SRE-938: Fix npm vulnerabilities from the 2026-08-10 scan by claude[bot] · Pull Request #9182 · hashintel/hash

claude · 2026-08-10T08:56:30Z

Requested by Tim Diekmann · Slack thread

🌟 What is the purpose of this PR?

Closes 25 of the 26 open npm vulnerability findings the 2026-08-10 weekly scan reported against this repo, in one PR, and supersedes four Renovate security PRs that cannot merge.

Before: yarn.lock carried vulnerable copies of nine packages. Most of them are transitive dependencies whose parents' semver ranges already allow a patched release — they were simply never re-resolved. The rest were held down by direct version pins and by root resolutions entries.

After: the lockfile has been re-resolved and deduped, and the four pins/resolutions that were blocking the remaining upgrades have been moved. Every vulnerable version listed below is now absent from yarn.lock — not merely accompanied by a newer entry (see the gone-check below).

Why this replaces the four Renovate PRs

#9173 (postcss), #9175 (js-yaml), #9180 (dompurify) and #9181 (nanoid) each change package.json and leave yarn.lock untouched, so every Yarn step in CI aborts. Renovate's own artifact-update comment on each names the cause: this repo declares packageManager: yarn@4.16.0, but the Renovate runner's global Yarn is 1.22.22 with Corepack disabled, so it cannot write a Yarn Berry lockfile. This is the same standing runner defect first seen on internal-sites (#198/#199/#200) on 2026-08-06; it is now reproducing here. Fixing the runner is out of scope for this PR and is worth its own ticket.

Two of them also needed correcting, not just relocking:

#9173 is incomplete. The root package.json has two postcss resolutions, next/postcss and postcss@npm:8.5.14. The PR bumps only the first, so the vulnerable 8.5.18 copy would have survived and GHSA-fxqj-rqcc-2cmp would have stayed open. Both are moved here.
#9181 takes two majors. It moves @apps/hash-api's exact nanoid pin from 3.3.11 straight to 5.1.16. nanoid 5 is ESM-only (no main, no CJS entry point) with a Node ≥18 floor, whereas 3.3.17 keeps the dual main: index.cjs / module: index.js layout that 3.3.11 has. 3.3.17 closes both nanoid advisories on its own, so there is no reason to take a major inside a security fix — and it lets the pinned copy collapse into the same lockfile entry as the transitive nanoid@npm:^3.0.0 / ^3.3.16 range instead of adding a third one. If nanoid 5 is wanted in hash-api, that belongs in a separate non-security PR.

🔗 Related links

Linear: SRE-938 (internal)
Supersedes Update npm package postcss to v8.5.23 [SECURITY] #9173, Update npm package js-yaml to v4.3.1 [SECURITY] #9175, Update npm package dompurify to v3.4.13 [SECURITY] #9180, Update npm package nanoid to v5 [SECURITY] #9181

🚫 Blocked by

Nothing

🔍 What does this change?

Manifest changes — direct pins and resolutions that were blocking a patched resolution:

Package	From	To	Where
`dompurify`	3.4.12	3.4.13	root `resolutions`, `@apps/hash-frontend`
`js-yaml`	4.3.0	4.3.1	`@apps/hash-api`, `@local/repo-chores`, `@tests/hash-playwright`, `@redocly/openapi-core/js-yaml` resolution
`nanoid`	3.3.11	3.3.17	`@apps/hash-api`
`postcss`	8.5.18	8.5.25	`next/postcss` and `postcss@npm:8.5.14` resolutions

Lockfile-only changes — transitive dependencies whose parents already admitted the fix, so no manifest change was needed:

Package	From	To
`brace-expansion`	1.1.17 / 2.1.3 / 5.0.8	1.1.18 / 2.1.4 / 5.0.9
`fast-uri`	3.1.4	3.1.5
`hono`	4.12.29	4.13.0
`ip-address`	10.2.0	10.4.0
`js-yaml`	3.15.0	3.15.1
`nanoid`	3.3.16 / 5.1.6	3.3.17 / 5.1.16
`postcss`	8.5.22	8.5.25
`undici`	7.28.0	7.29.0

Regenerated with yarn install followed by yarn dedupe --strategy highest; yarn lint:yarn-deduplicate reports nothing left to dedupe. Targets are the highest release the repo's npmMinimalAgeGate: 5d admits, which is why postcss stops at 8.5.25 rather than 8.5.26, hono at 4.13.0 rather than 4.13.1, nanoid at 3.3.17 rather than 3.3.18 and ip-address at 10.4.0 rather than 10.5.0. No gate override was needed — every version above is more than five days old.

