Huggingface/transformers: v4.9.2: Patch release

This document summarily provides brief descriptions of the MELCOR code enhancement made between code revision number 11932 and 14959. Revision 11932 represents the last official code release; therefore, the modeling features described within this document are provided to assist users that update to the newest official MELCOR code release, 14959. Along with the newly updated MELCOR Users' Guide [2] and Reference Manual [3], users will be aware and able to assess the new capabilities for their modeling and analysis applications. Following the official release an addendum section has been added to this report detailing modifications made to the official release which support the accompanying patch release. The addendums address user reported issues and previously known issues within the official code release which extends the original Quick look document to also support the patch release. Furthermore, the addendums section documents the recent changes to input records in the Users' Guide applicable to the patch release and corrects a few issues in the revision 14959 release as well. This page left blank.

With our ever increasing dependence on computers, many governments around the world have started to investigate strengthening the regulations on vulnerabilities and their lifecycle management. Although many previous works have studied this problem space for mainstream software packages and web applications, relatively few have studied this for consumer IoT devices. As our first step towards filling this void, this paper presents a pilot study on the vulnerability disclosures and patch releases of three prominent consumer IoT vendors in Japan and three in the United States. Our goals include (i) characterizing the trends and risks in the vulnerability lifecycle management of consumer IoT devices using accurate long-term data, and (ii) identifying problems, challenges, and potential approaches for future studies of this problem space. To this end, we collected all published vulnerabilities and patches related to the consumer IoT products by the included vendors between 2006 and 2017; then, we analyzed our dataset from multiple perspectives, such as the severity of the included vulnerabilities and the timing of the included patch releases with respect to the corresponding disclosures and exploits. Our work has uncovered several important findings that may inform future studies. These findings include (i) a stark contrast between how the vulnerabilities in our dataset were disclosed in the two markets, (ii) three alarming practices by the included vendors that may significantly increase the risk of 1-day exploits for customers, and (iii) challenges in data collection including crawling automation and long-term data availability. For each finding, we also provide discussions on its consequences and/or potential migrations or suggestions.

BackgroundThe goal of the current study was to create, improve, and test a transdermal patch loaded with primaquine for the treatment of malaria. Several ingredients were used to create the transdermal patch. For the choosing of polymers, placebo patches were created. The optimization of polymer ratios for patch development and testing their impact on tensile strength, in vitro drug release, in vitro drug permeation, and ex vivo drug permeation employed response surface methods. The F5 formulation was chosen as the optimal formulation based on these answers to the data. The stability of the F5 formulation was examined. According to the findings of trials on acute skin irritation, no place where transdermal patches were given showed any signs of clinical abnormalities or a change in body weight. No erythema or edema of the skin was seen in the rabbit’s skin.ResultsIt was observed that tensile strength of the transdermal films formulated with Eudragit RL100 and hydroxypropyl methylcellulose (Pmix) was found between 0.32 ± 0.017 and 0.59 ± 0.013 kg/cm2, which were 0.32 ± 0.017 (F1), 0.36 ± 0.012 (F2), 0.35 ± 0.015 (F3) for Pmix ratio 1:1, 0.42 ± 0.011 (F4), 0.49 ± 0.010 (F5), 0.55 ± 0.016 (F6) for Pmix ratio 1:2 and 0.56 ± 0.014 (F7), 0.57 ± 0.010 (F8), 0.59 ± 0.013 (F9) for Pmix ratio 1:3. Data fitting to the Peppas, Hixon–Crowell, Higuchi, and Zero-order models was used to examine the optimized transdermal patch (F5) release kinetic mechanism. Data comparison was done using the correlation coefficient (R2). Zero-order had an observed correlation coefficient (R2) of 0.9988, which was greater than that for other models. Therefore, it was clear that the medication was released from the formulation after the Zero-order release.ConclusionThe ideal thickness, percent elongation, and tensile strength of the primaquine therapeutic transdermal patches were prepared for transdermal delivery. The therapeutic transdermal patch was prepared by using Eudragit RL100: HPMC K15M (1:2) into the patch because this combination was responsible for the significant delivery of the drug into the bloodstream. The therapeutic transdermal patch has a notable penetration rate. Dimethyl sulfoxide was used as a permeation enhancer, which helped to obtain a high penetration rate. The statistical analysis was used to support the improved formulation. The therapeutic transdermal patch is a potential vehicle for the administration of primaquine, according to stability studies.

Capsaicin has been applied topically to treat some peripheral painful states, such as rheumatoid arthritis, cancer pain and diabetic neuropathy. Due to the pre-systemic metabolism of intragastric capsaicin and very rapid elimination half-life made topical application of capsaicin advantageous. The aim of this study was to evaluate differences in the dissolution characteristics of capsaicin transdermal patches commercially available on the local market (formulation I, II and III). USP Apparatus 5 (Paddle Over Disc) is used for transdermal patch release testing at fixed rotation speed (50 rpm). The 9 cm2 patch was exposed to 500 mL of phosphate buffer solution pH 4.0, 5.0 and 7.4. All dissolution studies were carried out at 32 ± 0.5 °C and samples were collected at various time intervals (60, 240, 480 and 720 min) and analyzed for capsaicin content using optimized and validated high-performance liquid chromatography (HPLC). The mobile phase consisted of acetonitrile:water (50:50 v/v). pH change in the release media showed no significant difference in capsaicin release profile for formulation I and II. For formulation III, the resulting results vary considerably with pH change. Although several apparatus and procedures have been used to study in vitro release characteristics of transdermal patches, USP Apparatus 5 could be considered as a discriminatory test that would be able to detect the differences in the dissolution rate of all tested capsaicin patches at short sampling intervals (1–12 h).

