch(err) {
// error thrown if token is invalid
}





 Webhook request body 

The request body the webhook sends to the external service is a JSON object with the following structure:

{
"event": {
"name": "{event_type}"
},
"payload": {
...
}
}

where {event_type} is either message_logged (for messages and responses) or cdr_logged (for CDR events).

The payload object contains the event data to be logged. The structure of the payload object depends on the type of event.



 Message event payload 

For message_logged events, the payload object contains data about a message request sent to the assistant and the message response returned to the integration or client application. For more information about the fields that are part of message requests and responses, see the [API reference](https://cloud.ibm.com/apidocs/assistant/assistant-v2message).

The log webhook payload might include data that is not currently supported by the API. Any fields that are not defined in the API reference documentation are subject to change.





 CDR event payload 

For cdr_logged events, the payload object contains data about a Call Detail Record (CDR) event that was handled by the phone integration. The structure of the payload object for a CDR event is as shown by this example:

{
"primary_phone_number": "+18005550123",
"global_session_id": "9caa8bad-aaa8-4a5a-a4b5-62bccc703d15",
"failure_occurred": false,
"transfer_occurred": false,
"content-type": "text/plain",
"host": "172.17.0.1",
"user-agent": "curl/7.43.0"
},
"__ow_path": "",
"__ow_body": "Jane"
}
}









 Securing web actions 

By default, anyone can invoke a web action by using the invocation URL. You can secure your web action by using the require-whisk-auth[web action annotation](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-annotationsannotations-specific-to-web-actions).

Before you begin

Create the demo package and hello web action by completing the steps in [Creating a web action](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_example).

You can set the require-whisk-auth annotation by either:



* Setting the require-whisk-auth annotation to true. When the require-whisk-auth annotation is set to true, the web action authenticates the invocation requests Basic Authorization credentials against the web action owner's whisk auth key. When set to a number or a case-sensitive string, the web action's invocation request must include the X-Require-Whisk-Auth header set to this same number or case-sensitive string. Secured web actions return the message Not Authorized when credential validation fails.
* Allowing the require-whisk-auth annotation to be set automatically by using the --web-secure flag. When the --web-secure flag is set to true, a random number is generated as the require-whisk-auth annotation value. When set to false, the require-whisk-auth annotation is removed. When set to any other value, that value is used as the require-whisk-auth annotation value.





 Creating a secure web action
You can provide your variables and credentials for this stage from [variables in the pipeline UI](https://cloud.ibm.com/docs/devsecops?topic=devsecops-custom-scriptscd-devsecops-scripts-secrets) and the [pipeline trigger webhook payload](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-webhook-payloads).





 Dynamic scan 

Dynamic code scan is a form of black box vulnerability scanning that allows software teams to scan running applications and identify vulnerabilities.

The Dynamic Scan stage runs immediately after the Deploy to dev stage after a successful deployment to the dev environment.

By default, the pipeline provides support to run Zed Attack Proxy (ZAP) Scan, which is a free and open source penetration testing tool that is maintained under the umbrella of OWASP. It performs both API and UI dynamic scans, both of which can be run on the sample hello-compliance-app.

To run the dynamic scan, set the pipeline parameter opt-in-dynamic-scan to a nonempty value. To disable the stage from running dynamic scans, set the pipeline parameter opt-in-dynamic-scan to empty. For more information about setting pipeline parameters, see [Pipeline parameters](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipeline-parm).

The CI pipeline creates issues in the Issues Repository based on the severity. The label that is attached to the issue indicates the severity of the vulnerability.



 ZAP API scan 

The ZAP API scans the application endpoints for possible data leakages, content-type errors, external redirects, code injection, SQL injection, remote OS command injection, and other vulnerabilities that are exposed by the application. The ZAP API scans help developers secure the application by detecting these vulnerabilities in a stage or test environment and fixing them before the application is deployed on a production environment.

ZAP API scans require the following inputs to scan your application:



* Swagger Definition File - Describing the HTTP APIs and their associated parameters as exposed by the app.
Sensitive data, for example API keys or passwords, are not included in generated events.

The metadata properties that are sent to Event Notifications vary depending on the event type and subtype. For example, if an com.ibm.cloud.compliance.posture:posture-scan-completed event takes place, Security and Compliance Center sends a notification payload to Event Notifications that is similar to the following example.

{
"action": "Validation completed",
"summary": "my-test-scan",
"scope": "my-test-scope",
"profile": "CIS IBM Foundations Benchmark 1.0.0",
"start_time": "2021-11-24 13:46:21.672",
"end_time": "2021-11-24 13:46:21.672"
}

Review the following table for more information about event notification properties.



Table 2. Properties in an event notification payload

 Property Description 

 action The [type of event](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-event-notifications&interface=uievent-notifications-list) that triggered a notification. 
 summary The name of the validation scan. 
 scope The name of the scope that is associated with the scan. 
 profile The name of the profile that is associated with the scan. 
 start_time The date and time the scan started. 
 end_time The date and time the scan completed.
Wrapping your passphrase data encrypts it and secures it so that you never need to share your passphrase in plain text.

