SRE-863: Bump vulnerable npm dependencies flagged by weekly security scan

[claude]

Requested by Tim Diekmann · Slack thread

🌟 What is the purpose of this PR?

Resolves the uncovered npm vulnerabilities flagged by the weekly security scan of 2026-07-27 (see SRE-863) via in-range lockfile refreshes and minimal direct bumps.

Before → After (advisories closed):

• next 15.5.18 → 15.5.21 — closes 8 advisories: HIGH SSRF in Server Actions GHSA-89xv-2m56-2m9x, HIGH SSRF in rewrites GHSA-p9j2-gv94-2wf4, HIGH DoS in App Router GHSA-m99w-x7hq-7vfj, plus 5 MODERATE (GHSA-4633-3j49-mh5q, GHSA-4c39-4ccg-62r3, GHSA-68g3-v927-f742, GHSA-955p-x3mx-jcvp, GHSA-q8wf-6r8g-63ch)
• postcss 8.5.10 / 8.5.14 / 8.5.16 → 8.5.18 / 8.5.22 — HIGH path traversal GHSA-r28c-9q8g-f849, HIGH arbitrary file read GHSA-6g55-p6wh-862q
• immutable 5.1.5 → 5.1.9 — HIGH GHSA-v56q-mh7h-f735, HIGH GHSA-xvcm-6775-5m9r
• mongoose 9.7.0 → 9.8.0 — MODERATE prototype pollution GHSA-664h-wqgq-64gw
• tar 7.5.19 → 7.5.21 — MODERATE GHSA-r292-9mhp-454m
• fast-uri 3.1.3 → 3.1.4 — HIGH host confusion GHSA-v2hh-gcrm-f6hx
• shell-quote 1.8.4 → 1.9.0 — HIGH quadratic-complexity DoS GHSA-395f-4hp3-45gv
• svgo 3.3.3 → 3.3.4 — HIGH GHSA-2p49-hgcm-8545

Dropped from this batch:

• @vitest/browser 4.1.8 → 4.1.10 (CRITICAL GHSA-p63j-vcc4-9vmv) — landed on main via H-6728: Upgrade vitest to 4.1.10 to fix @vitest/browser vulnerability (GHSA-p63j-vcc4-9vmv) #9100, which bumped the whole vitest toolchain to 4.1.10. This PR was rebased onto that main to drop its duplicate bump; the diff no longer touches any vitest packages.
• @hono/node-server 1.19.14 (MODERATE GHSA-frvp-7c67-39w9) — a fixed 1.x does exist: the path-traversal fix was backported to 1.19.15 (released 2026-07-24, latest-1 dist-tag; verified by tarball diff — the serve-static traversal-guard regex gains |\\), and an interim commit here bumped the lockfile to 1.19.17 in-range. But the GitHub advisory still lists the affected range as < 2.0.5, and this repo's "Dependencies / Review" check is a required status check (org-wide ruleset), so the gate failed on 1.19.17 and the bump was reverted to keep this 9-package batch mergeable. The hono bump is deferred until GitHub narrows the advisory range (then 1.19.17 goes in cleanly in-range), or it goes in as a forced 2.x resolution with human sign-off. GHSA-9mqv-5hh9-4cgg only affects 2.0.0–2.0.9 and never applied to 1.x.

Deliberately excluded per standing decisions: brace-expansion (held), esbuild (blocked by tsup), and packages already covered by open [SECURITY] PRs (#9075, #9081, #9087, #9088, #9089, #9090).

🔗 Related links

• SRE-863 (internal)
• Slack scan report (internal)

🔍 What does this change?