Why the resolutions stay resolutions

Per the "bump the pinning parent before adding or keeping an override" rule, each remaining override was re-checked against the registry:

next/postcss — next 15.5.x still exact-pins postcss 8.4.31 in every release up to the current 15.5.23. Only next 16.3.0 moves to 8.5.23, and that is a major upgrade of Next, not a security fix.
postcss@npm:8.5.14 — this descriptor comes from PandaCSS (@pandacss/core, @pandacss/generator, @pandacss/node, @pandacss/postcss). The current latest, 1.12.0, still exact-pins postcss 8.5.14.
@redocly/openapi-core/js-yaml — the repo is on @redocly/openapi-core@^1.34.6. The newest 1.x, 1.34.18, pins js-yaml 4.3.0, which is itself the vulnerable version; only the 2.x major moves to js-yaml ^5.2.2.
dompurify — kept global because monaco-editor@0.55.1 pulls in dompurify 3.2.7, which is affected by this advisory and several older ones. The resolution collapses it onto the patched copy.

Gone-check

Every vulnerable version has zero resolution: entries in the new yarn.lock:

brace-expansion@npm:1.1.17   0      nanoid@npm:3.3.11       0
brace-expansion@npm:2.1.3    0      nanoid@npm:3.3.16       0
brace-expansion@npm:5.0.8    0      nanoid@npm:5.1.6        0
dompurify@npm:3.4.12         0      postcss@npm:8.5.14      0
dompurify@npm:3.2.7          0      postcss@npm:8.5.18      0
fast-uri@npm:3.1.4           0      postcss@npm:8.5.22      0
hono@npm:4.12.29             0      undici@npm:7.28.0       0
ip-address@npm:10.2.0        0      js-yaml@npm:3.15.0      0
js-yaml@npm:4.2.0            0      js-yaml@npm:4.3.0       0

The yarn.lock diff is +48/−68: entries are removed, not merely added. Re-running the whole lockfile through npm's bulk advisory endpoint before and after the change shows 23 advisory rows closed and zero new ones.

Advisories closed

Advisory	Sev	Package
GHSA-rgw5-rvv9-x895	High	`brace-expansion` 1.1.17, 2.1.3, 5.0.8
GHSA-7p8r-x3mc-p8w7	High	`fast-uri` 3.1.4
GHSA-mwp4-54f8-5fhr	High	`ip-address` 10.2.0
GHSA-5p4m-2wfm-xmqj	High	`js-yaml` 3.15.0, 4.3.0
GHSA-28wg-ghj8-5hjv	High	`nanoid` 3.3.11, 5.1.6
GHSA-2v37-7h3g-55p8	High	`nanoid` 3.3.11, 3.3.16
GHSA-4cwx-7wf7-3272	High	`undici` 7.28.0
GHSA-55q2-fjhq-7xh7	Moderate	`dompurify` 3.4.12
GHSA-54fx-42gc-7vw4	Moderate	`hono` 4.12.29
GHSA-8j4g-w8fx-2239	Moderate	`hono` 4.12.29
GHSA-f23p-vx2j-j53r	Moderate	`hono` 4.12.29
GHSA-22jq-vg5j-6vgg	Moderate	`ip-address` 10.2.0
GHSA-4xrf-jv44-h6hh	Moderate	`ip-address` 10.2.0
GHSA-fxqj-rqcc-2cmp	Moderate	`postcss` 8.5.18, 8.5.22
GHSA-8xcm-r25x-g524	Moderate	`undici` 7.28.0
GHSA-jr45-8vmc-qm54	Moderate	`undici` 7.28.0
GHSA-m8rv-5g2x-5cg5	Moderate	`undici` 7.28.0
GHSA-v3r7-h72x-cjcm	Moderate	`undici` 7.28.0
GHSA-79qm-7rj5-m7r9	Low	`hono` 4.12.29

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

⚠️ Known issues

esbuild 0.27.7 (GHSA-g7r4-m6w7-qqqr, low) is the one finding this PR does not close, and it is deliberately left alone. tsup's latest release (8.5.1) still declares esbuild: ^0.27.0, and vite@7.3.5 and storybook 9.x/10.x also cap at ^0.27.0, so 0.28.1 is unreachable without forcing an override past several parents' declared ranges. Unchanged from the 2026-07-20 assessment.

