SRE-863: Bump vulnerable npm dependencies flagged by weekly security scan by claude[bot] · Pull Request #9101 · hashintel/hash

claude · 2026-07-27T08:40:48Z

Requested by Tim Diekmann · Slack thread

🌟 What is the purpose of this PR?

Resolves the uncovered npm vulnerabilities flagged by the weekly security scan of 2026-07-27 (see SRE-863) via in-range lockfile refreshes and minimal direct bumps.

Before → After (advisories closed):

next 15.5.18 → 15.5.21 — closes 8 advisories: HIGH SSRF in Server Actions GHSA-89xv-2m56-2m9x, HIGH SSRF in rewrites GHSA-p9j2-gv94-2wf4, HIGH DoS in App Router GHSA-m99w-x7hq-7vfj, plus 5 MODERATE (GHSA-4633-3j49-mh5q, GHSA-4c39-4ccg-62r3, GHSA-68g3-v927-f742, GHSA-955p-x3mx-jcvp, GHSA-q8wf-6r8g-63ch)
postcss 8.5.10 / 8.5.14 / 8.5.16 → 8.5.18 / 8.5.22 — HIGH path traversal GHSA-r28c-9q8g-f849, HIGH arbitrary file read GHSA-6g55-p6wh-862q
immutable 5.1.5 → 5.1.9 — HIGH GHSA-v56q-mh7h-f735, HIGH GHSA-xvcm-6775-5m9r
mongoose 9.7.0 → 9.8.0 — MODERATE prototype pollution GHSA-664h-wqgq-64gw
tar 7.5.19 → 7.5.21 — MODERATE GHSA-r292-9mhp-454m
fast-uri 3.1.3 → 3.1.4 — HIGH host confusion GHSA-v2hh-gcrm-f6hx
shell-quote 1.8.4 → 1.9.0 — HIGH quadratic-complexity DoS GHSA-395f-4hp3-45gv
svgo 3.3.3 → 3.3.4 — HIGH GHSA-2p49-hgcm-8545

Dropped from this batch:

@vitest/browser 4.1.8 → 4.1.10 (CRITICAL GHSA-p63j-vcc4-9vmv) — landed on main via H-6728: Upgrade vitest to 4.1.10 to fix @vitest/browser vulnerability (GHSA-p63j-vcc4-9vmv) #9100, which bumped the whole vitest toolchain to 4.1.10. This PR was rebased onto that main to drop its duplicate bump; the diff no longer touches any vitest packages.
@hono/node-server 1.19.14 (MODERATE GHSA-frvp-7c67-39w9) — a fixed 1.x does exist: the path-traversal fix was backported to 1.19.15 (released 2026-07-24, latest-1 dist-tag; verified by tarball diff — the serve-static traversal-guard regex gains |\\), and an interim commit here bumped the lockfile to 1.19.17 in-range. But the GitHub advisory still lists the affected range as < 2.0.5, and this repo's "Dependencies / Review" check is a required status check (org-wide ruleset), so the gate failed on 1.19.17 and the bump was reverted to keep this 9-package batch mergeable. The hono bump is deferred until GitHub narrows the advisory range (then 1.19.17 goes in cleanly in-range), or it goes in as a forced 2.x resolution with human sign-off. GHSA-9mqv-5hh9-4cgg only affects 2.0.0–2.0.9 and never applied to 1.x.

Deliberately excluded per standing decisions: brace-expansion (held), esbuild (blocked by tsup), and packages already covered by open [SECURITY] PRs (#9075, #9081, #9087, #9088, #9089, #9090).

🔗 Related links

SRE-863 (internal)
Slack scan report (internal)

🔍 What does this change?

How each fix landed:

In-range lockfile refresh (yarn.lock only): immutable, mongoose, tar, fast-uri, svgo, and the caret-ranged postcss group (^8.x → 8.5.22)
Direct dependency bumps:
- next 15.5.18 → 15.5.21 in apps/hash-frontend and libs/@local/hash-isomorphic-utils
Resolutions (root package.json) — used only where a direct bump was not possible:
- next/postcss: updated the pre-existing resolution from 8.5.10 → 8.5.18 (next itself pins postcss@8.4.31)
- postcss@npm:8.5.14 → 8.5.18 (new): the vulnerable 8.5.14 is exact-pinned inside @pandacss/*; the latest pandacss release (1.11.5) still pins 8.5.14, so no direct bump can fix it
- shell-quote@npm:1.8.4 → 1.9.0 (new): exact-pinned by concurrently@10.0.3 (via @openapitools/openapi-generator-cli@2.38.0); both concurrently@10.0.4 and openapi-generator-cli@2.40.1 were published <5 days ago and are blocked by the repo's npmMinimalAgeGate: 5d, so a direct bump cannot resolve yet. The resolution can be removed once those age past the gate.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

