SRE-945: Remove the GHSA-frvp-7c67-39w9 allowlist from the Dependencies preflight by claude[bot] · Pull Request #9210 · hashintel/hash

claude · 2026-08-12T20:44:38Z

Requested by Tim Diekmann · Slack thread

🌟 What is the purpose of this PR?

Before: the Dependencies preflight job is told to ignore one specific advisory, GHSA-frvp-7c67-39w9. Anyone reading the workflow sees a supply-chain exception with no expiry, and if that advisory ever became genuinely relevant to this repo the gate would stay silent about it.

After: the exception is gone. Dependencies / Review is blocking on every advisory again, with nothing carved out, and the workflow file no longer carries a stale "remove this later" comment.

How: the allowlist was added in #9149 purely to work around a wrong affected-version range on that advisory — it used to claim a blanket < 2.0.5, which flagged every 1.19.x even though the fix had been backported to 1.19.15. GitHub corrected the range on 2026-08-12, splitting it into two disjoint ranges: >= 2.0.0, < 2.0.5 (patched in 2.0.5) and < 1.19.15 (patched in 1.19.15). >= 1.19.15 < 2.0.0 is therefore no longer flagged, the reason for the exception is gone, and the with: block is simply removed.

This repo resolves @hono/node-server to 1.19.17 — transitively, via @modelcontextprotocol/sdk's ^1.19.9 range, and already the newest release on the 1.19 line (latest-1). npm's bulk audit endpoint returns {} for 1.19.17, so the check has nothing left to flag and no dependency change is needed alongside this revert.

🔗 Related links

Linear issue: SRE-945 (internal)
The PR being reverted: SRE-898: Allowlist GHSA-frvp-7c67-39w9 in the Dependency Review preflight #9149
The dependency update it was unblocking: H-6747: Update @hono/node-server and body-parser #9148
Advisory: GHSA-frvp-7c67-39w9 (last updated 2026-08-12)
Advisory-database correction: github/advisory-database#8824

🔍 What does this change?

Removes the with: allow-ghsas: GHSA-frvp-7c67-39w9 block (and its explanatory comment) from the dependencies job in .github/workflows/preflight-target.yml. allow-ghsas is the reusable workflow's only input and it is optional with a default of "", so the job call needs no with: at all — this restores the pre-SRE-898: Allowlist GHSA-frvp-7c67-39w9 in the Dependency Review preflight #9149 shape.
Leaves the hashintel/.github reusable-workflow pin at 69449a7 untouched.

Note: this is a hand-revert, not a git revert of #9149. That commit no longer applies — the dependencies job has since moved from preflight.yml to preflight-target.yml (#9197, #9172), and the reusable-workflow pin has been bumped twice (#9185, #9172). A mechanical revert conflicts and would also drag the pin backwards to d76c839, so only the allowlist itself is removed.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

⚠️ Known issues

None. The second @hono/node-server advisory, GHSA-9mqv-5hh9-4cgg, covers >= 2.0.0, <= 2.0.9 only and has never applied to the 1.19 line this repo is on.

🛡 What tests cover this?

The Dependencies / Review check on this PR is itself the test: it now runs with no allowlist, against a lockfile that resolves @hono/node-server to 1.19.17.

❓ How to test this?

Confirm the Dependencies / Review check passes on this PR with no allow-ghsas input in place.
Confirm @hono/node-server audits clean at the version the lockfile resolves:
```
curl -s -X POST https://registry.npmjs.org/-/npm/v1/security/advisories/bulk \
  -H 'Content-Type: application/json' \
  -d '{"@hono/node-server":["1.19.17"]}'
```
An empty {} means no advisory applies. For contrast, 1.19.14 still returns GHSA-frvp-7c67-39w9 with range <1.19.15, which is what the corrected advisory now says.

…es preflight Reverts the supply-chain exception added in #9149. GitHub narrowed GHSA-frvp-7c67-39w9 on 2026-08-12 to two disjoint ranges — `>= 2.0.0, < 2.0.5` and `< 1.19.15` — so the `1.19.x` line the repo resolves is no longer flagged and the allowlist is obsolete. Hand-reverted rather than `git revert`-ed: the `dependencies` job has since moved from `preflight.yml` to `preflight-target.yml` and the reusable-workflow pin has been bumped twice, so only the `with:` block is removed and the current pin is preserved. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MjvYwHkmR1zabWsaZmPL42

vercel · 2026-08-12T20:44:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 12, 2026 8:58pm
hashdotdesign-tokens	Ready	Preview	Aug 12, 2026 8:58pm
petrinaut	Ready	Preview	Aug 12, 2026 8:58pm

codecov · 2026-08-12T20:50:12Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.63%. Comparing base (38ab9fd) to head (414ce82).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9210   +/-   ##
=======================================
  Coverage   59.63%   59.63%           
=======================================
  Files        1420     1421    +1     
  Lines      138767   138770    +3     
  Branches     6555     6555           
=======================================
+ Hits        82753    82758    +5     
+ Misses      54950    54948    -2     
  Partials     1064     1064

