Skip to content

Update npm package next to v15.5.13 [SECURITY]#8555

Open
hash-worker[bot] wants to merge 1 commit intomainfrom
deps/js/npm-next-vulnerability
Open

Update npm package next to v15.5.13 [SECURITY]#8555
hash-worker[bot] wants to merge 1 commit intomainfrom
deps/js/npm-next-vulnerability

Conversation

@hash-worker
Copy link
Contributor

@hash-worker hash-worker bot commented Mar 17, 2026

This PR contains the following updates:

Package Change Age Confidence
next (source) 15.5.10 -> 15.5.13 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-29057

Summary

When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

Impact

An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.

Patches

The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.

Workarounds

If upgrade is not immediately possible:

  • Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
  • Enforce authentication/authorization on backend routes per our security guidance.

Release Notes

vercel/next.js (next)

v15.5.13

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)
Credits

Huge thanks to @​ztanner for helping!

v15.5.12

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

  • fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

v15.5.11

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits

Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - "before 4am every weekday,every weekend" (UTC).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@hash-worker hash-worker bot enabled auto-merge March 17, 2026 19:32
@vercel
Copy link

vercel bot commented Mar 17, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
hash Ready Ready Preview, Comment Mar 19, 2026 7:11pm
3 Skipped Deployments
Project Deployment Actions Updated (UTC)
hashdotdesign Ignored Ignored Preview Mar 19, 2026 7:11pm
hashdotdesign-tokens Ignored Ignored Preview Mar 19, 2026 7:11pm
petrinaut Skipped Skipped Comment Mar 19, 2026 7:11pm

@cursor
Copy link

cursor bot commented Mar 17, 2026

PR Summary

Low Risk
Low risk patch-level Next.js upgrade; main risk is unexpected runtime/build regressions from updated next and its bundled @next/* binaries.

Overview
Updates the workspace to next@15.5.13 (from 15.5.10) in apps/hash-frontend and @local/hash-isomorphic-utils.

Regenerates yarn.lock to pull in the corresponding @next/env and platform @next/swc-* packages for 15.5.13.

Written by Cursor Bugbot for commit ce302fa. This will update automatically on new commits. Configure here.

@github-actions github-actions bot added area/deps Relates to third-party dependencies (area) area/apps > hash* Affects HASH (a `hash-*` app) area/libs Relates to first-party libraries/crates/packages (area) type/eng > frontend Owned by the @frontend team type/eng > backend Owned by the @backend team area/apps labels Mar 17, 2026
@augmentcode
Copy link

augmentcode bot commented Mar 17, 2026

🤖 Augment PR Summary

Summary: Updates the repo’s Next.js dependency versions to address recent security advisories in Next.js.

Changes:

  • Bumped next in apps/hash-frontend from 15.5.10 to 16.1.7 (major version upgrade).
  • Bumped next in libs/@local/hash-isomorphic-utils (devDependency) from 15.5.10 to 15.5.13.
  • Updated lockfile resolution accordingly (via yarn.lock changes).

Technical Notes: The targeted Next.js versions include fixes for CVE-2026-27980 (bounded image optimizer disk cache via images.maximumDiskCacheSize) and CVE-2026-29057 (request-smuggling fix in rewrite proxy behavior).

🤖 Was this summary useful? React with 👍 or 👎

Copy link

@augmentcode augmentcode bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 3 suggestions posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

"material-ui-popup-state": "4.1.0",
"millify": "6.1.0",
"next": "15.5.10",
"next": "16.1.7",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This bumps next from v15 to v16 (major upgrade), so it’s worth confirming any Next-dependent tooling/config in hash-frontend (and key integrations like next-seo) are compatible before relying on automerge.

Severity: medium

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

"material-ui-popup-state": "4.1.0",
"millify": "6.1.0",
"next": "15.5.10",
"next": "16.1.7",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Next 16.1.7 adds images.maximumDiskCacheSize (default uses ~50% of available disk at startup); if this app is self-hosted on constrained disks, consider explicitly setting a cap in next.config.js to avoid surprising disk usage.