⚠️ Known issues

@hono/node-server remains at 1.19.14 (see "Dropped" above). The fix is backported in 1.19.15+, but the stale GHSA-frvp-7c67-39w9 advisory range (< 2.0.5) makes the required dependency-review gate reject any 1.19.x, so the bump is deferred until upstream corrects the range.

🐾 Next steps

Remove the shell-quote@npm:1.8.4 resolution once concurrently@10.0.4 / @openapitools/openapi-generator-cli@2.40.1 pass the 5-day age gate and can be bumped directly.
Re-apply the @hono/node-server 1.19.17 in-range bump once GitHub narrows the GHSA-frvp-7c67-39w9 advisory range below 1.19.15 (or land 2.x with human sign-off if the range never gets corrected).

🛡 What tests cover this?

Existing CI (dependency changes only, no code changes)

❓ How to test this?

yarn install --immutable --mode=skip-build — passes
yarn dedupe --strategy highest --check — passes ("No packages can be deduped")
Confirm resolved versions in yarn.lock match the list above

📹 Demo

N/A — dependency bumps only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WfQz9Y36mQ8J6kRC3zaEtt

Generated by Claude Code

vercel · 2026-07-27T08:40:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Jul 27, 2026 11:39pm
hashdotdesign-tokens	Ready	Preview, Comment	Jul 27, 2026 11:39pm
petrinaut	Ready	Preview, Comment	Jul 27, 2026 11:39pm

codecov · 2026-07-27T08:45:33Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.36%. Comparing base (602f13f) to head (a4fb04d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9101   +/-   ##
=======================================
  Coverage   59.36%   59.36%           
=======================================
  Files        1406     1406           
  Lines      136519   136519           
  Branches     6407     6407           
=======================================
+ Hits        81042    81045    +3     
+ Misses      54487    54484    -3     
  Partials      990      990

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.99% <ø> (ø)`
apps.hash-api	`12.10% <ø> (ø)`
blockprotocol.type-system	`40.84% <ø> (ø)`
local.claude-hooks	`0.00% <ø> (ø)`
local.harpc-client	`51.49% <ø> (ø)`
local.hash-backend-utils	`2.55% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
local.hash-isomorphic-utils	`5.75% <ø> (ø)`
rust.antsi	`0.00% <ø> (ø)`
rust.error-stack	`90.89% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-net	`96.24% <ø> (+0.04%)`	⬆️
rust.harpc-tower	`67.03% <ø> (ø)`
rust.harpc-types	`0.00% <ø> (ø)`
rust.harpc-wire-protocol	`92.23% <ø> (ø)`
rust.hash-codec	`72.76% <ø> (ø)`
rust.hash-graph-api	`7.41% <ø> (ø)`
rust.hash-graph-authorization	`62.59% <ø> (ø)`
rust.hash-graph-embeddings	`91.88% <ø> (ø)`
rust.hash-graph-postgres-store	`27.39% <ø> (ø)`
rust.hash-graph-store	`38.71% <ø> (ø)`
rust.hash-graph-temporal-versioning	`47.95% <ø> (ø)`
rust.hash-graph-types	`0.00% <ø> (ø)`
rust.hash-graph-validation	`84.71% <ø> (ø)`
rust.hashql-ast	`89.63% <ø> (ø)`
rust.hashql-compiletest	`28.39% <ø> (ø)`
rust.hashql-core	`78.98% <ø> (ø)`
rust.hashql-diagnostics	`72.51% <ø> (ø)`
rust.hashql-eval	`79.82% <ø> (ø)`
rust.hashql-hir	`89.09% <ø> (ø)`
rust.hashql-mir	`87.92% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.04% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codspeed-hq · 2026-07-27T09:04:41Z

Merging this PR will not alter performance

✅ 98 untouched benchmarks

_{Comparing claude/security-npm-2026-07-27 (e9af032) with main (15de8ae)¹}

No successful run was found on main (602f13f) during the generation of this report, so 15de8ae was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

vilkinsons · 2026-07-27T10:07:47Z

Parts of this PR are being interim-addressed separately (e.g. #9100)

claude · 2026-07-27T10:11:01Z

Only @vitest/browser overlaps with #9100 (same target, 4.1.10 — #9100 bumps the whole vitest toolchain). Once #9100 lands I'll rebase this PR to drop that bump; the other 8 packages here (next, postcss, immutable, mongoose, tar, fast-uri, shell-quote, svgo) aren't covered by it.