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.99% <ø> (ø)`
apps.hash-api	`14.00% <ø> (ø)`
blockprotocol.type-system	`40.84% <ø> (ø)`
local.claude-hooks	`0.00% <ø> (ø)`
local.harpc-client	`51.49% <ø> (ø)`
local.hash-backend-utils	`3.27% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
local.hash-isomorphic-utils	`12.22% <ø> (ø)`
rust.antsi	`2.36% <ø> (ø)`
rust.error-stack	`90.81% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-net	`96.24% <ø> (+0.03%)`	⬆️
rust.harpc-tower	`67.03% <ø> (ø)`
rust.harpc-types	`0.00% <ø> (ø)`
rust.harpc-wire-protocol	`92.23% <ø> (ø)`
rust.hash-codec	`72.76% <ø> (ø)`
rust.hash-graph-api	`7.36% <ø> (ø)`
rust.hash-graph-authentication	`100.00% <ø> (?)`
rust.hash-graph-authorization	`62.59% <ø> (ø)`
rust.hash-graph-embeddings	`91.88% <ø> (ø)`
rust.hash-graph-postgres-store	`29.33% <ø> (ø)`
rust.hash-graph-store	`46.78% <ø> (ø)`
rust.hash-graph-temporal-versioning	`47.95% <ø> (ø)`
rust.hash-graph-types	`0.00% <ø> (ø)`
rust.hash-graph-validation	`84.71% <ø> (ø)`
rust.hashql-ast	`89.63% <ø> (ø)`
rust.hashql-compiletest	`28.39% <ø> (ø)`
rust.hashql-core	`78.98% <ø> (ø)`
rust.hashql-diagnostics	`72.51% <ø> (ø)`
rust.hashql-eval	`79.82% <ø> (ø)`
rust.hashql-hir	`89.09% <ø> (ø)`
rust.hashql-mir	`87.92% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.04% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codspeed · 2026-08-12T20:53:55Z

Merging this PR will not alter performance

✅ 98 untouched benchmarks

_{Comparing claude/sre-945-revert-ghsa-allowlist (414ce82) with main (648e991)}

cursor · 2026-08-12T20:55:26Z

PR Summary

^{Cursor Bugbot is generating a summary for commit 414ce82. Configure here.}

Copilot

Pull request overview

Removes the obsolete dependency-review advisory exception, restoring checks for all advisories.

Changes:

