Commit Graph

90 Commits

Author SHA1 Message Date
Damien Elmes
e473b76043 urllib3 security fix 2024-06-18 12:46:32 +07:00
Damien Elmes
a7cddbbdd9 Update past yanked requests version
https://forums.ankiweb.net/t/compiling-after-cve-changes/45248
2024-05-25 16:10:45 +07:00
Damien Elmes
4853798105 Latest requests CVE 2024-05-21 23:51:32 +07:00
Damien Elmes
70996146d2 flask-cors CVE 2024-05-17 11:59:19 +07:00
Damien Elmes
c29125939d Bump some Python deps with CVEs 2024-05-07 21:54:48 +10:00
Damien Elmes
761780397b Update idna for security issue 2024-04-12 11:17:29 +07:00
Damien Elmes
f79a6c9480 Update black for security issue 2024-03-25 16:44:07 +07:00
Abdo
fa771991ca
Use system certificate store (#3050) 2024-03-04 05:48:16 +00:00
Damien Elmes
4fc535ec88
Dependency updates (#3040)
* Update JS deps

* Update semver-compat Rust deps

* Update some semver-incompat Rust deps

- hyper/axum held back because reqwests is not ready
- rusqlite held back due to burn-rs incompat version
- wiremock held back due to compile issue

* pylint wants changes to our _rsbridge.pyi

* Update Python deps

Also solves a security warning in orjson

Reformat with latest black
2024-02-28 16:28:04 +07:00
Damien Elmes
f09fbea3b9 Update to Qt 6.6.2
- Mac binary build stuff still todo
- Windows/Linux currently untested; please report any problems
2024-02-18 11:21:50 +07:00
Damien Elmes
cc648f4c0a Update for jinja2 security warning 2024-01-12 15:17:26 +10:00
Damien Elmes
e009325745 Roll back Qt on Mac source build too 2023-12-28 18:28:46 +10:00
Damien Elmes
20dc281558 Revert "Update to Qt 6.6.1 on Mac"
This reverts commit cbab96ec75.

This moves the bundle back to Qt 5.3 due to
https://forums.ankiweb.net/t/anki-23-12-mac-apple-qt6-dmg-crashing-on-browser/38783

We'll move back up when 6.6.2 comes out in mid-late Jan.
2023-12-28 18:17:50 +10:00
Damien Elmes
987a46978b Update to PyQt 6.6.1
The new wheel appears to have fixed ABI issues on both Windows and Linux.
2023-12-06 09:20:42 +10:00
Damien Elmes
cbab96ec75 Update to Qt 6.6.1 on Mac
This also fixes the Mac bundle using an old Qt version.

Linux held back due to ABI breakage; should be fixed in about a week
when PyQt 6.6.1 comes out. Windows build also fails to run - not sure
if it's the same issue or not.
2023-12-04 16:15:52 +10:00
Damien Elmes
a5de0fb40a Update Python deps 2023-11-27 13:34:42 +10:00
Damien Elmes
e327195470 Update pip for CVE [action required]
If this is not your first time building Anki, remove out/pyenv to
fix the error you'll get after updating to this commit.
2023-11-03 14:21:12 +10:00
Damien Elmes
f69b3c73e1 Update pip-tools
Required for the following commit
2023-11-03 14:19:23 +10:00
Damien Elmes
129e01a631 Update to PyQt 6.6 on all platforms
This bumps the glibc requirement of the Linux Qt6 build
2023-11-03 14:02:03 +10:00
Damien Elmes
48dfe502f2 Bump werkzeug for CVE 2023-10-26 11:23:24 +10:00
Damien Elmes
197c486bc0 Bump urllib3 for CVE 2023-10-18 08:56:48 +10:00
Damien Elmes
b2d515c8bb Update to Qt 6.5.3 on Windows/Mac
+ Fix incorrect version selection on Mac

Closes #2733 (except for Linux users)
2023-10-15 09:48:36 +10:00
Gulshan Singh
a230c754b9
Add Sphinx documentation generation functionality (#2720)
* Add Sphinx documentation generation functionality