- next 15.5.18 -> 15.5.21 (hash-frontend, hash-isomorphic-utils) [8 advisories incl. 3 HIGH] - postcss 8.5.10/8.5.14/8.5.16 -> 8.5.18/8.5.22 (updated next/postcss resolution, new resolution for pandacss's exact 8.5.14 pin, in-range refresh) [GHSA-r28c-9q8g-f849, GHSA-6g55-p6wh-862q] - immutable 5.1.5 -> 5.1.9 (in-range refresh) [GHSA-v56q-mh7h-f735, GHSA-xvcm-6775-5m9r] - mongoose 9.7.0 -> 9.8.0 (in-range refresh) [GHSA-664h-wqgq-64gw] - tar 7.5.19 -> 7.5.21 (in-range refresh) [GHSA-r292-9mhp-454m] - fast-uri 3.1.3 -> 3.1.4 (in-range refresh) [GHSA-v2hh-gcrm-f6hx] - shell-quote 1.8.4 -> 1.9.0 (resolution; concurrently 10.0.4 blocked by npmMinimalAgeGate) [GHSA-395f-4hp3-45gv] - svgo 3.3.3 -> 3.3.4 (in-range refresh) [GHSA-2p49-hgcm-8545] @vitest/browser 4.1.10 bump dropped from this batch: landed on main via #9100. @hono/node-server deferred: fix only available in 2.0.5 (major bump of a transitive dep). Linear: SRE-863

The GHSA-frvp-7c67-39w9 serve-static path-traversal fix, previously believed to be 2.x-only, was backported to 1.19.15 (verified by tarball diff). Every ^1.19.x request now resolves in-range to 1.19.17 with no major bump. Resolved with a one-off relaxation of npmMinimalAgeGate (1.19.15+ is younger than 5 days); the locked version passes the normal immutable install, so CI is unaffected.

github-actions · 2026-07-27T23:14:56Z

Dependency Review

The following issues were found:

❌ 1 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

yarn.lock

Name	Version	Vulnerability	Severity	Patched Version
@hono/node-server	1.19.17	Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)	moderate	2.0.5

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/next

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/next

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@hono/node-server

1.19.17

Unknown

npm/@mongodb-js/saslprep

1.4.12

Unknown

npm/@next/env

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-darwin-arm64

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-darwin-x64

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-arm64-gnu

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-arm64-musl

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-x64-gnu

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-linux-x64-musl

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-win32-arm64-msvc

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/@next/swc-win32-x64-msvc

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/fast-uri

3.1.4

Unknown

npm/immutable

5.1.9

🟢 6.6

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 1/14 approved changesets -- score normalized to 0
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 8	SAST tool is not run on all commits -- score normalized to 8

npm/mongodb

7.5.0

🟢 6.2

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	🟢 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	🟢 10	SAST tool is run on all commits
Fuzzing	⚠️ 0	project is not fuzzed
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0

npm/mongodb-connection-string-url

7.0.2

🟢 6

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	13 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9

npm/mongoose

9.8.0

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 9	security policy file detected
Code-Review	🟢 8	Found 13/16 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 8	SAST tool detected but not run on all commits
Packaging	🟢 10	packaging workflow detected

npm/nanoid

3.3.16

🟢 6.4

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 10	all dependencies are pinned
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/next

15.5.21

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 26/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 10	license file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	⚠️ 0	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/postcss

8.5.18

🟢 7.3

Details

Check	Score	Reason
Code-Review	⚠️ 2	Found 8/30 approved changesets -- score normalized to 2
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/postcss

8.5.22

🟢 7.3

Details

Check	Score	Reason
Code-Review	⚠️ 2	Found 8/30 approved changesets -- score normalized to 2
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/svgo