Severity: low

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

"eslint": "9.39.3",
"graphql": "16.11.0",
"next": "15.5.10",
"next": "15.5.13",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@local/hash-isomorphic-utils now pins next to v15.5.13 while hash-frontend uses v16.1.7, which may cause multiple Next.js versions to be installed and can lead to confusing type/tooling resolution across workspaces. If next is only needed for dev/test here, consider aligning versions (or removing it) to keep the monorepo consistent.

Severity: medium

Other Locations
  • apps/hash-frontend/package.json:94

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 3 potential issues.

Fix All in Cursor

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

@codecov
Copy link

codecov bot commented Mar 17, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.60%. Comparing base (618964d) to head (ce302fa).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #8555   +/-   ##
=======================================
  Coverage   62.60%   62.60%           
=======================================
  Files        1317     1317           
  Lines      133975   133975           
  Branches     5517     5517           
=======================================
  Hits        83877    83877           
  Misses      49183    49183           
  Partials      915      915           
Flag Coverage Δ
apps.hash-ai-worker-ts 1.40% <ø> (ø)
apps.hash-api 0.00% <ø> (ø)
local.hash-isomorphic-utils 0.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@codspeed-hq
Copy link

codspeed-hq bot commented Mar 17, 2026

Merging this PR will not alter performance

✅ 80 untouched benchmarks


Comparing deps/js/npm-next-vulnerability (cb62559) with main (9cf2392)1

Open in CodSpeed

Footnotes

  1. No successful run was found on main (feb318b) during the generation of this report, so 9cf2392 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report.

@github-actions
Copy link
Contributor

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 2002 $$28.3 \mathrm{ms} \pm 239 \mathrm{μs}\left({\color{gray}1.33 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$3.62 \mathrm{ms} \pm 29.7 \mathrm{μs}\left({\color{gray}3.02 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 1001 $$13.6 \mathrm{ms} \pm 116 \mathrm{μs}\left({\color{red}7.96 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 3314 $$44.8 \mathrm{ms} \pm 395 \mathrm{μs}\left({\color{gray}2.67 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$16.1 \mathrm{ms} \pm 108 \mathrm{μs}\left({\color{red}7.77 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 1526 $$25.8 \mathrm{ms} \pm 236 \mathrm{μs}\left({\color{gray}4.11 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 2078 $$29.5 \mathrm{ms} \pm 216 \mathrm{μs}\left({\color{gray}2.10 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.88 \mathrm{ms} \pm 21.8 \mathrm{μs}\left({\color{gray}0.985 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 1033 $$14.8 \mathrm{ms} \pm 108 \mathrm{μs}\left({\color{red}8.82 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_medium

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 102 $$3.91 \mathrm{ms} \pm 20.5 \mathrm{μs}\left({\color{gray}0.033 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$3.08 \mathrm{ms} \pm 13.2 \mathrm{μs}\left({\color{gray}-0.986 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 51 $$3.47 \mathrm{ms} \pm 17.6 \mathrm{μs}\left({\color{gray}-0.148 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 269 $$5.31 \mathrm{ms} \pm 30.3 \mathrm{μs}\left({\color{gray}-0.624 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$3.69 \mathrm{ms} \pm 17.1 \mathrm{μs}\left({\color{gray}-0.222 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 107 $$4.30 \mathrm{ms} \pm 31.4 \mathrm{μs}\left({\color{gray}0.498 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 133 $$4.60 \mathrm{ms} \pm 24.4 \mathrm{μs}\left({\color{gray}-0.618 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.58 \mathrm{ms} \pm 22.9 \mathrm{μs}\left({\color{gray}0.969 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 63 $$4.20 \mathrm{ms} \pm 26.2 \mathrm{μs}\left({\color{gray}-0.366 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_none

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 2 $$2.84 \mathrm{ms} \pm 13.6 \mathrm{μs}\left({\color{gray}-0.431 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$2.78 \mathrm{ms} \pm 17.3 \mathrm{μs}\left({\color{gray}-0.327 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 1 $$2.90 \mathrm{ms} \pm 13.1 \mathrm{μs}\left({\color{gray}-0.187 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 8 $$3.16 \mathrm{ms} \pm 14.8 \mathrm{μs}\left({\color{gray}-1.023 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$2.95 \mathrm{ms} \pm 11.0 \mathrm{μs}\left({\color{gray}-1.273 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 3 $$3.26 \mathrm{ms} \pm 14.1 \mathrm{μs}\left({\color{gray}-0.199 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_small

