vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Previously, the article was included only for the first day of the month for French (for example, "the first of September," "le premier septembre").

Defect fix: Japanese synthesis is improved to handle long strings of input text
: Defect fix: The service now correctly synthesizes Japanese requests that include long strings of characters. Previously, the service failed to properly synthesize very long strings of Japanese text.

Defect fix: Add rules for custom model naming documentation
: Defect fix: The documentation now provides detailed rules for naming custom models. For more information, see



* [Creating a custom model](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-customModelscuModelsCreate)
* [API & SDK reference](https://cloud.ibm.com/apidocs/text-to-speech)



Security vulnerabilities addressed
: The following security vulnerabilities have been fixed:



* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a cross-configuration attack against OpenPGP (CVE-2021-40528)](https://www.ibm.com/support/pages/node/6843867)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in PCRE2 (CVE-2022-1586)](https://www.ibm.com/support/pages/node/6843869)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Vim (CVE-2022-1621)](https://www.ibm.com/support/pages/node/6843871)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer overflow in Vim (CVE-2022-1629)](https://www.ibm.com/support/pages/node/6843873)
To view all of the access keys for an IBM Cloud Security and Compliance Center Workload Protection instance, complete the following steps:



1. Obtain the API Token from the IBM Cloud Security and Compliance Center Workload Protection UI. [Learn more](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-api_tokenapi_token_get).
2. Issue a curl GET request against the regional endpoint to enable the given access key.

curl -XGET -H 'Authorization: Bearer SYSDIG_API_TOKEN' -H 'IBMInstanceID: GUID' https://ENDPOINT/api/customer/accessKeys

Where



* ENDPOINT is the URL for the region where the monitoring instance is available. For more information, see [Endpoints](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-endpointsendpoints).
* SYSDIG_API_TOKEN is the API Token retrieved in Step 1.
* GUID is the GUID of the instance that is associated with the access key.



The output will provide a list of the access keys in the response and whether they are enabled.

{
"customerAccessKeys": [
{
"enabled": true,
"accessKey": "12345678-1234-1234-1234-123456789012",
"dateCreated": 1541096409000,
"dateDisabled": null,
"limit": null,
"reservation": null,
"teamId": null
},
{
"enabled": false,
"accessKey": "87654321-1234-1234-1234-123456789012",
"dateCreated": 1573849361000,
"dateDisabled": 1573849367000,
"limit": null,
"reservation": null,
"teamId": null
}
]
}







 Deleting access keys
How to resolve the Application workflow issues? 

If you get error messages or warnings during the application workflow, check for the following troubleshooting tips:



1.  Encrypt button is disabled: Shield is initializing, restarting, or stopped.

The Shields enrolled in an application must all be in a running state to enable the Encryption operations.
2.  Shield connection to the database fails: Database credentials are changed. The Database Username or Database Password might have been updated; from the time the connection was created in Manager.
3.  Database grants are insufficient: The database credentials which the Shield uses to create a session must have a minimum set of permissions.
4.  Shield does not use SSL: If the database connection uses SSL, the Shield connection must also use SSL.
5.  Custom Data Protection mode is not visible in the Data Protection dropdown for selection: Custom mode is invalid for the selected datatype. Certain custom encryption modes and masking modes may only be applied on data types.
6.  Multiple Data Protection modes are selected on one column: Default Data Protection is overridden: By design, default data protection policies may be applied on any column. If a custom or column-specific Encryption Mode or Masking Mode is simultaneously selected for a column, then the default policy is ignored. The custom selection is applied.
7.  Option to Deploy Policy & Migrate Data is disabled: Shield is initializing, restarting, or stopped. The Shields enrolled in an application must all be in a running state to enable the Encryption operations. Or, if no Shields are enrolled in the application, the migration option is disabled.