How each fix landed:

• In-range lockfile refresh (yarn.lock only): immutable, mongoose, tar, fast-uri, svgo, and the caret-ranged postcss group (^8.x → 8.5.22)
• Direct dependency bumps:
  • next 15.5.18 → 15.5.21 in apps/hash-frontend and libs/@local/hash-isomorphic-utils
• Resolutions (root package.json) — used only where a direct bump was not possible:
  • next/postcss: updated the pre-existing resolution from 8.5.10 → 8.5.18 (next itself pins postcss@8.4.31)
  • postcss@npm:8.5.14 → 8.5.18 (new): the vulnerable 8.5.14 is exact-pinned inside @pandacss/*; the latest pandacss release (1.11.5) still pins 8.5.14, so no direct bump can fix it
  • shell-quote@npm:1.8.4 → 1.9.0 (new): exact-pinned by concurrently@10.0.3 (via @openapitools/openapi-generator-cli@2.38.0); both concurrently@10.0.4 and openapi-generator-cli@2.40.1 were published <5 days ago and are blocked by the repo's npmMinimalAgeGate: 5d, so a direct bump cannot resolve yet. The resolution can be removed once those age past the gate.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

⚠️ Known issues

• @hono/node-server remains at 1.19.14 (see "Dropped" above). The fix is backported in 1.19.15+, but the stale GHSA-frvp-7c67-39w9 advisory range (< 2.0.5) makes the required dependency-review gate reject any 1.19.x, so the bump is deferred until upstream corrects the range.

🐾 Next steps

• Remove the shell-quote@npm:1.8.4 resolution once concurrently@10.0.4 / @openapitools/openapi-generator-cli@2.40.1 pass the 5-day age gate and can be bumped directly.
• Re-apply the @hono/node-server 1.19.17 in-range bump once GitHub narrows the GHSA-frvp-7c67-39w9 advisory range below 1.19.15 (or land 2.x with human sign-off if the range never gets corrected).

🛡 What tests cover this?

• Existing CI (dependency changes only, no code changes)

❓ How to test this?

1. yarn install --immutable --mode=skip-build — passes
2. yarn dedupe --strategy highest --check — passes ("No packages can be deduped")
3. Confirm resolved versions in yarn.lock match the list above

📹 Demo

N/A — dependency bumps only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WfQz9Y36mQ8J6kRC3zaEtt

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Jul 27, 2026 11:39pm
hashdotdesign-tokens	Ready	Preview, Comment	Jul 27, 2026 11:39pm
petrinaut	Ready	Preview, Comment	Jul 27, 2026 11:39pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.36%. Comparing base (602f13f) to head (a4fb04d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9101   +/-   ##
=======================================
  Coverage   59.36%   59.36%           
=======================================
  Files        1406     1406           
  Lines      136519   136519           
  Branches     6407     6407           
=======================================
+ Hits        81042    81045    +3     
+ Misses      54487    54484    -3     
  Partials      990      990           

Flag	Coverage Δ
apps.hash-ai-worker-ts	1.99% <ø> (ø)
apps.hash-api	12.10% <ø> (ø)
blockprotocol.type-system	40.84% <ø> (ø)
local.claude-hooks	0.00% <ø> (ø)
local.harpc-client	51.49% <ø> (ø)
local.hash-backend-utils	2.55% <ø> (ø)
local.hash-graph-sdk	10.02% <ø> (ø)
local.hash-isomorphic-utils	5.75% <ø> (ø)
rust.antsi	0.00% <ø> (ø)
rust.error-stack	90.89% <ø> (ø)
rust.harpc-codec	84.70% <ø> (ø)
rust.harpc-net	96.24% <ø> (+0.04%)	⬆️
rust.harpc-tower	67.03% <ø> (ø)
rust.harpc-types	0.00% <ø> (ø)
rust.harpc-wire-protocol	92.23% <ø> (ø)
rust.hash-codec	72.76% <ø> (ø)
rust.hash-graph-api	7.41% <ø> (ø)
rust.hash-graph-authorization	62.59% <ø> (ø)
rust.hash-graph-embeddings	91.88% <ø> (ø)
rust.hash-graph-postgres-store	27.39% <ø> (ø)
rust.hash-graph-store	38.71% <ø> (ø)
rust.hash-graph-temporal-versioning	47.95% <ø> (ø)
rust.hash-graph-types	0.00% <ø> (ø)
rust.hash-graph-validation	84.71% <ø> (ø)
rust.hashql-ast	89.63% <ø> (ø)
rust.hashql-compiletest	28.39% <ø> (ø)
rust.hashql-core	78.98% <ø> (ø)
rust.hashql-diagnostics	72.51% <ø> (ø)
rust.hashql-eval	79.82% <ø> (ø)
rust.hashql-hir	89.09% <ø> (ø)
rust.hashql-mir	87.92% <ø> (ø)
rust.hashql-syntax-jexpr	94.04% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will not alter performance

