H-6340: Update flatted, tar, undici

[CiaranMn]

🌟 What is the purpose of this PR?

Update transitive dependencies with security vulnerabilities.

Also ninja edits a Petrinaut version bump from minor to patch.

[cursor]

PR Summary

Low Risk
Primarily lockfile-only transitive dependency updates plus a changeset bump tweak; low functional risk, with the main risk being unexpected behavior changes from updated networking/archive libs.

Overview
Updates transitive dependencies in yarn.lock to newer patched versions (flatted, tar, undici) to address known vulnerabilities.

Also adjusts the @hashintel/petrinaut changeset in .changeset/bright-ideas-flow.md from a minor to a patch release.

^{Written by Cursor Bugbot for commit 83d05c2. This will update automatically on new commits. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Mar 19, 2026 2:23pm
hashdotdesign	Ready	Preview, Comment	Mar 19, 2026 2:23pm
hashdotdesign-tokens	Ready	Preview, Comment	Mar 19, 2026 2:23pm
petrinaut	Ready	Preview, Comment	Mar 19, 2026 2:23pm

[augmentcode]

🤖 Augment PR Summary

Summary: Updates transitive dependencies (via yarn.lock) to address security vulnerabilities.
Changes: Adjusts the pending Changeset for @hashintel/petrinaut from a minor to a patch release.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[TimDiekmann]

@TimDiekmann approved this PR from Slack with Graphite

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.49%. Comparing base (e0e4091) to head (83d05c2).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8562      +/-   ##
==========================================
- Coverage   62.60%   62.49%   -0.11%     
==========================================
  Files        1317     1318       +1     
  Lines      133977   134211     +234     
  Branches     5517     5517              
==========================================
  Hits        83877    83877              
- Misses      49185    49419     +234     
  Partials      915      915              

Flag	Coverage Δ
apps.hash-ai-worker-ts	1.40% <ø> (ø)
apps.hash-api	0.00% <ø> (ø)
blockprotocol.type-system	40.84% <ø> (ø)
local.claude-hooks	0.00% <ø> (ø)
local.harpc-client	51.24% <ø> (ø)
local.hash-graph-sdk	9.63% <ø> (ø)
local.hash-isomorphic-utils	0.00% <ø> (ø)
rust.antsi	0.00% <ø> (ø)
rust.error-stack	90.88% <ø> (ø)
rust.harpc-codec	84.70% <ø> (ø)
rust.harpc-net	96.16% <ø> (ø)
rust.harpc-tower	66.80% <ø> (ø)
rust.harpc-types	0.00% <ø> (ø)
rust.harpc-wire-protocol	92.23% <ø> (ø)
rust.hash-codec	72.76% <ø> (ø)
rust.hash-graph-api	2.52% <ø> (ø)
rust.hash-graph-authorization	62.34% <ø> (ø)
rust.hash-graph-postgres-store	26.39% <ø> (-0.34%)	⬇️
rust.hash-graph-store	37.76% <ø> (-0.13%)	⬇️
rust.hash-graph-temporal-versioning	47.95% <ø> (ø)
rust.hash-graph-types	0.00% <ø> (ø)
rust.hash-graph-validation	83.45% <ø> (ø)
rust.hashql-ast	87.23% <ø> (ø)
rust.hashql-compiletest	29.69% <ø> (ø)
rust.hashql-core	82.29% <ø> (ø)
rust.hashql-diagnostics	72.43% <ø> (ø)
rust.hashql-eval	69.13% <ø> (ø)
rust.hashql-hir	89.06% <ø> (ø)
rust.hashql-mir	92.64% <ø> (ø)
rust.hashql-syntax-jexpr	94.05% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will not alter performance

✅ 80 untouched benchmarks

---

_{Comparing cm/more-dep-updates (83d05c2) with main (ee670b9)¹}

Footnotes

1. No successful run was found on main (fe49d7c) during the generation of this report, so ee670b9 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[github-actions]