If you are experiencing any other issues with the Data Security Broker, go to the IBM Cloud [Support Center](https://cloud.ibm.com/unifiedsupport/supportcenter) and navigate to creating a case. Use the All products option to search for IBM Cloud Data Security Broker to continue creating the case or to find more information about getting support.
Your VMware instance is running on IBM Cloud bare metal servers.

Complete the following steps to ensure that you make adequate plans for high availability and business continuity.



* Review vSphere HA and vSphere Distributed Resource Scheduler (DRS) configuration against your requirements.
* Review network and storage I/O control configuration against your requirements.
* Configure the virtual machine startup order against your requirements.
* Configure resource pools, as needed, for management and workload.
* Plan, implement, and monitor a backup solution for both [instance management components](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_backingup) and workload.
* Plan for high availability of instance management, including the possibility of multiple instances, multiple clusters, vCenter HA, and PSC HA.
* Use solutions such as [Zerto Disaster Recovery](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-addingzertodr) or [Veeam Backup and Replication](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview) to plan for business continuity for your workloads.







 Storage planning 

In addition to capacity planning, complete the following to ensure that your storage configuration meets your performance and availability requirements.



* Storage performance depends on various factors, including RAID configuration and disk striping, network configuration, block size, configured IOPS (input/output operations per second) for network-attached storage, VM hardware configuration and method of storage attachment, clustering and replication methods, and use of storage policies such as encryption, deduplication, and compression. Plan time to test and tune your configuration to meet your storage performance needs.
* Review your vSAN storage policy



* RAID 1 provides better performance and smaller windows of susceptibility to sequential failure, such as shorter rebuild time, than RAID 5. However, RAID 5 has less storage overhead.
* RAID 6 provides protection against dual failures, but requires a minimum of six hosts compared to four hosts for RAID 5.
Attestation 

Attestation is a process that starts by default at virtual instance creation, ensures that the virtual server instance image is indeed built by IBM, and that it was not modified. This process also provides information and allows validation of any data that is provided to the instance at the time of deployment.

When you create a virtual server instance by using the IBM Hyper Protect Container Runtime image, the image uses an initial file system that is protected by encryption and signed by IBM Secure Execution. For more information, see [Confidential computing with LinuxONE](https://cloud.ibm.com/docs/vpc?topic=vpc-about-se). To know more about the attestation process, see this [video](https://mediacenter.ibm.com/media/IBM+Cloud+Hyper+Protect+Virtual+Server+for+VPC.mp4/1_mj9ksaob).

The boot process creates a unique root disk encryption key to ensure protection of the root disk. To perform attestation, the virtual server instance image contains an attestation-signing key and the hash of the root partition at build time. The boot process validates the root partition. If the hash of the root partition does not match, the boot process does not continue because it assumes that the image was modified before boot. The attestation signing key is a random RSA 4 K key that is signed by an IBM root key that is maintained in Hyper Protect Crypto Services. The IBM root key is signed by Digicert.

During deployment of the virtual server instance in the cloud, an attestation record is created. It contains hashes of the following items:



* The original base image
* The root partition at the moment of the first boot
* The root partition at build time
* The cloud initialization options



The attestation record is signed by the attestation key. As an extra protection layer, you can provide a public key during deployment, against which the attestation record is encrypted. The hash of this public key is added to the attestation record to ensure that the record can be viewed only by the compliance authority, and the expected authority can be easily identified through that hash.
{"customerAccessKey":{"enabled":true,"accessKey":"b302311f-aa1c-4930-8726-59fb4ba0fe84","dateCreated":1683550580444,"dateDisabled":null,"limit":null,"reservation":null,"teamId":null}}
{
"customerAccessKey": {
"enabled": true,
"accessKey": "12345678-1234-1234-1234-123456789012",
"dateCreated": 1573852152224,
"dateDisabled": null,
"limit":null,
"reservation":null,
"teamId":null
}
}
3. The access key can now be used in the agent configuration files.