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 52 $$3.19 \mathrm{ms} \pm 18.9 \mathrm{μs}\left({\color{gray}-0.586 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$2.91 \mathrm{ms} \pm 14.9 \mathrm{μs}\left({\color{gray}-0.603 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 25 $$3.08 \mathrm{ms} \pm 19.9 \mathrm{μs}\left({\color{gray}-0.344 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 94 $$3.65 \mathrm{ms} \pm 19.9 \mathrm{μs}\left({\color{gray}-0.754 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$3.17 \mathrm{ms} \pm 16.5 \mathrm{μs}\left({\color{gray}-1.408 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 26 $$3.41 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{gray}-1.547 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 66 $$3.54 \mathrm{ms} \pm 13.1 \mathrm{μs}\left({\color{gray}-1.357 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.15 \mathrm{ms} \pm 18.3 \mathrm{μs}\left({\color{gray}-1.460 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 29 $$3.45 \mathrm{ms} \pm 15.0 \mathrm{μs}\left({\color{gray}-0.570 \mathrm{\%}}\right) $$ Flame Graph

read_scaling_complete

Function Value Mean Flame graphs
entity_by_id;one_depth 1 entities $$47.3 \mathrm{ms} \pm 235 \mathrm{μs}\left({\color{gray}2.80 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 10 entities $$84.5 \mathrm{ms} \pm 337 \mathrm{μs}\left({\color{gray}1.43 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 25 entities $$51.8 \mathrm{ms} \pm 301 \mathrm{μs}\left({\color{gray}0.276 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 5 entities $$56.1 \mathrm{ms} \pm 511 \mathrm{μs}\left({\color{red}5.56 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 50 entities $$64.4 \mathrm{ms} \pm 416 \mathrm{μs}\left({\color{gray}4.05 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 1 entities $$47.8 \mathrm{ms} \pm 249 \mathrm{μs}\left({\color{gray}1.68 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 10 entities $$426 \mathrm{ms} \pm 919 \mathrm{μs}\left({\color{gray}0.715 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 25 entities $$104 \mathrm{ms} \pm 556 \mathrm{μs}\left({\color{gray}2.55 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 5 entities $$92.8 \mathrm{ms} \pm 383 \mathrm{μs}\left({\color{gray}0.812 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 50 entities $$326 \mathrm{ms} \pm 696 \mathrm{μs}\left({\color{red}12.0 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 1 entities $$20.5 \mathrm{ms} \pm 140 \mathrm{μs}\left({\color{gray}3.23 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 10 entities $$20.9 \mathrm{ms} \pm 124 \mathrm{μs}\left({\color{gray}1.03 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 25 entities $$20.8 \mathrm{ms} \pm 127 \mathrm{μs}\left({\color{gray}1.32 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 5 entities $$20.8 \mathrm{ms} \pm 115 \mathrm{μs}\left({\color{gray}3.50 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 50 entities $$25.1 \mathrm{ms} \pm 178 \mathrm{μs}\left({\color{gray}1.77 \mathrm{\%}}\right) $$ Flame Graph

read_scaling_linkless

Function Value Mean Flame graphs
entity_by_id 1 entities $$20.3 \mathrm{ms} \pm 96.0 \mathrm{μs}\left({\color{gray}3.36 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10 entities $$20.4 \mathrm{ms} \pm 126 \mathrm{μs}\left({\color{gray}2.95 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 100 entities $$20.3 \mathrm{ms} \pm 103 \mathrm{μs}\left({\color{gray}2.04 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 1000 entities $$20.8 \mathrm{ms} \pm 114 \mathrm{μs}\left({\color{gray}2.37 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10000 entities $$27.1 \mathrm{ms} \pm 169 \mathrm{μs}\left({\color{gray}-0.662 \mathrm{\%}}\right) $$ Flame Graph