🐾 Next steps

Close Update npm package postcss to v8.5.23 [SECURITY] #9173, Update npm package js-yaml to v4.3.1 [SECURITY] #9175, Update npm package dompurify to v3.4.13 [SECURITY] #9180 and Update npm package nanoid to v5 [SECURITY] #9181 once this is green.
The Renovate runner cannot regenerate Yarn Berry lockfiles (global Yarn 1.22.22, Corepack disabled). Until that is fixed, every lockfile-bearing Renovate PR on this repo and on internal-sites will land broken and need this same manual repair. Worth its own ticket.

🛡 What tests cover this?

The existing CI suite. There are no source changes — only dependency versions — so the signal is that lint, typecheck, unit, integration and the Docker/Vercel builds all still pass against the re-resolved tree.

❓ How to test this?

Check out the branch and run yarn install --immutable — it should complete without rewriting the lockfile.
Run yarn lint:yarn-deduplicate — it should report nothing to dedupe.
Grep yarn.lock for any of the versions in the gone-check table above — there should be no matches.

Refresh yarn.lock and bump the pins and resolutions holding vulnerable copies in place, closing 25 of the 26 open npm findings in this repo. Direct pins and resolutions: - dompurify 3.4.12 -> 3.4.13 (root resolution + @apps/hash-frontend) - js-yaml 4.3.0 -> 4.3.1 (@apps/hash-api, @local/repo-chores, @tests/hash-playwright, @redocly/openapi-core/js-yaml resolution) - nanoid 3.3.11 -> 3.3.17 (@apps/hash-api) - postcss 8.5.18 -> 8.5.25 (both next/postcss and postcss@npm:8.5.14 resolutions; Renovate bumped only the first) Re-resolved transitively, no manifest change needed: - brace-expansion 1.1.17/2.1.3/5.0.8 -> 1.1.18/2.1.4/5.0.9 - fast-uri 3.1.4 -> 3.1.5 - hono 4.12.29 -> 4.13.0 - ip-address 10.2.0 -> 10.4.0 - js-yaml 3.15.0 -> 3.15.1 - nanoid 3.3.16 -> 3.3.17, 5.1.6 -> 5.1.16 - postcss 8.5.22 -> 8.5.25 - undici 7.28.0 -> 7.29.0 Supersedes #9173, #9175, #9180 and #9181, none of which regenerated the lockfile.

vercel · 2026-08-10T08:56:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 10, 2026 9:09am
hashdotdesign-tokens	Ready	Preview	Aug 10, 2026 9:09am
petrinaut	Ready	Preview	Aug 10, 2026 9:09am

codecov · 2026-08-10T09:01:19Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.58%. Comparing base (77fb79c) to head (8ea6bc0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9182   +/-   ##
=======================================
  Coverage   59.58%   59.58%           
=======================================
  Files        1419     1419           
  Lines      138220   138220           
  Branches     6549     6549           
=======================================
+ Hits        82355    82357    +2     
+ Misses      54801    54799    -2     
  Partials     1064     1064

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.99% <ø> (ø)`
apps.hash-api	`14.00% <ø> (ø)`
blockprotocol.type-system	`40.84% <ø> (ø)`
local.claude-hooks	`0.00% <ø> (ø)`
local.harpc-client	`51.49% <ø> (ø)`
local.hash-backend-utils	`3.27% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
local.hash-isomorphic-utils	`12.22% <ø> (ø)`
rust.antsi	`2.36% <ø> (ø)`
rust.error-stack	`90.81% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-net	`96.24% <ø> (+0.03%)`	⬆️
rust.harpc-tower	`67.03% <ø> (ø)`
rust.harpc-types	`0.00% <ø> (ø)`
rust.harpc-wire-protocol	`92.23% <ø> (ø)`
rust.hash-codec	`72.76% <ø> (ø)`
rust.hash-graph-api	`7.36% <ø> (ø)`
rust.hash-graph-authorization	`62.59% <ø> (ø)`
rust.hash-graph-embeddings	`91.88% <ø> (ø)`
rust.hash-graph-postgres-store	`29.66% <ø> (ø)`
rust.hash-graph-store	`42.16% <ø> (ø)`
rust.hash-graph-temporal-versioning	`47.95% <ø> (ø)`
rust.hash-graph-types	`0.00% <ø> (ø)`
rust.hash-graph-validation	`84.71% <ø> (ø)`
rust.hashql-ast	`89.63% <ø> (ø)`
rust.hashql-compiletest	`28.39% <ø> (ø)`
rust.hashql-core	`78.98% <ø> (ø)`
rust.hashql-diagnostics	`72.51% <ø> (ø)`
rust.hashql-eval	`79.82% <ø> (ø)`
rust.hashql-hir	`89.09% <ø> (ø)`
rust.hashql-mir	`87.92% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.04% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codspeed-hq · 2026-08-10T09:04:42Z