 Disabling an access key 

To disable an existing access key for an IBM Cloud Security and Compliance Center Workload Protection instance, complete the following steps:



1. Obtain the API Token from the IBM Cloud Security and Compliance Center Workload Protection UI ( [see instructions](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-api_tokenapi_token_get) ).
2. Issue a curl POST request against the endpoint to disable the given access key.

curl -XPOST -H 'Authorization: Bearer SYSDIG_API_TOKEN' -H 'IBMInstanceID: GUID' https:ENDPOINT/api/customer/accessKeys/ACCESS_KEY/disable

Where



* ENDPOINT is the URL for the region where the instance is available. For more information, see [Endpoints](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-endpointsendpoints).
* SYSDIG_API_TOKEN is the API Token retrieved in step 1.
* ACCESS_KEY is the access key that you wish to disable.
* The root partition at build time
* The cloud initialization options



The attestation record is signed by the attestation key. As an extra protection layer, you can provide a public key during deployment, against which the attestation record is encrypted. The hash of this public key is added to the attestation record to ensure that the record can be viewed only by the compliance authority, and the expected authority can be easily identified through that hash.

Before you upload any workload to your instance, you need to validate the attestation record. After an instance is created, you can validate the attestation record within the created instance. Your instance must have access to the /var/hyperprotect directory. If so, follow these procedures:



* The attestation record is signed by the attestation signing key.
* The attestation signing key can be confirmed by the IBM intermediate certificate. The IBM intermediate certificate is signed by DigiCert, which is proven by the root certificate of DigiCert, thus completing the chain of trust.



The encryption and attestation certificates are signed by the IBM intermediate certificate and this has been signed by the IBM Digicert intermediate cert (which in turn is signed by DigiCert Trusted Root G4). For more information about the certificates, see [DigiCert Trusted Root Authority Certificates](https://www.digicert.com/kb/digicert-root-certificates.htm).

Use the following procedure to validate the attestation record and hashes:



* Obtain the attestation record se-checksums.txt and the signature file se-signature.bin from your Hyper Protect Virtual Servers for VPC instance. To do so, you can implement your container to provide the attestation record and the signature file. The attestation record and the signature file are made available to your container in the /var/hyperprotect directory.
: Watson Speech services do not support the IBM Cloud Pak for Data OpenShift APIs for Data Protection (OADP) backup and restore utility. If the Speech services are installed on a cluster, you might not be able to use the IBM Cloud Pak for Data OADP backup and restore utility to back up other services that are installed on that cluster. This limitation applies to version 4.0.0 and later versions of the Speech services.

Security vulnerabilities addressed
: The following security vulnerabilities have been fixed:



* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable a denial of service, caused by a buffer overflow with Twisted (CVE-2022-21716)](https://www.ibm.com/support/pages/node/6593867)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in NumPy. (CVE-2021-33430)](https://www.ibm.com/support/pages/node/6592841)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by improper input validation with Spring Framework (CVE-2022-22950)](https://www.ibm.com/support/pages/node/6593865)







 1 May 2022 (Version 1.2.x) 

Important: End of service for Speech to Text version 1.2.x on IBM Cloud Pak for Data version 3.5
: Important: Speech to Text version 1.2.x on IBM Cloud Pak for Data version 3.5 is out of service as of 1 May 2022. Speech to Text version 1.2.x is no longer supported, available, or documented.
: IBM Cloud Monitoring collects basic Classic infrastructure and VPC virtual server metrics such as CPU usage, disk usage, network traffic, and memory. These metrics are stored in IBM Cloud Monitoring. For more information, see [IBM Cloud Monitoring](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-monitoring-iaas).







 May 2020 



 18 May 2020 

NVM solid-state drives
: Non-Volatile Memory Express (NVMe) is a high-performance storage protocol that supports direct connection of the memory subsystem to the CPU through the PCIe interface. The NVMe protocol capitalizes on parallel, low latency data paths to the underlying media. This protocol offers significantly higher performance and smaller latencies compared to traditional SAS and SATA protocols. For more information, see [NVMe solid-state drives](https://cloud.ibm.com/docs/bare-metal?topic=bare-metal-ordering-nvme-ssd).