* sphinx-docs -> python/sphinx

* Use ninja instead of make

* Update copyright info in sphinx docs

* Run sphinx-apidoc before building Sphinx docs

* Cleanup Sphinx path insertion

* Don't write build outputs into source; use autoapi

* aqt -> _aqt

* Mention sphinx in development.md

---------

Co-authored-by: Damien Elmes <gpg@ankiweb.net>
2023-10-13 13:03:54 +10:00
Damien Elmes
9165a7efaf Update urllib3
Minor CVEs
2023-10-03 12:25:06 +10:00
Damien Elmes
9ce98207be Update certifi for minor bug fix 2023-07-26 20:41:19 +10:00
Damien Elmes
9fa2495f8d Qt 6.5.1 -> 6.52 on Windows/Mac
Linux still blocked on previous Wayland breakage
2023-07-26 20:39:11 +10:00
Damien Elmes
85c2769f80
Update Rust and Python deps (#2567)
* Update Python deps

* Update semver-compat Rust deps

* Update most crates to latest semver

* Update to latest axum-client-ip
2023-07-01 18:26:43 +10:00
Damien Elmes
a31d669a90 Bump Mac and Windows builds to Qt 6.5.1
- Windows was on 6.4 as some users reported slowdowns; we'll need to
confirm whether they have come back in the next build.
- Linux has been held back due to https://bugreports.qt.io/browse/QTBUG-114635
2023-06-22 09:46:09 +10:00
Damien Elmes
823ca4c8a9 Split the Qt requirements into per-platform deps
Since more often than not, we can't use the same Qt version on all
platforms due to regressions.
2023-06-22 09:46:09 +10:00
Damien Elmes
e100789d24 Update requests for CVE
CVE-2023-32681
2023-05-24 16:09:15 +10:00
Damien Elmes
113239748b Update flask for security update
CVE-2023-30861

It doesn't look like it affects us.
2023-05-02 14:43:04 +10:00
Damien Elmes
13890ffade Bump pyqt6-sip version 2023-04-27 11:43:01 +10:00
Damien Elmes
103be366c9 Add new pyqt6.5 checksums
Because the version number was not changed, this was breaking new installs.

https://www.riverbankcomputing.com/pipermail/pyqt/2023-April/045257.html
2023-04-26 22:07:59 +10:00
Damien Elmes
8abcb77d95 Revert Windows build to Qt 6.4; update to 6.4.3
Multiple users have reported that 6.5 is behaving sluggishly

https://forums.ankiweb.net/t/anki-2-1-62-beta/29302/9
2023-04-14 12:05:34 +10:00
Damien Elmes
e20e7f7af1 Update to the latest wheel package; make code work with it 2023-04-12 16:17:00 +10:00
Damien Elmes
7caa807f1d Upgrade to Qt 6.5 on Mac
This bumps the minimum required macOS version to 11 for Qt6.

Closes #2263
2023-04-12 16:12:41 +10:00
Damien Elmes
b1ed4ade9d Upgrade to Qt 6.5 on Windows/Linux 2023-04-11 16:57:34 +10:00
Damien Elmes
82caffecbc Revert wheel upgrade
Will need to investigate why it's breaking bundles:

https://buildkite.com/ankitects/anki-ci/builds/5642#018735f6-5178-427a-9143-b6e610433408
2023-03-31 15:04:51 +10:00
Damien Elmes
0a0d17ff98 Update Python deps
- Black's formatting has changed
- Pylint has introduced a new lint
2023-03-31 14:04:05 +10:00
RumovZ
cdfb84f19a
Implement TTS using windows crate (#2371)
* Implement TTS using windows crate

* Use API calls instead of SSML

* Properly stop player in case of TTS error

* Add context to WindowsErrors

* Validate available voices

* Remove TTS text from synthesize error

* Limit maximum buffer size

* Make validation optional and list it in tts filter

* We no longer need the winrt module (dae)

* Use a separate request object so the meaning of the bool is clear (dae)

* Slightly shorten runtime error message (dae)

The default message appears to clip slightly.