When you import the image, you must specify the cloud resource name (CRN) for your customer root key (CRK) that is stored in your KMS. You must also specify the ciphertext for your wrapped data encryption key (WDEK). The passphrase is stored encrypted in the WDEK always. It is only unwrapped when a virtual server that uses the encrypted image is started.

When you're ready to provision a new virtual server with the encrypted image, the encryption information isn't needed. The WDEK and the CRN of the CRK are stored as metadata with the image. For more information, see [About encrypted custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutbyok-about-encrypted-images).





 Overview of encrypted image process 

The following steps summarize the high-level process that you need to complete to be successful with creating and importing an encrypted image. Subsequent sections provide details on how to complete the steps.



1. Create an encrypted image by using QEMU and a passphrase of your choice to encrypt a qcow2 file with LUKS encryption.
2. Upload the encrypted image file to IBM Cloud Object Storage.
3. Provision a key management service, create a customer root key (CRK), and then wrap your passphrase with the CRK to generate a wrapped data encryption key (WDEK).
4. Ensure that you have the required IBM Cloud Identity and Access Management authorizations so that you can import the image from IBM Cloud Object Storage and so that your WDEK can be used for data encryption.
5. Import the image to IBM Cloud VPC. You must specify IBM Cloud Object Storage location, the CRK that is stored in your KMS, and your WDEK ciphertext.







 Encrypting the image
Click Webhooks > Pre-message webhook.
3. Set the Pre-message webhook switch to Enabled.
4. Decide whether to return an error if the webhook call fails.

When enabled, everything stops until the preprocessing step is completed successfully.



* If you have a critical preprocessing step that must be taken before you want to allow the message to be processed by the assistant, enable this setting.

Take steps to test the process that you are calling on a regular basis so you will know if it's down, and can change this setting to prevent all of your message calls from failing.
* When this setting is disabled, the assistant ignores any errors it encounters and continues to process the incoming message without taking the preprocessing step. If the preprocessing step is helpful but not critical, consider keeping this setting disabled.



5. In the URL field, add the URL for the external application to which you want to send HTTP POST request callouts.

For example, you might write a Cloud Functions web action that checks whether a message is in a language other than English, and if so, send it to the Language Translator service to covert it to English. Specify the URL for your web action.

https://us-south.functions.cloud.ibm.com/api/v1/web/my_org_dev/default/translateToEnglish.json

You must specify a URL that uses the SSL protocol, so specify a URL that begins with https.

You cannot use a webhook to call a Cloud Functions action that uses token-based Identity and Access Management (IAM) authentication. However, you can make a call to a Cloud Functions web action or a secured web action.
6. In the Secret field, add a private key to pass with the request that can be used to authenticate with the external service.

The key must be specified as a text string, such as purple unicorn. Maximum length is 1,024 characters. You cannot specify a context variable.

It is the responsibility of the external service to check for and verify the secret. If the external service does not require a token, specify any string you want.
* ${PROJECT_CPFS_OPS} identifies the project for the IBM Cloud Pak for Data foundational services.



For more information about using the environment variables, see [Best practice: Setting up install variables](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=installing-best-practice-setting-up-install-variables).

The ttsVoiceMarginalCPU property is no longer documented
: The ttsVoiceMarginalCPU property has been removed from the documentation for the Speech services custom resource. The property manages the tradeoff between concurrency and speech synthesis speed. The default value of 400 ensures a reasonable balance for most customers and maintains real-time synthesis.

Security vulnerabilities addressed
: The following security vulnerabilities have been fixed:



* [Security Bulletin: A vulnerability with Guava affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2020-8908)](https://www.ibm.com/support/pages/node/6575479)
* [Security Bulletin: A Google Guava vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2018-10237)](https://www.ibm.com/support/pages/node/6575477)
* [Security Bulletin: Vulnerabilities in Apache Tomcat affect IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2022-23181)](https://www.ibm.com/support/pages/node/6575481)
* [Security Bulletin: A Cyrus SASL vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2022-24407)](https://www.ibm.com/support/pages/node/6575483)
* [Security Bulletin: A vulnerability with GNU wget affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2016-4971)](https://www.ibm.com/support/pages/node/6575485)
Use secrets to store sensitive information You can store information, such as passwords and SSH keys in a secret. For more information, see [Working with secrets](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secret). 





 Supported TLS versions and cipher suites 

The Code Engine API and application endpoints support transport layer security (TLS) 1.2 (or higher) and the following cipher suites.