 March 2020 



 24 March 2020 

AMD CPU support
: When you provision a bare metal server, AMD EPYC® "Rome" generation CPUs are now an option. Rome generation processors are high-performance multiprocessors that are based on AMD's Zen 2 architecture. The EPYC "Rome" family offers several CPU options that offer up to 48 cores per socket. For more information, see the AMD CPU support section in [Bare metal server options](https://cloud.ibm.com/docs/bare-metal?topic=bare-metal-about-bmbm-amd-procs).







 February 2020 



 11 February 2020 

Veeam backup for Office 365
: Veeam backup for Office 365 protects your Office 365 data by backing up your Exchange Online, SharePoint Online, and OneDrive for Business data. True data protection and RPO (recovery point objective) are not included with Office 365. Veeam provides a software-defined solution that protects Office 365, performs granular restores, and recovers data to anywhere.
* Resolve potential vulnerabilities









 v1.8.6fp1 

Published date: 2020-11-18



 Fixes 



* Resolve unexpected error when there is network latency between SG client and SG server
* Resolve error when using RPM installer with upgrade operation
* Enhance the handling when both side close the connection in the same time









 v1.8.6 

Published date: 2020-09-22



 Fixes 



* Resolve potential vulnerabilities
* Resolve unexpected websocket fatal error
* Resolve error when update destination too frequently
* Resolve incorrect UI version info
* Resolve DataPower SG client unexpected restart issue
* Enhance concurrent connection limit counting and logging
* Resolved incorrect UI version info







 Breaking changes 

TLS 1.0 and TLS 1.1 is disabled since this version, connections which use TLS 1.0 and TLS 1.1 will get SSL error.







 v1.8.5fp2 

Published date: 2020-04-22



 Fixes 



* Resolve the error when starting the Secure Gateway Client UI in Windows version









 v1.8.5fp1 

Published date: 2020-02-12



 Features and Fixes 



* Upgrade Node.js to 10.19.0
* Resolve the error when starting the Secure Gateway Client as Windows service









 v1.8.5 

Published date: 2020-01-07



 Features 



* Upgrade Node.js to 10.17.0
* Node modules vulnerabilities fix
* Resolve the Node.js conflict on Windows installer
* Add proxy option to the installer for npm module installation







 Breaking changes 

Please be aware the breaking changes for the Node.js version upgrade, for example, the OpenSSL is upgraded to 1.1.1d because of Node.js upgrade which might cause some breaking changes on the TLS connections since the security policy is stricter than before, customer will get error when enable Reject unauthorized and connect to the endpoint which using cert/key which generate with insecure algorithm.







 v1.8.4 

Published date: 2019-10-22



 Features 



* Support the toggle rejectUnauthorized for Resource Authentication
VMware Update Manager overview 

VMware® Update Manager (VUM) uses a multistage process to upgrade vSphere® objects and to apply patches or extensions. This process enables a smooth update procedure with a minimum of system downtime. Before we look at this process, we need to understand the following terms:



* Inventory Object - an object within vCenter such as virtual machines (VMs), virtual appliances (VAs), or vSphere ESXi™ hosts.
* Baseline - baselines contain a collection of one or more patches, extensions, service packs, bug fixes, or upgrades. Baselines can be classified as patch, extension, or upgrade baselines. There are two types of baselines: Host and VM/VA. Host and VM/VA have predefined baselines by VMware and custom baselines that can be added as required:





* Pre-defined Hosts baselines:



* Critical host patches
* Non-critical host patches



* Pre-defined VMs/VAs baselines:



* VA upgrade to latest
* VM hardware upgrade to match host
* VMware tools upgrade to match host