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$26.7 \mathrm{ms} \pm 117 \mathrm{μs}\left({\color{gray}0.956 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.86 \mathrm{ms} \pm 13.8 \mathrm{μs}\left({\color{gray}-0.033 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1001	$$12.2 \mathrm{ms} \pm 77.7 \mathrm{μs}\left({\color{gray}0.832 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$38.8 \mathrm{ms} \pm 239 \mathrm{μs}\left({\color{gray}0.390 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$12.2 \mathrm{ms} \pm 95.9 \mathrm{μs}\left({\color{gray}0.807 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1526	$$21.6 \mathrm{ms} \pm 118 \mathrm{μs}\left({\color{gray}0.239 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$27.5 \mathrm{ms} \pm 161 \mathrm{μs}\left({\color{gray}1.19 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.14 \mathrm{ms} \pm 15.3 \mathrm{μs}\left({\color{gray}0.731 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$13.2 \mathrm{ms} \pm 61.0 \mathrm{μs}\left({\color{gray}2.88 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.18 \mathrm{ms} \pm 16.2 \mathrm{μs}\left({\color{gray}0.678 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.44 \mathrm{ms} \pm 10.1 \mathrm{μs}\left({\color{gray}-0.405 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 51	$$2.78 \mathrm{ms} \pm 11.1 \mathrm{μs}\left({\color{gray}-0.114 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$4.54 \mathrm{ms} \pm 25.0 \mathrm{μs}\left({\color{gray}-0.487 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.00 \mathrm{ms} \pm 15.6 \mathrm{μs}\left({\color{gray}-0.012 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 107	$$3.52 \mathrm{ms} \pm 19.1 \mathrm{μs}\left({\color{gray}0.784 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$3.84 \mathrm{ms} \pm 20.2 \mathrm{μs}\left({\color{gray}0.201 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.89 \mathrm{ms} \pm 15.7 \mathrm{μs}\left({\color{gray}0.996 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$3.48 \mathrm{ms} \pm 19.5 \mathrm{μs}\left({\color{gray}2.08 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.21 \mathrm{ms} \pm 10.9 \mathrm{μs}\left({\color{gray}0.647 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.18 \mathrm{ms} \pm 8.49 \mathrm{μs}\left({\color{gray}1.18 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1	$$2.27 \mathrm{ms} \pm 10.3 \mathrm{μs}\left({\color{gray}0.671 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.51 \mathrm{ms} \pm 11.8 \mathrm{μs}\left({\color{gray}1.09 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.33 \mathrm{ms} \pm 9.24 \mathrm{μs}\left({\color{gray}0.715 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.59 \mathrm{ms} \pm 14.3 \mathrm{μs}\left({\color{gray}1.28 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$2.53 \mathrm{ms} \pm 10.7 \mathrm{μs}\left({\color{gray}0.575 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.26 \mathrm{ms} \pm 8.52 \mathrm{μs}\left({\color{gray}-0.251 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 25	$$2.39 \mathrm{ms} \pm 10.1 \mathrm{μs}\left({\color{gray}0.618 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$2.86 \mathrm{ms} \pm 14.9 \mathrm{μs}\left({\color{gray}-0.436 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.52 \mathrm{ms} \pm 10.9 \mathrm{μs}\left({\color{gray}0.038 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 26	$$2.70 \mathrm{ms} \pm 14.9 \mathrm{μs}\left({\color{gray}0.218 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$2.78 \mathrm{ms} \pm 14.0 \mathrm{μs}\left({\color{gray}-1.213 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.52 \mathrm{ms} \pm 12.9 \mathrm{μs}\left({\color{gray}0.723 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$2.70 \mathrm{ms} \pm 14.8 \mathrm{μs}\left({\color{gray}0.527 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$38.9 \mathrm{ms} \pm 146 \mathrm{μs}\left({\color{gray}-2.184 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$78.4 \mathrm{ms} \pm 246 \mathrm{μs}\left({\color{gray}-0.656 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$43.8 \mathrm{ms} \pm 170 \mathrm{μs}\left({\color{gray}1.92 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$48.3 \mathrm{ms} \pm 287 \mathrm{μs}\left({\color{gray}0.693 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$55.0 \mathrm{ms} \pm 178 \mathrm{μs}\left({\color{gray}1.68 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$41.7 \mathrm{ms} \pm 168 \mathrm{μs}\left({\color{gray}1.76 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$426 \mathrm{ms} \pm 