* Alternate buffer implementation (dae)

* Use array instead of vec

* Drop the max buffer size to 128k (dae)
2023-02-17 12:26:07 +10:00
Damien Elmes
b4290fbe44 Bump werkzeug version
Fixes CVE-2023-23934
2023-02-16 17:41:25 +10:00
Damien Elmes
cf45cbf429
Rework syncing code, and replace local sync server (#2329)
This PR replaces the existing Python-driven sync server with a new one in Rust.
The new server supports both collection and media syncing, and is compatible
with both the new protocol mentioned below, and older clients. A setting has
been added to the preferences screen to point Anki to a local server, and a
similar setting is likely to come to AnkiMobile soon.

Documentation is available here: <https://docs.ankiweb.net/sync-server.html>

In addition to the new server and refactoring, this PR also makes changes to the
sync protocol. The existing sync protocol places payloads and metadata inside a
multipart POST body, which causes a few headaches:

- Legacy clients build the request in a non-deterministic order, meaning the
entire request needs to be scanned to extract the metadata.
- Reqwest's multipart API directly writes the multipart body, without exposing
the resulting stream to us, making it harder to track the progress of the
transfer. We've been relying on a patched version of reqwest for timeouts,
which is a pain to keep up to date.

To address these issues, the metadata is now sent in a HTTP header, with the
data payload sent directly in the body. Instead of the slower gzip, we now
use zstd. The old timeout handling code has been replaced with a new implementation
that wraps the request and response body streams to track progress, allowing us
to drop the git dependencies for reqwest, hyper-timeout and tokio-io-timeout.

The main other change to the protocol is that one-way syncs no longer need to
downgrade the collection to schema 11 prior to sending.
2023-01-18 12:43:46 +10:00
Damien Elmes
cef672a6a1 Update Windows/Linux to Qt 6.4.2
Closes #2275
2023-01-09 16:22:47 +10:00
Aristotelis
2270ff425a
Add dev tools for live-reloading Anki's web views (#2151)
* Add dev tools for live-reloading the web stack while running Anki

* Handle CDP connection errors more graciously

* Include sass in web stack watchers

* Refactor monitored folder and event definition

* Switch to more specific build target

Thanks to @hikaru-y

* Add PyChromeDevTools to dev requirements

* Update rebuild-web for ninja

* Satisfy mypy

* Remove ts-watch

Superseded by web-watch (the version here was also still based around bazel)

* Simplify calls to other build tools

Given that `./ninja qt/aqt` has to be run from the project root anyways, it doesn't make sense to use calls relative to `rebuild-web` in an ill-guided effort to lower dependencies on hard-coded paths.

* Remove remaining script-relative tool path
2023-01-03 11:55:58 +10:00
Damien Elmes
e0c4ba4b60 Revert to Qt 6.3.1 on macOS
Due to flicker reported on #2263. 6.3.1 was used in the 2.1.54 and is
the more conservative choice; we can trial 6.3.2 after release.
2022-12-14 15:25:10 +10:00
Damien Elmes
f9f8769ea8 Update certifi to fix security alert 2022-12-11 11:42:08 +10:00
Damien Elmes
9dc6e41153 Switch back to winrt to see if it fixes slow TTS
https://forums.ankiweb.net/t/slow-tts-and-duplicated-voices/25157/7

winrt blocks an upgrade from Python 3.9, so this will be a temporary
solution at best.
2022-12-06 20:30:54 +10:00
Damien Elmes
a70f8d4dd5 Fix TTS handling on Windows
Also update to winsdk, which unblocks Python updates on Windows
2022-11-29 13:04:51 +10:00
Damien Elmes
5e0a761b87
Move away from Bazel (#2202)
(for upgrading users, please see the notes at the bottom)

Bazel brought a lot of nice things to the table, such as rebuilds based on
content changes instead of modification times, caching of build products,
detection of incorrect build rules via a sandbox, and so on. Rewriting the build
in Bazel was also an opportunity to improve on the Makefile-based build we had
prior, which was pretty poor: most dependencies were external or not pinned, and
the build graph was poorly defined and mostly serialized. It was not uncommon
for fresh checkouts to fail due to floating dependencies, or for things to break
when trying to switch to an older commit.