* Baseline Group - a set of non-conflicting baselines, which combines different types of baselines, and scans and remediates an inventory object against all of them as a whole. If a baseline group contains both upgrade and patch or extension baselines, the upgrade runs first.
* Scanning - Scanning is the process in which the Inventory object or objects are evaluated against the baseline or baseline group.
* Staging - Staging ensures that the patches and extensions are downloaded to the vSphere ESXi hosts before the remediation and is an optional step to minimize the time hosts are in maintenance mode.
* Remediation - Remediation is the process in which VUM applies patches, extensions, and upgrades to the inventory object or objects.



Therefore, the VUM process is as follows:



* An inventory object, or a group of objects, are scanned for compliance against a baseline or a baseline group.
* After a review, patches and extensions can be optionally staged, before remediated.
VRVDR-42017 Minor When “show vpn ipsec sa” is running on VRRP backup, “ConnectionRefusedError” error is thrown related to vyatta-op-vpn- ipsec-vici line 563 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801m

 Issue Number CVSS score Advisory Summary 

 VRVDR- 42317 5.4 DSA-4226-1 CVE-2018-12015: Debian DSA-4226-1: perl – security update 
 VRVDR- 42284 7.5 DSA-4222-1 CVE-2018-12020: Debian DSA-4222-1: gnupg2 – security update 









 1801k 

Released June 8, 2018.



 Issues Resolved 



Issues resolved for 1801k

 Issue Number Priority Summary 

 VRVDR-42084 Blocker NAT sessions linked to VFP interfaces for PB IPsec tunnels are not being created for packets that arrive on the router even though the router is configured to do so 
 VRVDR-41944 Major After VRRP fail-over some VTI tunnels fail to re-establish until a “vpn restart” or peer reset is issued 
 VRVDR-41906 Major PMTU discovery fails as ICMP type 3 scode 4 messages are sent out from wrong source IP 
 VRVDR-41558 Major The reported timestamps in packet traces are not consistent with the actual time and system clock 
 VRVDR-41469 Major One interface link down – bond is not carrying traffic 
 VRVDR-41420 Major LACP bonding state/link “u/D” with mode change active-backup to LACP 
 VRVDR-41313 Critical IPsec – VTI interface instability 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801k

 Issue Number CVSS score Advisory Summary
With IBM Cloud Gateway Appliances, you can provision application and database servers without public network interfaces while still allowing your servers to access the internet using source NAT. You can also hide your servers behind the gateway device with destination NAT for enhanced security.





 Enterprise-grade routing 

For multi-tiered applications on different isolated networks, the appliances enable you to build connectivity between these networks with greater flexibility. You can set up dynamic routing using Border Gateway Protocol (BGP), which allows you to announce your own public IP space to the IBM Cloud routers. BGP also offers more flexibility for custom private network configurations when using a mix of tunnels and direct link solutions.





 VLANs and the gateway appliance's role 

A VLAN (virtual LAN) is a mechanism that segregates a physical network into many virtual segments. For convenience, traffic from multiple selected VLANs can be delivered through a single network cable, a process commonly called "trunking."

IBM Cloud Gateway Appliances are managed in two different interfaces: the gateway appliance server(s) and fixture. The gateway appliance server provides an interface (GUI and API) for selecting the VLANs that you want to associate with your vSRX or VRA. Associating a VLAN with a gateway appliance reroutes (or "trunks") that VLAN and all of its subnets to your appliance, giving you control over filtering, forwarding, and protection. Servers in an associated VLAN can only be reached from other VLANs by going through your appliance; it is not possible to circumvent the appliance unless you bypass or disassociate the VLAN.

By default, a new gateway appliance is associated with two non-removable "transit" VLANs, one each for your public and private networks. These networks typically are used for administration, and they can be secured by gateway appliance commands separately.

The vSRX or VRA can only manage VLANs that are associated with it through the gateway appliance.