3.3.4

🟢 6.3

Details

Check	Score	Reason
Code-Review	⚠️ 2	Found 5/21 approved changesets -- score normalized to 2
Maintained	🟢 10	3 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
SAST	🟢 10	SAST tool is run on all commits

npm/tar

7.5.21

🟢 6.2

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Maintained	🟢 10	18 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

apps/hash-frontend/package.json
libs/@local/hash-isomorphic-utils/package.json
yarn.lock

…fix)" This reverts commit 2405158.

github-actions · 2026-07-28T00:32:51Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$25.8 \mathrm{ms} \pm 167 \mathrm{μs}\left({\color{gray}0.065 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.74 \mathrm{ms} \pm 15.5 \mathrm{μs}\left({\color{gray}-1.571 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$11.2 \mathrm{ms} \pm 83.4 \mathrm{μs}\left({\color{gray}0.024 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$37.9 \mathrm{ms} \pm 349 \mathrm{μs}\left({\color{gray}0.330 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$11.2 \mathrm{ms} \pm 77.1 \mathrm{μs}\left({\color{gray}0.555 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$20.3 \mathrm{ms} \pm 202 \mathrm{μs}\left({\color{gray}1.47 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$26.2 \mathrm{ms} \pm 189 \mathrm{μs}\left({\color{gray}-0.405 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.02 \mathrm{ms} \pm 16.2 \mathrm{μs}\left({\color{gray}-0.028 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$12.1 \mathrm{ms} \pm 87.0 \mathrm{μs}\left({\color{gray}0.267 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.10 \mathrm{ms} \pm 24.8 \mathrm{μs}\left({\color{gray}0.531 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.41 \mathrm{ms} \pm 12.8 \mathrm{μs}\left({\color{gray}0.661 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$2.71 \mathrm{ms} \pm 16.0 \mathrm{μs}\left({\color{gray}0.226 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$4.36 \mathrm{ms} \pm 26.5 \mathrm{μs}\left({\color{gray}0.203 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.84 \mathrm{ms} \pm 13.9 \mathrm{μs}\left({\color{gray}0.335 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$3.37 \mathrm{ms} \pm 21.5 \mathrm{μs}\left({\color{gray}0.157 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$3.65 \mathrm{ms} \pm 18.6 \mathrm{μs}\left({\color{gray}-0.927 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.79 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{gray}-0.544 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$3.36 \mathrm{ms} \pm 28.2 \mathrm{μs}\left({\color{gray}1.67 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.09 \mathrm{ms} \pm 12.1 \mathrm{μs}\left({\color{gray}-0.042 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$1.98 \mathrm{ms} \pm 10.4 \mathrm{μs}\left({\color{gray}-0.332 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.08 \mathrm{ms} \pm 13.1 \mathrm{μs}\left({\color{gray}0.759 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.29 \mathrm{ms} \pm 13.3 \mathrm{μs}\left({\color{gray}0.309 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.13 \mathrm{ms} \pm 11.0 \mathrm{μs}\left({\color{gray}-0.292 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.30 \mathrm{ms} \pm 19.3 \mathrm{μs}\left({\color{gray}1.43 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$2.41 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}0.300 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.18 \mathrm{ms} \pm 14.8 \mathrm{μs}\left({\color{gray}0.612 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$2.35 \mathrm{ms} \pm 11.6 \mathrm{μs}\left({\color{gray}-0.191 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$2.71 \mathrm{ms} \pm 14.5 \mathrm{μs}\left({\color{gray}-0.792 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.35 \mathrm{ms} \pm 12.4 \mathrm{μs}\left({\color{gray}0.348 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$2.60 \mathrm{ms} \pm 14.9 \mathrm{μs}\left({\color{gray}-0.482 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$2.66 \mathrm{ms} \pm 15.3 \mathrm{μs}\left({\color{gray}-0.125 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.31 \mathrm{ms} \pm 8.82 \mathrm{μs}\left({\color{gray}-0.082 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$2.61 \mathrm{ms} \pm 13.9 \mathrm{μs}\left({\color{gray}-0.372 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$36.8 \mathrm{ms} \pm 169 \mathrm{μs}\left({\color{gray}1.31 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$27.1 \mathrm{ms} \pm 147 \mathrm{μs}\left({\color{gray}-1.010 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$29.5 \mathrm{ms} \pm 170 \mathrm{μs}\left({\color{gray}-0.144 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$26.6 \mathrm{ms} \pm 189 \mathrm{μs}\left({\color{lightgreen}-30.015 