Merging this PR will not alter performance

✅ 98 untouched benchmarks

_{Comparing claude/sre-938-npm-security-2026-08-10 (8ea6bc0) with main (271284a)¹}

No successful run was found on main (77fb79c) during the generation of this report, so 271284a was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

cursor · 2026-08-10T09:28:57Z

PR Summary

Low Risk
Dependency version bumps only; no application code changes. Residual risk is normal patch-level behavior changes in libraries used for YAML, HTML sanitization, IDs, and CSS processing.

Overview
Addresses the 2026-08-10 npm vulnerability scan by bumping direct pins and root resolutions, then re-resolving yarn.lock so vulnerable versions are removed rather than left alongside patched copies.

Manifest updates move js-yaml to 4.3.1 (hash-api, repo-chores, playwright, Redocly resolution), nanoid to 3.3.17 in hash-api (stays on v3, not a major jump), dompurify to 3.4.13 (frontend + global resolution), and postcss to 8.5.25 via both next/postcss and postcss@npm:8.5.14 resolutions. The lockfile also picks up patched transitive releases (e.g. brace-expansion, hono, undici, ip-address, fast-uri) with no application source changes.

^{Reviewed by Cursor Bugbot for commit 8ea6bc0. Bugbot is set up for automated code reviews on this repo. Configure here.}