For day-to-day development, I think Bazel served us reasonably well - we could
generally switch between branches while being confident that builds would be
correct and reasonably fast, and not require full rebuilds (except on Windows,
where the lack of a sandbox and the TS rules would cause build breakages when TS
files were renamed/removed).

Bazel achieves that reliability by defining rules for each programming language
that define how source files should be turned into outputs. For the rules to
work with Bazel's sandboxing approach, they often have to reimplement or
partially bypass the standard tools that each programming language provides. The
Rust rules call Rust's compiler directly for example, instead of using Cargo,
and the Python rules extract each PyPi package into a separate folder that gets
added to sys.path.

These separate language rules allow proper declaration of inputs and outputs,
and offer some advantages such as caching of build products and fine-grained
dependency installation. But they also bring some downsides:

- The rules don't always support use-cases/platforms that the standard language
tools do, meaning they need to be patched to be used. I've had to contribute a
number of patches to the Rust, Python and JS rules to unblock various issues.
- The dependencies we use with each language sometimes make assumptions that do
not hold in Bazel, meaning they either need to be pinned or patched, or the
language rules need to be adjusted to accommodate them.

I was hopeful that after the initial setup work, things would be relatively
smooth-sailing. Unfortunately, that has not proved to be the case. Things
frequently broke when dependencies or the language rules were updated, and I
began to get frustrated at the amount of Anki development time I was instead
spending on build system upkeep. It's now about 2 years since switching to
Bazel, and I think it's time to cut losses, and switch to something else that's
a better fit.

The new build system is based on a small build tool called Ninja, and some
custom Rust code in build/. This means that to build Anki, Bazel is no longer
required, but Ninja and Rust need to be installed on your system. Python and
Node toolchains are automatically downloaded like in Bazel.

This new build system should result in faster builds in some cases:

- Because we're using cargo to build now, Rust builds are able to take advantage
of pipelining and incremental debug builds, which we didn't have with Bazel.
It's also easier to override the default linker on Linux/macOS, which can
further improve speeds.
- External Rust crates are now built with opt=1, which improves performance
of debug builds.
- Esbuild is now used to transpile TypeScript, instead of invoking the TypeScript
compiler. This results in faster builds, by deferring typechecking to test/check
time, and by allowing more work to happen in parallel.

As an example of the differences, when testing with the mold linker on Linux,
adding a new message to tags.proto (which triggers a recompile of the bulk of
the Rust and TypeScript code) results in a compile that goes from about 22s on
Bazel to about 7s in the new system. With the standard linker, it's about 9s.

Some other changes of note:

- Our Rust workspace now uses cargo-hakari to ensure all packages agree on
available features, preventing unnecessary rebuilds.
- pylib/anki is now a PEP420 implicit namespace, avoiding the need to merge
source files and generated files into a single folder for running. By telling
VSCode about the extra search path, code completion now works with generated
files without needing to symlink them into the source folder.
- qt/aqt can't use PEP420 as it's difficult to get rid of aqt/__init__.py.
Instead, the generated files are now placed in a separate _aqt package that's
added to the path.
- ts/lib is now exposed as @tslib, so the source code and generated code can be
provided under the same namespace without a merging step.
- MyPy and PyLint are now invoked once for the entire codebase.
- dprint will be used to format TypeScript/json files in the future instead of
the slower prettier (currently turned off to avoid causing conflicts). It can
automatically defer to prettier when formatting Svelte files.
- svelte-check is now used for typechecking our Svelte code, which revealed a
few typing issues that went undetected with the old system.
- The Jest unit tests now work on Windows as well.

If you're upgrading from Bazel, updated usage instructions are in docs/development.md and docs/build.md. A summary of the changes:

- please remove node_modules and .bazel
- install rustup (https://rustup.rs/)
- install rsync if not already installed  (on windows, use pacman - see docs/windows.md)
- install Ninja (unzip from https://github.com/ninja-build/ninja/releases/tag/v1.11.1 and
  place on your path, or from your distro/homebrew if it's 1.10+)
- update .vscode/settings.json from .vscode.dist
2022-11-27 15:24:20 +10:00
Stefan Kangas
5551a37f03
Fix typos (#2210) 2022-11-24 20:18:57 +10:00