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$35.5 \mathrm{ms} \pm 247 \mathrm{μs}\left({\color{gray}1.82 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$44.5 \mathrm{ms} \pm 318 \mathrm{μs}\left({\color{gray}2.73 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$34.2 \mathrm{ms} \pm 214 \mathrm{μs}\left({\color{gray}0.885 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$82.2 \mathrm{ms} \pm 541 \mathrm{μs}\left({\color{gray}2.70 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$28.3 \mathrm{ms} \pm 173 \mathrm{μs}\left({\color{gray}0.165 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$244 \mathrm{ms} \pm 827 \mathrm{μs}\left({\color{gray}-0.742 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$8.93 \mathrm{ms} \pm 45.6 \mathrm{μs}\left({\color{gray}0.843 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$9.11 \mathrm{ms} \pm 58.2 \mathrm{μs}\left({\color{gray}1.04 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$9.05 \mathrm{ms} \pm 42.6 \mathrm{μs}\left({\color{gray}0.220 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$9.00 \mathrm{ms} \pm 52.3 \mathrm{μs}\left({\color{gray}1.12 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$9.01 \mathrm{ms} \pm 57.2 \mathrm{μs}\left({\color{gray}0.125 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$8.93 \mathrm{ms} \pm 37.5 \mathrm{μs}\left({\color{gray}0.050 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$9.02 \mathrm{ms} \pm 36.0 \mathrm{μs}\left({\color{gray}0.725 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$8.99 \mathrm{ms} \pm 48.1 \mathrm{μs}\left({\color{gray}-0.125 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$9.19 \mathrm{ms} \pm 51.0 \mathrm{μs}\left({\color{gray}1.18 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$9.29 \mathrm{ms} \pm 45.9 \mathrm{μs}\left({\color{gray}-0.220 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$9.41 \mathrm{ms} \pm 71.4 \mathrm{μs}\left({\color{gray}0.619 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$9.35 \mathrm{ms} \pm 45.8 \mathrm{μs}\left({\color{gray}-1.926 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$9.35 \mathrm{ms} \pm 44.4 \mathrm{μs}\left({\color{gray}0.316 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$9.36 \mathrm{ms} \pm 44.7 \mathrm{μs}\left({\color{gray}-0.274 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$9.34 \mathrm{ms} \pm 46.1 \mathrm{μs}\left({\color{gray}-0.448 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$9.43 \mathrm{ms} \pm 55.0 \mathrm{μs}\left({\color{gray}0.321 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$9.38 \mathrm{ms} \pm 47.0 \mathrm{μs}\left({\color{gray}0.293 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$9.38 \mathrm{ms} \pm 46.3 \mathrm{μs}\left({\color{gray}-0.100 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$9.35 \mathrm{ms} \pm 41.8 \mathrm{μs}\left({\color{gray}-1.299 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$6.89 \mathrm{ms} \pm 38.1 \mathrm{μs}\left({\color{gray}0.473 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$55.3 \mathrm{ms} \pm 403 \mathrm{μs}\left({\color{red}5.53 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$97.9 \mathrm{ms} \pm 452 \mathrm{μs}\left({\color{gray}2.89 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$61.1 \mathrm{ms} \pm 361 \mathrm{μs}\left({\color{gray}4.15 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$69.5 \mathrm{ms} \pm 578 \mathrm{μs}\left({\color{gray}4.55 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$76.8 \mathrm{ms} \pm 415 \mathrm{μs}\left({\color{gray}4.69 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$80.9 \mathrm{ms} \pm 418 \mathrm{μs}\left({\color{gray}4.08 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$39.8 \mathrm{ms} \pm 333 \mathrm{μs}\left({\color{gray}0.188 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$63.7 \mathrm{ms} \pm 381 \mathrm{μs}\left({\color{gray}1.43 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$44.8 \mathrm{ms} \pm 217 \mathrm{μs}\left({\color{gray}1.32 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$52.8 \mathrm{ms} \pm 332 \mathrm{μs}\left({\color{gray}1.28 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$54.9 \mathrm{ms} \pm 451 \mathrm{μs}\left({\color{gray}1.68 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$54.7 \mathrm{ms} \pm 386 \mathrm{μs}\left({\color{gray}2.06 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$116 \mathrm{ms} \pm 808 \mathrm{μs}\left({\color{gray}0.650 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$125 \mathrm{ms} \pm 477 \mathrm{μs}\left({\color{gray}0.632 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$16.2 \mathrm{ms} \pm 89.8 \mathrm{μs}\left({\color{gray}-1.036 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$479 \mathrm{ms} \pm 1.23 \mathrm{ms}\left({\color{gray}1.96 \mathrm{\%}}\right) $$	Flame Graph