github-actions · 2026-08-10T10:17:21Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$26.8 \mathrm{ms} \pm 216 \mathrm{μs}\left({\color{gray}-2.267 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.43 \mathrm{ms} \pm 24.5 \mathrm{μs}\left({\color{gray}0.995 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$12.2 \mathrm{ms} \pm 86.7 \mathrm{μs}\left({\color{gray}0.293 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$43.0 \mathrm{ms} \pm 416 \mathrm{μs}\left({\color{gray}0.733 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$14.1 \mathrm{ms} \pm 171 \mathrm{μs}\left({\color{gray}1.53 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$23.7 \mathrm{ms} \pm 200 \mathrm{μs}\left({\color{gray}-0.728 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$27.9 \mathrm{ms} \pm 196 \mathrm{μs}\left({\color{gray}-1.654 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.73 \mathrm{ms} \pm 23.1 \mathrm{μs}\left({\color{gray}0.290 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$13.2 \mathrm{ms} \pm 120 \mathrm{μs}\left({\color{gray}-1.158 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.77 \mathrm{ms} \pm 20.3 \mathrm{μs}\left({\color{gray}-0.163 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.01 \mathrm{ms} \pm 24.8 \mathrm{μs}\left({\color{gray}1.09 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.38 \mathrm{ms} \pm 21.9 \mathrm{μs}\left({\color{gray}0.608 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.15 \mathrm{ms} \pm 34.2 \mathrm{μs}\left({\color{gray}0.411 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.52 \mathrm{ms} \pm 19.2 \mathrm{μs}\left({\color{gray}0.379 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.15 \mathrm{ms} \pm 31.3 \mathrm{μs}\left({\color{gray}1.40 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.42 \mathrm{ms} \pm 34.7 \mathrm{μs}\left({\color{gray}0.446 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.44 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}0.231 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.07 \mathrm{ms} \pm 25.1 \mathrm{μs}\left({\color{gray}0.402 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.65 \mathrm{ms} \pm 12.8 \mathrm{μs}\left({\color{gray}-0.615 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.51 \mathrm{ms} \pm 14.8 \mathrm{μs}\left({\color{gray}0.424 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.64 \mathrm{ms} \pm 15.6 \mathrm{μs}\left({\color{gray}-0.515 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.93 \mathrm{ms} \pm 16.4 \mathrm{μs}\left({\color{gray}-0.019 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.71 \mathrm{ms} \pm 14.6 \mathrm{μs}\left({\color{gray}-0.467 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.92 \mathrm{ms} \pm 18.6 \mathrm{μs}\left({\color{gray}0.132 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.04 \mathrm{ms} \pm 14.2 \mathrm{μs}\left({\color{gray}0.196 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.77 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}1.48 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$2.99 \mathrm{ms} \pm 18.3 \mathrm{μs}\left({\color{gray}3.28 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.43 \mathrm{ms} \pm 23.2 \mathrm{μs}\left({\color{gray}0.456 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.97 \mathrm{ms} \pm 15.8 \mathrm{μs}\left({\color{gray}-0.126 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.29 \mathrm{ms} \pm 21.9 \mathrm{μs}\left({\color{gray}1.44 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.36 \mathrm{ms} \pm 20.1 \mathrm{μs}\left({\color{gray}0.049 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.96 \mathrm{ms} \pm 18.7 \mathrm{μs}\left({\color{gray}0.485 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.34 \mathrm{ms} \pm 24.6 \mathrm{μs}\left({\color{gray}2.78 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$42.3 \mathrm{ms} \pm 239 \mathrm{μs}\left({\color{gray}-0.317 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$33.0 \mathrm{ms} \pm 221 \mathrm{μs}\left({\color{gray}-0.277 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$35.5 \mathrm{ms} \pm 238 \mathrm{μs}\left({\color{gray}0.609 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$31.7 \mathrm{ms} \pm 155 \mathrm{μs}\left({\color{gray}-0.562 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$41.5 \mathrm{ms} \pm 255 \mathrm{μs}\left({\color{gray}-1.836 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$49.5 \mathrm{ms} \pm 232 \mathrm{μs}\left({\color{gray}-0.228 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$40.1 \mathrm{ms} \pm 250 \mathrm{μs}\left({\color{gray}0.938 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$91.2 \mathrm{ms} \pm 646 \mathrm{μs}\left({\color{gray}1.09 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$33.6 \mathrm{ms} \pm 214 \mathrm{μs}\left({\color{gray}-1.089 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$272 \mathrm{ms} \pm 1.04 \mathrm{ms}\left({\color{gray}0.185 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.0 \mathrm{ms} \pm 70.1 \mathrm{μs}\left({\color{gray}0.034 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.2 \mathrm{ms} \pm 88.6 \mathrm{μs}\left({\color{gray}1.01 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.1 \mathrm{ms} \pm 64.4 \mathrm{μs}\left({\color{gray}0.102 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.0 \mathrm{ms} \pm 64.6 \mathrm{μs}\left({\color{gray}0.264 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.0 \mathrm{ms} \pm 68.0 \mathrm{μs}\left({\color{gray}-0.330 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.0 \mathrm{ms} \pm 64.6 \mathrm{μs}\left({\color{gray}-0.654 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.1 \mathrm{ms} \pm 61.9 \mathrm{μs}\left({\color{gray}-0.593 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.1 \mathrm{ms} \pm 63.9 \mathrm{μs}\left({\color{gray}-1.329 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$11.1 \mathrm{ms} \pm 62.6 \mathrm{μs}\left({\color{gray}-1.407 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$11.3 \mathrm{ms} \pm 76.6 \mathrm{μs}\left({\color{lightgreen}-5.642 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$11.7 \mathrm{ms} \pm 83.2 \mathrm{μs}\left({\color{gray}1.32 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$11.5 \mathrm{ms} \pm 83.8 \mathrm{μs}\left({\color{gray}-0.839 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$11.6 \mathrm{ms} \pm 63.5 \mathrm{μs}\left({\color{gray}0.809 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$11.7 \mathrm{ms} \pm 85.4 \mathrm{μs}\left({\color{gray}0.275 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$11.5 \mathrm{ms} \pm 84.1 \mathrm{μs}\left({\color{gray}0.530 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$11.6 \mathrm{ms} \pm 57.6 \mathrm{μs}\left({\color{gray}0.642 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$11.5 \mathrm{ms} \pm 70.2 \mathrm{μs}\left({\color{gray}-0.940 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$11.5 \mathrm{ms} \pm 65.9 \mathrm{μs}\left({\color{gray}-1.380 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$11.7 \mathrm{ms} \pm 104 \mathrm{μs}\left({\color{gray}1.77 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$8.65 \mathrm{ms} \pm 59.4 \mathrm{μs}\left({\color{gray}0.626 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$56.2 \mathrm{ms} \pm 467 \mathrm{μs}\left({\color{gray}-3.266 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$109 \mathrm{ms} \pm 737 \mathrm{μs}\left({\color{gray}-0.774 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$63.5 \mathrm{ms} \pm 543 \mathrm{μs}\left({\color{gray}-2.367 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$72.7 \mathrm{ms} \pm 519 \mathrm{μs}\left({\color{gray}-2.416 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$82.2 \mathrm{ms} \pm 580 \mathrm{μs}\left({\color{gray}-1.445 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$87.8 \mathrm{ms} \pm 533 \mathrm{μs}\left({\color{gray}-1.219 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$42.5 \mathrm{ms} \pm 310 \mathrm{μs}\left({\color{gray}-1.479 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$70.8 \mathrm{ms} \pm 428 \mathrm{μs}\left({\color{gray}-0.002 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$48.7 \mathrm{ms} \pm 359 \mathrm{μs}\left({\color{gray}-2.094 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$57.8 \mathrm{ms} \pm 370 \mathrm{μs}\left({\color{gray}-0.984 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$60.5 \mathrm{ms} \pm 469 \mathrm{μs}\left({\color{gray}0.325 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$60.0 \mathrm{ms} \pm 372 \mathrm{μs}\left({\color{gray}-1.227 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$127 \mathrm{ms} \pm 884 \mathrm{μs}\left({\color{gray}-1.745 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$137 \mathrm{ms} \pm 560 \mathrm{μs}\left({\color{gray}-0.962 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$20.2 \mathrm{ms} \pm 348 \mathrm{μs}\left({\color{lightgreen}-8.940 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$534 \mathrm{ms} \pm 1.22 \mathrm{ms}\left({\color{gray}3.91 \mathrm{\%}}\right) $$	Flame Graph

