unable to run librdkafka=1.3.0 over docker - go

I was trying to run librdkafka version 1.3.0 from alpine distribution over my docker container using this:
FROM golang:1.13.6-alpine3.10 as base
RUN apk add --no-cache --update librdkafka=1.3.0 librdkafka-dev=1.3.0 --update-cache --repository http://dl-3.alpinelinux.org/alpine/edge/community
but got this error while building image:
librdkafka-1.4.2-r0:
breaks: world[librdkafka=1.3.0]
satisfies: librdkafka-dev-1.4.2-r0[librdkafka=1.4.2-r0]
librdkafka-dev-1.4.2-r0:
breaks: world[librdkafka-dev=1.3.0]
Can someone tell me what might be possibly wrong here?

The librdkafka package has been upgraded to 1.4.2.
In Alpine repositories, as opposed to Ubuntu for example, old package versions are not kept. This is mostly done for security reasons, AFAICT. When a package is upgraded, the old version is gone for good. This has the unfortunate side effect of breaking images that depend on specific package versions.
The currently available librdkafka 1.X versions on Alpine repositories are 1.4.2 (edge, 3.12), 1.2.2 (3.11), and 1.0.1 (3.10).
If you must use this exact version, you could try building it from source, using the 1.3.0 tag.

Related

nth-check: Not able to fix vulnerability introducted through rails/webpacker

There is a vulnerability related to nth-check that I am trying to fix.
https://www.cve.org/CVERecord?id=CVE-2021-3803
It is coming from #rails/webpacker. Tried removing entry optimize-css-assets-webpack-plugin#^5.0.8 from yarn.lock and running yarn install again but no luck. It still installs 5.0.8 version.
yarn upgrade adds new entry in package.json for latest version of optimize-css-assets-webpack-plugin but looking at https://www.npmjs.com/package/#rails/webpacker?activeTab=dependencies rails/webpacker is consuming latest version of optimize-css-assets-webpack-plugin so I am not sure why its not picking up latest version.

Why go get downloads two versions of same package when using -u

I was using go get -u to get a package which depends on golang.org/x/text#v0.3.7. I noticed that it first downloads golang.org/x/text#v0.3.7 then downloads golang.org/x/text#v0.4.0.
Then I ran go clean -modcache and go get golang.org/x/text which downloaded v0.4.0 of golang.org/x/text and then again go get -u entgo.io/ent. This time go didn't download golang.org/x/text#v0.3.7
So, Why go get -u downloads both the old version and latest version when the latest version is not present locally, and Why it doesn't download the old version when the latest version is available locally?
Because it is a two-step process of
Getting dependencies
Updating dependencies
From a programming standpoint there is no good reason to merge these into a single concern of "Get latest dependencies".
From the go command documentation:
The -u flag instructs get to update modules providing dependencies of packages named on the command line to use newer minor or patch releases when available.
This means that -u specifically deals with modules which the package you are getting depends on, rather than with the module of the package you are getting.
Furthermore, it appears that -u is agnostic to the Go idiom of treating any change in a v0 version as a major version change, so one cannot lightheartedly recommend using -u out of principle. The README of golang.org/x/test even says:
Until version 1.0.0 of x/text is reached, the minor version is considered a major version. So going from 0.1.0 to 0.2.0 is considered to be a major version bump.

Access old pytorch release from conda cloud

According to multiple sites, there was a binary release 0.2.1 for pytorch in repo peterjc123 (e.g. https://moodle.di.ens.fr/mod/forum/discuss.php?d=9#p33 ).
I also see a release 0.3.0 when looking at the only snapshot from archive.org.
However, the conda cloud website only shows the latest version (0.3.1; https://anaconda.org/peterjc123/pytorch/files ); the same applies to
conda search pytorch -c peterjc123
The old download links do not work anymore.
How do I access the old version (I need a binary < 0.3 for windows 10; cuda80; py36)?
Consider using the binaries uplodaed by user Soumith, who is also the uploader for the (now stable branch) pytorch/pytorch on Anaconda cloud.
This channel has versions back to 0.2.1, so it should be satisfying your requirements.
If that does not work, also consider installing with regular pip install and specifying a version of your desire.
Edit: There might also be older versions for pytorch_cpu and other packages, I only checked for the "main" pytorch package.

How can I ensure that I install compatible versions of JAGS and rjags in Ubuntu?

I would like to write a script that installs JAGS and rjags on a new ubuntu installation, and that will work independently of the currently available versions of these packages. I'd like to know how I can do this while avoiding conflicts between versions.
I have the following R script, initialize.R:
system('apt-get install jags')
install.packages('rjags')
So that I can run from bash:
sudo R --vanilla < initialize.R
However, the most recent version of JAGS in the Ubuntu repository is 2.2, and the version of rjags available from CRAN depends on JAGS > 3.0.
I am interested in installing compatable JAGS and rjags, perhaps either:
installing a specific version of JAGS (e.g. 2.2) and the compatable rjags version (which version?)
generically installing the version of JAGS currently in the ubuntu repository and the appropriate rjags version, or
generically installing the most recent version of rjags at cran and the appropriate version of JAGS
The ability to do case 1 is essential, but am also curious how I could implement cases 2 and/or 3.
questions:
How can I do this?
Is there a more sound approach?
update: following link in Dirk's answer, the following worked:
add-apt-repository ppa:marutter/rrutter
apt-get update
apt-get install r-cran-rjags
Michael Rutter provides an r-cran-rjags package via his repository; this works with the jags package you already have installed. See this message on r-sig-devel for details, and you may want to subscribe to and follow the r-sig-debian list to stay abreast of these things.

Node.js version and Heroku

So, I got a small site started in node.js (my first one) using Express. Pretty happy with it, until I tried to deploy to Heroku and found that I had 0.4.9 installed and they only support 0.4.7.
Is uninstalling 0.4.9 and installing 0.4.7 my only option, or is there a way to do a side-by-side on the two?
You can override the version of node.js and npm by customizing the Heroku build pack:
http://blog.superpat.com/2011/11/15/running-your-own-node-js-version-on-heroku/
Actually...you do not have to remove anything.
Just ensure you are using features of node compliant with node 0.4.7 and when you make your package.json which specifies your dependencies has the correct version number or range specified.
I had a similar issue where one of our developers made is packacge and set the dependency to node 0.4.8 however it didn't require this it was just what version he was using at the time, we ended up updating his package.json to list node 0.4.7 instead and then my package which depended on his deployed to heroku just fine.
It seems Heroku only supports 0.4.7 at the moment and even suggests to develop strictly on that version.
If you have to use heroku then you have to uninstall 0.4.9, install 0.4.7.
If you don't have to use heroku. You can always setup a VPS yourself, and you will have the freedom to install whatever version that pleases you. :D

Resources