cursor · 2026-08-03T08:15:16Z

PR Summary

Medium Risk
Bumps Next.js and several high-severity transitive deps used by the frontend and data layer; behavior should be patch-level but warrants normal CI and smoke checks on the App Router.

Overview
Addresses SRE-863 by bumping vulnerable npm packages—no application code changes.

next is raised from 15.5.18 to 15.5.21 in apps/hash-frontend and libs/@local/hash-isomorphic-utils, with matching @next/* SWC packages in the lockfile. Root resolutions move next/postcss to 8.5.18, add postcss@npm:8.5.14 → 8.5.18 (for @pandacss/* pins), and shell-quote@npm:1.8.4 → 1.9.0 (for concurrently / openapi-generator until direct bumps pass the age gate).

yarn.lock refreshes transitive fixes: postcss (8.5.18 / 8.5.22), mongoose 9.8.0 (and mongodb ~7.5), immutable, tar, fast-uri, svgo, nanoid, and related checksum updates.

^{Reviewed by Cursor Bugbot for commit e9af032. Bugbot is set up for automated code reviews on this repo. Configure here.}

claude Bot assigned CiaranMn Jul 27, 2026

vercel Bot temporarily deployed to Preview – hashdotdesign-tokens July 27, 2026 08:42 Inactive

vercel Bot temporarily deployed to Preview – petrinaut July 27, 2026 08:49 Inactive

vercel Bot deployed to Preview – hash July 27, 2026 09:05 View deployment

vilkinsons requested a review from CiaranMn July 27, 2026 10:07

claude Bot force-pushed the claude/security-npm-2026-07-27 branch from cee582b to a4fb04d Compare July 27, 2026 22:46

github-actions Bot removed the area/apps > hash.design Affects the `hash.design` design site (app) label Jul 27, 2026

vercel Bot temporarily deployed to Preview – hashdotdesign-tokens July 27, 2026 22:48 Inactive

vercel Bot temporarily deployed to Preview – petrinaut July 27, 2026 22:58 Inactive

vercel Bot deployed to Preview – hash July 27, 2026 23:05 View deployment

vercel Bot temporarily deployed to Preview – hashdotdesign-tokens July 27, 2026 23:16 Inactive

Revert "Bump @hono/node-server to 1.19.17 (backported path-traversal …

e9af032

…fix)" This reverts commit 2405158.

vercel Bot temporarily deployed to Preview – hashdotdesign-tokens July 27, 2026 23:19 Inactive

vercel Bot temporarily deployed to Preview – petrinaut July 27, 2026 23:26 Inactive

claude Bot marked this pull request as ready for review August 3, 2026 08:14

This was referenced Aug 3, 2026

Update npm package next to v15.5.21 [SECURITY] #9108

Closed

Update npm package postcss to v8.5.18 [SECURITY] #9109

Closed

CiaranMn approved these changes Aug 3, 2026

View reviewed changes

CiaranMn added this pull request to the merge queue Aug 3, 2026

Merged via the queue into main with commit da69e4f Aug 3, 2026
191 checks passed

CiaranMn deleted the claude/security-npm-2026-07-27 branch August 3, 2026 09:39

Uh oh!

Conversation

claude Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌟 What is the purpose of this PR?

🔗 Related links

🔍 What does this change?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

📹 Demo

Uh oh!

vercel Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed-hq Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

vilkinsons commented Jul 27, 2026

Uh oh!

claude Bot commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Dependency Review

Vulnerabilities

yarn.lock

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions Bot commented Jul 28, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

cursor Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

claude Bot commented Jul 27, 2026 •

edited

Loading

vercel Bot commented Jul 27, 2026 •

edited

Loading

codecov Bot commented Jul 27, 2026 •

edited

Loading

codspeed-hq Bot commented Jul 27, 2026 •

edited

Loading

cursor Bot commented Aug 3, 2026 •

edited

Loading