Zero-day vulnerabilities remain one of the major security threats that are faced by organizations. Once a vendor learns about a zero-day vulnerability, releasing a timely patch becomes a priority given the risk of zero-day exploits. However, we still lack information on the factors that affect patch release time of such vulnerabilities. The main objective of this study is to examine the impact of other as-yet unexplored factors on the patch release time of zero-day vulnerabilities. Using zero-day vulnerability dataset captured between 2010 and 2020, we employ survival analysis technique. Our model explores the impact of vulnerability attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability impact on patch release timing. Findings show that a zero-day vulnerability is more likely to be patched on time if the vulnerability results in a scope change and affects more vendors, products, and versions. However, a zero-day vulnerability is less likely to be patched on time if it requires privileges and impacts confidentiality. Our sub-analyses also reveal how patch release times vary across different products and vulnerability types.

Security vulnerabilities in software are one of the primary reasons for security breaches, and an important challenge from knowledge management perspective is to determine how to manage the disclosure of knowledge about those vulnerabilities. The security community has proposed several disclosure mechanisms, such as full vendor, immediate public, and hybrid, and has debated about the merits and demerits of these alternatives. In this paper, we study how vulnerabilities should be disclosed to minimize the social loss. We find that the characteristics of the vulnerability (vulnerability risk before and after disclosure), cost structure of the software user population, and vendor's incentives to develop a patch determine the optimal (responsible) vulnerability disclosure. We show that, unlike some existing vulnerability disclosure mechanisms that fail to motivate the vendor to release its patch, responsible vulnerability disclosure policy always ensures the release of a patch. However, we find that this is not because of the threat of public disclosure, as argued by some security practitioners. In fact, not restricting the vendor with a time constraint can ensure the patch release. This result runs counter to the argument of some that setting a grace period always pushes the vendor to develop a patch. When the vulnerability affects multiple vendors, we show that the responsible disclosure policy cannot ensure that every vendor will release a patch. However, when the optimal policy does elicit a patch from each vendor, we show that the coordinator's grace period in the multiple vendor case falls between the grace periods that it would set individually for the vendors in the single vendor case. This implies that the coordinator does not necessarily increase the grace period to accommodate more vendors. We then extend our base model to analyze the impact of 1) early discovery and 2) an early warning system that provides privileged vulnerability knowledge to selected users before the release of a patch for the vulnerability on responsible vulnerability disclosure. We show that while early discovery always improves the social welfare, an early warning system does not necessarily improve the social welfare

Users’ demand of reliable software in zero time has made the software development more complex. If software industry fails in fulfilling the demands, then it may undergo big penalties and revenue loss. The developers are pressurized subject to resource constraints provided by the management. Despite such fact, software experiences various validation (testing) processes before its release; faults and vulnerabilities are still left undetected that later lack the quality of the product. The only feasible solution for resisting from the lack after the release of software is patch development. Generally, the patches developed for fixing faults and vulnerabilities are a separate process which requires extra resources that increases the total development cost and time. In this paper, we have proposed a cost framework that solves the problem of optimizing the patch release time with two different approaches. Here, the first approach has considered the release of a single patch that fixes both faults and vulnerabilities jointly. As the severity of vulnerabilities is much higher than the faults, the second approach considered the release of two patches where the first patch has fixed both faults and vulnerabilities jointly and other patch specifically fixed only vulnerabilities. The detailed illustration of the method is presented in the proposed paper. The case study is presented at the end for the validation purpose.

We study the question of whether a software vendor should allow users of unlicensed (pirated) copies of a software product to apply security patches. We present a joint model of network software security and software piracy and contrast two policies that a software vendor can enforce: (i) restriction of security patches only to legitimate users or (ii) provision of access to security patches to all users whether their copies are licensed or not. We find that when the software security risk is high and the piracy enforcement level is low, or when tendency for piracy in the consumer population is high, it is optimal for the vendor to restrict unlicensed users from applying security patches. When piracy tendency in the consumer population is low, applying software security patch restrictions is optimal for the vendor only when the piracy enforcement level is high. If patching costs are sufficiently low, however, an unrestricted patch release policy maximizes vendor profits. We also show that the vendor can use security patch restrictions as a substitute to investment in software security, and this effect can significantly reduce welfare. Furthermore, in certain cases, increased piracy enforcement levels can actually hurt vendor profits. We also show that governments can increase social surplus and intellectual property protection simultaneously by increasing piracy enforcement and utilizing the strategic interaction of piracy patch restrictions and network security. Finally, we demonstrate that, although unrestricted patching can maximize welfare when the piracy enforcement level is low, contrary to what one might expect, when the piracy enforcement level is high, restricting security patches only to licensed users can be socially optimal.