738 \mathrm{μs}\left({\color{gray}-1.055 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$89.4 \mathrm{ms} \pm 387 \mathrm{μs}\left({\color{gray}-1.598 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$92.3 \mathrm{ms} \pm 337 \mathrm{μs}\left({\color{gray}0.206 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$259 \mathrm{ms} \pm 881 \mathrm{μs}\left({\color{gray}-0.122 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$17.2 \mathrm{ms} \pm 85.9 \mathrm{μs}\left({\color{gray}-1.143 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$17.7 \mathrm{ms} \pm 70.6 \mathrm{μs}\left({\color{gray}0.033 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$17.9 \mathrm{ms} \pm 75.6 \mathrm{μs}\left({\color{gray}-0.025 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$18.4 \mathrm{ms} \pm 74.9 \mathrm{μs}\left({\color{gray}4.19 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$21.6 \mathrm{ms} \pm 103 \mathrm{μs}\left({\color{gray}-1.705 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$17.2 \mathrm{ms} \pm 95.1 \mathrm{μs}\left({\color{gray}2.80 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$17.4 \mathrm{ms} \pm 78.5 \mathrm{μs}\left({\color{gray}1.56 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$17.3 \mathrm{ms} \pm 73.9 \mathrm{μs}\left({\color{gray}1.28 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$17.9 \mathrm{ms} \pm 101 \mathrm{μs}\left({\color{gray}1.92 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$24.0 \mathrm{ms} \pm 192 \mathrm{μs}\left({\color{gray}-0.871 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1	$$31.4 \mathrm{ms} \pm 300 \mathrm{μs}\left({\color{gray}-0.743 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1	$$31.6 \mathrm{ms} \pm 244 \mathrm{μs}\left({\color{gray}-2.123 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1	$$31.8 \mathrm{ms} \pm 301 \mathrm{μs}\left({\color{gray}0.416 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1	$$32.4 \mathrm{ms} \pm 327 \mathrm{μs}\left({\color{gray}2.99 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2	$$31.3 \mathrm{ms} \pm 291 \mathrm{μs}\left({\color{gray}-3.433 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1	$$32.2 \mathrm{ms} \pm 322 \mathrm{μs}\left({\color{gray}0.820 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1	$$32.0 \mathrm{ms} \pm 292 \mathrm{μs}\left({\color{gray}3.53 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1	$$32.1 \mathrm{ms} \pm 322 \mathrm{μs}\left({\color{gray}1.49 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1	$$31.7 \mathrm{ms} \pm 290 \mathrm{μs}\left({\color{gray}3.30 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba	$$6.94 \mathrm{ms} \pm 25.9 \mathrm{μs}\left({\color{gray}-0.196 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$94.1 \mathrm{ms} \pm 405 \mathrm{μs}\left({\color{gray}-0.882 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$139 \mathrm{ms} \pm 625 \mathrm{μs}\left({\color{gray}0.327 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$99.6 \mathrm{ms} \pm 335 \mathrm{μs}\left({\color{gray}-1.625 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$107 \mathrm{ms} \pm 394 \mathrm{μs}\left({\color{gray}-1.099 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$114 \mathrm{ms} \pm 464 \mathrm{μs}\left({\color{gray}-1.719 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$121 \mathrm{ms} \pm 513 \mathrm{μs}\left({\color{gray}0.557 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$99.1 \mathrm{ms} \pm 373 \mathrm{μs}\left({\color{gray}0.363 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$122 \mathrm{ms} \pm 521 \mathrm{μs}\left({\color{gray}-0.347 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$105 \mathrm{ms} \pm 472 \mathrm{μs}\left({\color{gray}-0.902 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$111 \mathrm{ms} \pm 419 \mathrm{μs}\left({\color{gray}-0.736 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$113 \mathrm{ms} \pm 389 \mathrm{μs}\left({\color{gray}-0.711 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$114 \mathrm{ms} \pm 456 \mathrm{μs}\left({\color{gray}0.292 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$128 \mathrm{ms} \pm 497 \mathrm{μs}\left({\color{gray}0.754 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$135 \mathrm{ms} \pm 436 \mathrm{μs}\left({\color{gray}-1.294 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$90.2 \mathrm{ms} \pm 464 \mathrm{μs}\left({\color{gray}0.694 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$498 \mathrm{ms} \pm 1.66 \mathrm{ms}\left({\color{gray}-0.628 \mathrm{\%}}\right) $$	Flame Graph