chore(apollo_infra): creating branch main-v0.14.0#6473
Conversation
|
This change is |
matanl-starkware
force-pushed
the
main-v0.14.0
branch
from
46ae03f to
9d6687d
Compare
matanl-starkware
changed the title
|
Benchmark movements: tree_computation_flow performance improved 😺 tree_computation_flow time: [34.445 ms 34.477 ms 34.511 ms] change: [-4.7616% -3.1796% -1.7943%] (p = 0.00 < 0.05) Performance has improved. Found 3 outliers among 100 measurements (3.00%) 3 (3.00%) high mild |
dorimedini-starkware
left a comment
dorimedini-starkware
left a comment
There was a problem hiding this comment.
Reviewed 2 of 4 files at r1, 2 of 2 files at r2, all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on @matanl-starkware)
a discussion (no related file):
approved but blocking to prevent merge to main
This stack of pull requests is managed by Graphite. Learn more about stacking. |
We want to account for the sierra gas used for fee transfer as well as for the gas used for validate and execute.
…t for cancellations (#9776)
![semgrep-code-starkware-libs[bot]](https://avatars.githubusercontent.com/u/59333826?s=60&v=4){kind=small}
| charset-normalizer==3.4.2 | ||
| ckzg==2.1.1 | ||
| cytoolz==1.0.1 | ||
| ecdsa==0.19.1 |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 14 lists a dependency (ecdsa) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of ecdsa are vulnerable to Minerva timing attack (side-channel) when using the NIST P-256 curve. Using the ecdsa.SigningKey.sign_digest() function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. The library considers side-channel attacks out of scope and there will be no fix.
To resolve this comment:
Check if you expose the library in a way that allows an attacker to measure how long it takes to generate a key pair or sign a message through a side-channel. Examples include but are not limited to an attacker being able to run code on the same physical machine in which key pair generation or signing is taking place (this includes virtual machines), an attacker being able to measure how much power your computer uses during key pair generation or signing, and an attacker being able to measure RF interference coming from your computer during key pair generation or signing..
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
* apollo_gateway: Add naive class cache * apollo_gateway: make class cache configurable
* Revert "apollo_infra: apply tcp_nodelay on remote connections (#10237)" This reverts commit 3a5aacd. * Revert "apollo_gateway: Add gatewaye cache ratio panel (#10189)" This reverts commit e961954. * Revert "apollo_gateway: Add cache metrics (#10191)" This reverts commit 4f46288. * Revert "apollo_gateway: make class cache configurable (#10188)" This reverts commit 4ced915. * Revert "apollo_gateway: Add naive class cache (#10190)" This reverts commit cfb096e.
github-merge-queue
bot
closed this pull request by merging all changes
into
main
in
b9ad526
20 participants
No description provided.