✅ 98 untouched benchmarks

---

_{Comparing claude/security-npm-2026-07-27 (e9af032) with main (15de8ae)¹}

Footnotes

1. No successful run was found on main (602f13f) during the generation of this report, so 15de8ae was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[vilkinsons]

Parts of this PR are being interim-addressed separately (e.g. #9100)

[claude]

Only @vitest/browser overlaps with #9100 (same target, 4.1.10 — #9100 bumps the whole vitest toolchain). Once #9100 lands I'll rebase this PR to drop that bump; the other 8 packages here (next, postcss, immutable, mongoose, tar, fast-uri, shell-quote, svgo) aren't covered by it.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

yarn.lock

Name	Version	Vulnerability	Severity	Patched Version
@hono/node-server	1.19.17	Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)	moderate	2.0.5

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/next	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/next	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@hono/node-server	1.19.17	Unknown	Unknown
npm/@mongodb-js/saslprep	1.4.12	Unknown	Unknown
npm/@next/env	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@next/swc-darwin-arm64	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@next/swc-darwin-x64	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@next/swc-linux-arm64-gnu	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@next/swc-linux-arm64-musl	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@next/swc-linux-x64-gnu	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@next/swc-linux-x64-musl	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@next/swc-win32-arm64-msvc	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@next/swc-win32-x64-msvc	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/fast-uri	3.1.4	Unknown	Unknown
npm/immutable	5.1.9	🟢 6.6	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 0 Found 1/14 approved changesets -- score normalized to 0 Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Packaging 🟢 10 packaging workflow detected SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/mongodb	7.5.0	🟢 6.2	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits Fuzzing ⚠️ 0 project is not fuzzed Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
npm/mongodb-connection-string-url	7.0.2	🟢 6	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 13 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
npm/mongoose	9.8.0	🟢 6.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 9 security policy file detected Code-Review 🟢 8 Found 13/16 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 8 SAST tool detected but not run on all commits Packaging 🟢 10 packaging workflow detected
npm/nanoid	3.3.16	🟢 6.4	Details Check Score Reason Code-Review ⚠️ 0 Found 1/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 10 all dependencies are pinned Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 5 SAST tool is not run on all commits -- score normalized to 5
npm/next	15.5.21	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts ⚠️ 0 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/postcss	8.5.18	🟢 7.3	Details Check Score Reason Code-Review ⚠️ 2 Found 8/30 approved changesets -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/postcss	8.5.22	🟢 7.3	Details Check Score Reason Code-Review ⚠️ 2 Found 8/30 approved changesets -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/svgo	3.3.4	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 2 Found 5/21 approved changesets -- score normalized to 2 Maintained 🟢 10 3 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected SAST 🟢 10 SAST tool is run on all commits
npm/tar	7.5.21	🟢 6.2	Details Check Score Reason Code-Review ⚠️ 0 Found 1/30 approved changesets -- score normalized to 0 Maintained 🟢 10 18 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• apps/hash-frontend/package.json
• libs/@local/hash-isomorphic-utils/package.json
• yarn.lock

[github-actions]