claude Bot assigned CiaranMn Aug 10, 2026

claude Bot temporarily deployed to pull-request August 10, 2026 08:57 Inactive

vercel Bot deployed to Preview – hashdotdesign-tokens August 10, 2026 08:58 View deployment

vercel Bot deployed to Preview – petrinaut August 10, 2026 08:59 View deployment

vercel Bot deployed to Preview – hash August 10, 2026 09:09 View deployment

claude Bot requested a review from CiaranMn August 10, 2026 09:28

claude Bot marked this pull request as ready for review August 10, 2026 09:28

This was referenced Aug 10, 2026

Update npm package postcss to v8.5.23 [SECURITY] #9173

Closed

Update npm package js-yaml to v4.3.1 [SECURITY] #9175

Closed

Update npm package dompurify to v3.4.13 [SECURITY] #9180

Closed

Update npm package nanoid to v5 [SECURITY] #9181

Closed

claude Bot requested a review from TimDiekmann August 10, 2026 09:54

claude Bot assigned TimDiekmann Aug 10, 2026

claude Bot removed the request for review from CiaranMn August 10, 2026 09:54

claude Bot unassigned CiaranMn Aug 10, 2026

TimDiekmann approved these changes Aug 10, 2026

View reviewed changes

TimDiekmann added this pull request to the merge queue Aug 10, 2026

Merged via the queue into main with commit 8ea4027 Aug 10, 2026
193 checks passed

TimDiekmann deleted the claude/sre-938-npm-security-2026-08-10 branch August 10, 2026 10:57

Navigation Menu

Uh oh!

SRE-938: Fix npm vulnerabilities from the 2026-08-10 scan - #9182

SRE-938: Fix npm vulnerabilities from the 2026-08-10 scan#9182
TimDiekmann merged 1 commit into
mainfrom
claude/sre-938-npm-security-2026-08-10

claude Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Aug 10, 2026

Uh oh!

cursor Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 10, 2026

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

claude Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌟 What is the purpose of this PR?

Why this replaces the four Renovate PRs

🔗 Related links

🚫 Blocked by

🔍 What does this change?

Why the resolutions stay resolutions

Gone-check

Advisories closed

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

Uh oh!

vercel Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed-hq Bot commented Aug 10, 2026

Merging this PR will not alter performance

Footnotes

Uh oh!

cursor Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

github-actions Bot commented Aug 10, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

claude Bot commented Aug 10, 2026 •

edited

Loading

vercel Bot commented Aug 10, 2026 •

edited

Loading

codecov Bot commented Aug 10, 2026 •

edited

Loading

cursor Bot commented Aug 10, 2026 •

edited

Loading