representative_read_entity

Function Value Mean Flame graphs
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1 $$36.0 \mathrm{ms} \pm 363 \mathrm{μs}\left({\color{gray}1.21 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1 $$35.3 \mathrm{ms} \pm 291 \mathrm{μs}\left({\color{gray}0.502 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1 $$34.5 \mathrm{ms} \pm 305 \mathrm{μs}\left({\color{gray}-0.977 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1 $$37.4 \mathrm{ms} \pm 284 \mathrm{μs}\left({\color{gray}3.89 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2 $$34.4 \mathrm{ms} \pm 318 \mathrm{μs}\left({\color{gray}-0.312 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1 $$35.5 \mathrm{ms} \pm 370 \mathrm{μs}\left({\color{gray}3.06 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1 $$36.6 \mathrm{ms} \pm 278 \mathrm{μs}\left({\color{red}5.40 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1 $$36.9 \mathrm{ms} \pm 242 \mathrm{μs}\left({\color{red}6.57 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1 $$36.2 \mathrm{ms} \pm 264 \mathrm{μs}\left({\color{gray}1.68 \mathrm{\%}}\right) $$ Flame Graph

representative_read_entity_type

Function Value Mean Flame graphs
get_entity_type_by_id Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba $$8.84 \mathrm{ms} \pm 44.3 \mathrm{μs}\left({\color{gray}1.86 \mathrm{\%}}\right) $$ Flame Graph

representative_read_multiple_entities

Function Value Mean Flame graphs
entity_by_property traversal_paths=0 0 $$97.1 \mathrm{ms} \pm 432 \mathrm{μs}\left({\color{gray}4.10 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=255 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true $$150 \mathrm{ms} \pm 607 \mathrm{μs}\left({\color{gray}3.84 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false $$105 \mathrm{ms} \pm 575 \mathrm{μs}\left({\color{gray}4.59 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true $$114 \mathrm{ms} \pm 764 \mathrm{μs}\left({\color{gray}4.86 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true $$122 \mathrm{ms} \pm 631 \mathrm{μs}\left({\color{gray}4.57 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true $$129 \mathrm{ms} \pm 530 \mathrm{μs}\left({\color{gray}3.35 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=0 0 $$105 \mathrm{ms} \pm 544 \mathrm{μs}\left({\color{gray}3.48 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=255 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true $$130 \mathrm{ms} \pm 442 \mathrm{μs}\left({\color{gray}0.582 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false $$111 \mathrm{ms} \pm 491 \mathrm{μs}\left({\color{gray}2.28 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true $$122 \mathrm{ms} \pm 539 \mathrm{μs}\left({\color{gray}3.98 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true $$119 \mathrm{ms} \pm 486 \mathrm{μs}\left({\color{gray}-0.044 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true $$120 \mathrm{ms} \pm 543 \mathrm{μs}\left({\color{gray}1.19 \mathrm{\%}}\right) $$

scenarios

Function Value Mean Flame graphs
full_test query-limited $$138 \mathrm{ms} \pm 569 \mathrm{μs}\left({\color{gray}4.11 \mathrm{\%}}\right) $$ Flame Graph
full_test query-unlimited $$149 \mathrm{ms} \pm 546 \mathrm{μs}\left({\color{gray}2.16 \mathrm{\%}}\right) $$ Flame Graph
linked_queries query-limited $$105 \mathrm{ms} \pm 550 \mathrm{μs}\left({\color{red}162 \mathrm{\%}}\right) $$ Flame Graph
linked_queries query-unlimited $$569 \mathrm{ms} \pm 2.65 \mathrm{ms}\left({\color{gray}4.14 \mathrm{\%}}\right) $$ Flame Graph

@hash-worker hash-worker bot force-pushed the deps/js/npm-next-vulnerability branch from cb62559 to ce302fa Compare March 19, 2026 18:56
@vercel vercel bot temporarily deployed to Preview – petrinaut March 19, 2026 18:57 Inactive
@hash-worker hash-worker bot changed the title Update npm package next [SECURITY] Update npm package next to v15.5.13 [SECURITY] Mar 19, 2026
@graphite-app graphite-app bot requested review from a team March 19, 2026 19:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/apps > hash* Affects HASH (a `hash-*` app) area/apps area/deps Relates to third-party dependencies (area) area/libs Relates to first-party libraries/crates/packages (area) type/eng > backend Owned by the @backend team type/eng > frontend Owned by the @frontend team

Development

Successfully merging this pull request may close these issues.

1 participant