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$25.8 \mathrm{ms} \pm 167 \mathrm{μs}\left({\color{gray}0.065 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.74 \mathrm{ms} \pm 15.5 \mathrm{μs}\left({\color{gray}-1.571 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$11.2 \mathrm{ms} \pm 83.4 \mathrm{μs}\left({\color{gray}0.024 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$37.9 \mathrm{ms} \pm 349 \mathrm{μs}\left({\color{gray}0.330 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$11.2 \mathrm{ms} \pm 77.1 \mathrm{μs}\left({\color{gray}0.555 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$20.3 \mathrm{ms} \pm 202 \mathrm{μs}\left({\color{gray}1.47 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$26.2 \mathrm{ms} \pm 189 \mathrm{μs}\left({\color{gray}-0.405 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.02 \mathrm{ms} \pm 16.2 \mathrm{μs}\left({\color{gray}-0.028 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$12.1 \mathrm{ms} \pm 87.0 \mathrm{μs}\left({\color{gray}0.267 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.10 \mathrm{ms} \pm 24.8 \mathrm{μs}\left({\color{gray}0.531 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.41 \mathrm{ms} \pm 12.8 \mathrm{μs}\left({\color{gray}0.661 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$2.71 \mathrm{ms} \pm 16.0 \mathrm{μs}\left({\color{gray}0.226 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$4.36 \mathrm{ms} \pm 26.5 \mathrm{μs}\left({\color{gray}0.203 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.84 \mathrm{ms} \pm 13.9 \mathrm{μs}\left({\color{gray}0.335 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$3.37 \mathrm{ms} \pm 21.5 \mathrm{μs}\left({\color{gray}0.157 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$3.65 \mathrm{ms} \pm 18.6 \mathrm{μs}\left({\color{gray}-0.927 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.79 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{gray}-0.544 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$3.36 \mathrm{ms} \pm 28.2 \mathrm{μs}\left({\color{gray}1.67 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.09 \mathrm{ms} \pm 12.1 \mathrm{μs}\left({\color{gray}-0.042 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$1.98 \mathrm{ms} \pm 10.4 \mathrm{μs}\left({\color{gray}-0.332 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.08 \mathrm{ms} \pm 13.1 \mathrm{μs}\left({\color{gray}0.759 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.29 \mathrm{ms} \pm 13.3 \mathrm{μs}\left({\color{gray}0.309 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.13 \mathrm{ms} \pm 11.0 \mathrm{μs}\left({\color{gray}-0.292 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.30 \mathrm{ms} \pm 19.3 \mathrm{μs}\left({\color{gray}1.43 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$2.41 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}0.300 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.18 \mathrm{ms} \pm 14.8 \mathrm{μs}\left({\color{gray}0.612 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$2.35 \mathrm{ms} \pm 11.6 \mathrm{μs}\left({\color{gray}-0.191 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$2.71 \mathrm{ms} \pm 14.5 \mathrm{μs}\left({\color{gray}-0.792 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.35 \mathrm{ms} \pm 12.4 \mathrm{μs}\left({\color{gray}0.348 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$2.60 \mathrm{ms} \pm 14.9 \mathrm{μs}\left({\color{gray}-0.482 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$2.66 \mathrm{ms} \pm 15.3 \mathrm{μs}\left({\color{gray}-0.125 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.31 \mathrm{ms} \pm 8.82 \mathrm{μs}\left({\color{gray}-0.082 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$2.61 \mathrm{ms} \pm 13.9 \mathrm{μs}\left({\color{gray}-0.372 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$36.8 \mathrm{ms} \pm 169 \mathrm{μs}\left({\color{gray}1.31 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$27.1 \mathrm{ms} \pm 147 \mathrm{μs}\left({\color{gray}-1.010 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$29.5 \mathrm{ms} \pm 170 \mathrm{μs}\left({\color{gray}-0.144 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$26.6 \mathrm{ms} \pm 189 \mathrm{μs}\left({\color{lightgreen}-30.015 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$35.5 \mathrm{ms} \pm 247 \mathrm{μs}\left({\color{gray}1.82 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$44.5 \mathrm{ms} \pm 318 \mathrm{μs}\left({\color{gray}2.73 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$34.2 \mathrm{ms} \pm 214 \mathrm{μs}\left({\color{gray}0.885 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$82.2 \mathrm{ms} \pm 541 \mathrm{μs}\left({\color{gray}2.70 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$28.3 \mathrm{ms} \pm 173 \mathrm{μs}\left({\color{gray}0.165 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$244 \mathrm{ms} \pm 827 \mathrm{μs}\left({\color{gray}-0.742 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$8.93 \mathrm{ms} \pm 45.6 \mathrm{μs}\left({\color{gray}0.843 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$9.11 \mathrm{ms} \pm 58.2 \mathrm{μs}\left({\color{gray}1.04 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$9.05 \mathrm{ms} \pm 42.6 \mathrm{μs}\left({\color{gray}0.220 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$9.00 \mathrm{ms} \pm 52.3 \mathrm{μs}\left({\color{gray}1.12 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$9.01 \mathrm{ms} \pm 57.2 \mathrm{μs}\left({\color{gray}0.125 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$8.93 \mathrm{ms} \pm 37.5 \mathrm{μs}\left({\color{gray}0.050 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$9.02 \mathrm{ms} \pm 36.0 \mathrm{μs}\left({\color{gray}0.725 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$8.99 \mathrm{ms} \pm 48.1 \mathrm{μs}\left({\color{gray}-0.125 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$9.19 \mathrm{ms} \pm 51.0 \mathrm{μs}\left({\color{gray}1.18 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$9.29 \mathrm{ms} \pm 45.9 \mathrm{μs}\left({\color{gray}-0.220 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1	$$9.41 \mathrm{ms} \pm 71.4 \mathrm{μs}\left({\color{gray}0.619 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1	$$9.35 \mathrm{ms} \pm 45.8 \mathrm{μs}\left({\color{gray}-1.926 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1	$$9.35 \mathrm{ms} \pm 44.4 \mathrm{μs}\left({\color{gray}0.316 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1	$$9.36 \mathrm{ms} \pm 44.7 \mathrm{μs}\left({\color{gray}-0.274 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2	$$9.34 \mathrm{ms} \pm 46.1 \mathrm{μs}\left({\color{gray}-0.448 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1	$$9.43 \mathrm{ms} \pm 55.0 \mathrm{μs}\left({\color{gray}0.321 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1	$$9.38 \mathrm{ms} \pm 47.0 \mathrm{μs}\left({\color{gray}0.293 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1	$$9.38 \mathrm{ms} \pm 46.3 \mathrm{μs}\left({\color{gray}-0.100 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1	$$9.35 \mathrm{ms} \pm 41.8 \mathrm{μs}\left({\color{gray}-1.299 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba	$$6.89 \mathrm{ms} \pm 38.1 \mathrm{μs}\left({\color{gray}0.473 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$55.3 \mathrm{ms} \pm 403 \mathrm{μs}\left({\color{red}5.53 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$97.9 \mathrm{ms} \pm 452 \mathrm{μs}\left({\color{gray}2.89 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$61.1 \mathrm{ms} \pm 361 \mathrm{μs}\left({\color{gray}4.15 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$69.5 \mathrm{ms} \pm 578 \mathrm{μs}\left({\color{gray}4.55 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$76.8 \mathrm{ms} \pm 415 \mathrm{μs}\left({\color{gray}4.69 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$80.9 \mathrm{ms} \pm 418 \mathrm{μs}\left({\color{gray}4.08 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$39.8 \mathrm{ms} \pm 333 \mathrm{μs}\left({\color{gray}0.188 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$63.7 \mathrm{ms} \pm 381 \mathrm{μs}\left({\color{gray}1.43 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$44.8 \mathrm{ms} \pm 217 \mathrm{μs}\left({\color{gray}1.32 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$52.8 \mathrm{ms} \pm 332 \mathrm{μs}\left({\color{gray}1.28 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$54.9 \mathrm{ms} \pm 451 \mathrm{μs}\left({\color{gray}1.68 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$54.7 \mathrm{ms} \pm 386 \mathrm{μs}\left({\color{gray}2.06 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$116 \mathrm{ms} \pm 808 \mathrm{μs}\left({\color{gray}0.650 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$125 \mathrm{ms} \pm 477 \mathrm{μs}\left({\color{gray}0.632 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$16.2 \mathrm{ms} \pm 89.8 \mathrm{μs}\left({\color{gray}-1.036 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$479 \mathrm{ms} \pm 1.23 \mathrm{ms}\left({\color{gray}1.96 \mathrm{\%}}\right) $$	Flame Graph