 TLS cipher suites 



* ECDHE-ECDSA-AES128-GCM-SHA256
* ECDHE-ECDSA-AES256-GCM-SHA384
* ECDHE-RSA-AES128-GCM-SHA256
* ECDHE-RSA-AES256-GCM-SHA384
* ECDHE-ECDSA-CHACHA20-POLY1305
* ECDHE-RSA-CHACHA20-POLY1305









 DDoS protection 

Code Engine provides out-of-the-box DDoS protection for your application. Code Engine's DDoS protection is provided by Cloud Internet Services (CIS) at no additional cost to you.

DDoS protection covers System Interconnection (OSI) Layer 3 and Layer 4 (TCP/IP) protocol attacks, but not Layer 7 (HTTP) attacks.

To address Layer 7 attacks, you can take the following steps so that your traffic runs through a secure route using your custom domain and is no longer available to the public internet through the Code Engine provided domain.



1. Obtain your custom domain.
2. In Code Engine, [create a custom domain mapping](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappings) for your app.
3. Set up an instance of [Cloud Internet Services (CIS)](https://cloud.ibm.com/catalog/services/internet-services) to manage your custom domain.
4. [Add the custom domain to the CIS instance](https://cloud.ibm.com/docs/cis?topic=cis-multi-domain-support).
In practical terms, the service can send an arbitrary number of audio chunks, including multiple chunks of audio before and after each text message. It is also possible for a single binary chunk to contain audio data that both precede and follow the timing information for a mark or word.

However, the text message that contains the timing information always arrives before the binary chunk that contains the corresponding audio. Moreover, the audio messages always arrive in order so that you can construct complete and accurate audio of the synthesized text from the binary results.





 Specifying an SSML mark 

The optional SSML <mark> element is an empty tag that places a marker into the text to be synthesized. The client is notified when all of the text that precedes the <mark> element has been synthesized.

The element accepts a single name attribute that specifies a string that uniquely identifies the mark. The name must begin with an alphanumeric character. The service returns the name along with the time at which the mark occurs from the beginning of the synthesized audio. You can include any number of marks in the input text.

The following snippet of JavaScript code includes an instance of the <mark> element with the name here:

function onOpen(evt) {
var message = {
text: 'Hello <mark name="here"/> world',
accept: '/'
};
websocket.send(JSON.stringify(message));
}

When it finishes synthesizing the text that precedes the mark, the service sends a text message that identifies the name of the mark and the time in seconds at which the mark occurs in the audio:

{
"marks": [
"here", 0.501]
]
}

The text message that contains the timing information always arrives before the audio chunk that contains the mark's location.





 Requesting word timings for all words 

The optional timings parameter of the JSON object that you pass to the service for a request returns timing information for all strings of the input text. This convenience eliminates the need to specify the SSML <mark> element for each word of the input. Pass an array that includes the string words to request word timings.
Your assistant remembers this information, and other information about a conversation, as variables. [Using variables to manage conversation information](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-manage-info) 
 Session variables A value that is not necessarily tied to a particular action can be stored as a session variable. Session variables are long-term memory: they persist throughout the user's interaction with the assistant, and your assistant can reference them from any action. [Using variables to manage conversation information](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-manage-info) 
 Regex response type A regex response collects a text string that matches a pattern that is expressed as a regular expression. Use this response to capture a value that must conform to a particular pattern or format, such as an email address or telephone number. [Regex](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-collect-infocustomer-response-type-regex) 
 Yes/No response type A confirmation response presents customers with the choices of either Yes or No as buttons. [Confirmation](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-collect-infocustomer-response-type-confirmation) 
 Connect to agent If your assistant is integrated with one of the supported service desk systems, you can build in logic that transfers the conversation to a live agent when necessary. [Connecting to a live agent](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-human-agent) 
 Embedded video Includes a video to display a how-to demonstration, promotional clip, or other video content. In the web chat, a video response renders as an embedded video player. [Adding a Video response](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-respondrespond-add-video)
* [Next-generation languages and models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-models-ng)
* [Customization support for next-generation models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-custom-supportcustom-language-support-ng)



Beta next-generation en-WW_Medical_Telephony model now supports smart formatting
: The beta next-generation en-WW_Medical_Telephony model now supports the smart_formatting parameter for US English audio. For more information about all next-generation models, see [Next-generation languages and models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-models-ng)

Security vulnerabilities addressed
: The following security vulnerabilities have been fixed:



* [Red Hat CVE-2022-24407](https://access.redhat.com/security/cve/CVE-2022-24407): A flaw was found in the SQL plugin shipped with Cyrus SASL. The vulnerability occurs due to failure to properly escape SQL input and leads to an improper input validation vulnerability. This flaw allows an attacker to execute arbitrary SQL commands and the ability to change the passwords for other accounts allowing escalation of privileges.
* [Security Bulletin: A jwt-go vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2020-26160)](https://www.ibm.com/support/pages/node/6574543)
* [Security Bulletin: A vulnerability in Golang Go affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-29923)](https://www.ibm.com/support/pages/node/6574545)