Removes the GHSA-frvp-7c67-39w9 allowlist and stale explanatory comment.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-08-12T22:05:46Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$27.7 \mathrm{ms} \pm 153 \mathrm{μs}\left({\color{gray}-0.962 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.54 \mathrm{ms} \pm 28.0 \mathrm{μs}\left({\color{gray}2.51 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$12.8 \mathrm{ms} \pm 105 \mathrm{μs}\left({\color{gray}-2.651 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$44.3 \mathrm{ms} \pm 352 \mathrm{μs}\left({\color{gray}0.039 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$15.0 \mathrm{ms} \pm 128 \mathrm{μs}\left({\color{gray}3.94 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$23.9 \mathrm{ms} \pm 176 \mathrm{μs}\left({\color{gray}-3.734 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$29.0 \mathrm{ms} \pm 248 \mathrm{μs}\left({\color{gray}0.412 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.94 \mathrm{ms} \pm 26.2 \mathrm{μs}\left({\color{red}5.01 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$14.3 \mathrm{ms} \pm 125 \mathrm{μs}\left({\color{gray}1.76 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.97 \mathrm{ms} \pm 29.5 \mathrm{μs}\left({\color{gray}0.698 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.09 \mathrm{ms} \pm 20.3 \mathrm{μs}\left({\color{gray}-0.397 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.49 \mathrm{ms} \pm 23.3 \mathrm{μs}\left({\color{gray}-2.591 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.27 \mathrm{ms} \pm 50.7 \mathrm{μs}\left({\color{gray}1.02 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.56 \mathrm{ms} \pm 22.3 \mathrm{μs}\left({\color{gray}-0.988 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.18 \mathrm{ms} \pm 26.3 \mathrm{μs}\left({\color{gray}0.290 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.52 \mathrm{ms} \pm 34.2 \mathrm{μs}\left({\color{gray}-0.363 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.60 \mathrm{ms} \pm 27.6 \mathrm{μs}\left({\color{gray}1.21 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.16 \mathrm{ms} \pm 31.3 \mathrm{μs}\left({\color{lightgreen}-5.051 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.69 \mathrm{ms} \pm 15.7 \mathrm{μs}\left({\color{gray}-1.059 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.53 \mathrm{ms} \pm 17.5 \mathrm{μs}\left({\color{gray}-1.041 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.66 \mathrm{ms} \pm 15.0 \mathrm{μs}\left({\color{gray}-1.852 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$3.03 \mathrm{ms} \pm 18.7 \mathrm{μs}\left({\color{gray}2.41 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.76 \mathrm{ms} \pm 16.5 \mathrm{μs}\left({\color{gray}0.064 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.98 \mathrm{ms} \pm 19.6 \mathrm{μs}\left({\color{gray}1.37 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.11 \mathrm{ms} \pm 26.4 \mathrm{μs}\left({\color{gray}0.374 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.75 \mathrm{ms} \pm 12.5 \mathrm{μs}\left({\color{gray}-0.541 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.03 \mathrm{ms} \pm 20.8 \mathrm{μs}\left({\color{gray}-0.182 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.45 \mathrm{ms} \pm 20.2 \mathrm{μs}\left({\color{gray}-0.649 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.02 \mathrm{ms} \pm 21.6 \mathrm{μs}\left({\color{gray}0.430 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.33 \mathrm{ms} \pm 22.9 \mathrm{μs}\left({\color{gray}0.381 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.40 \mathrm{ms} \pm 19.9 \mathrm{μs}\left({\color{gray}-1.835 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.99 \mathrm{ms} \pm 21.8 \mathrm{μs}\left({\color{gray}-2.199 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.35 \mathrm{ms} \pm 22.3 \mathrm{μs}\left({\color{gray}-2.374 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$42.2 \mathrm{ms} \pm 246 \mathrm{μs}\left({\color{gray}-2.046 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$33.6 \mathrm{ms} \pm 226 \mathrm{μs}\left({\color{gray}-1.847 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$36.6 \mathrm{ms} \pm 214 \mathrm{μs}\left({\color{gray}-1.725 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$32.8 \mathrm{ms} \pm 284 \mathrm{μs}\left({\color{gray}2.77 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$43.6 \mathrm{ms} \pm 239 \mathrm{μs}\left({\color{gray}0.002 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$51.7 \mathrm{ms} \pm 350 \mathrm{μs}\left({\color{gray}1.49 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$41.4 \mathrm{ms} \pm 278 \mathrm{μs}\left({\color{gray}0.180 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$94.1 \mathrm{ms} \pm 574 \mathrm{μs}\left({\color{gray}1.62 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$34.9 \mathrm{ms} \pm 246 \mathrm{μs}\left({\color{gray}-1.967 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$282 \mathrm{ms} \pm 914 \mathrm{μs}\left({\color{gray}1.01 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.2 \mathrm{ms} \pm 67.4 \mathrm{μs}\left({\color{gray}-4.759 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.7 \mathrm{ms} \pm 71.4 \mathrm{μs}\left({\color{gray}-3.934 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.6 \mathrm{ms} \pm 69.0 \mathrm{μs}\left({\color{gray}0.266 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.8 \mathrm{ms} \pm 89.8 \mathrm{μs}\left({\color{gray}-2.450 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$12.0 \mathrm{ms} \pm 80.6 \mathrm{μs}\left({\color{gray}4.17 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.9 \mathrm{ms} \pm 76.2 \mathrm{μs}\left({\color{gray}3.07 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$12.0 \mathrm{ms} \pm 72.8 \mathrm{μs}\left({\color{gray}3.33 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$12.2 \mathrm{ms} \pm 88.2 \mathrm{μs}\left({\color{red}6.56 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$12.5 \mathrm{ms} \pm 80.4 \mathrm{μs}\left({\color{gray}3.81 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$12.4 \mathrm{ms} \pm 93.4 \mathrm{μs}\left({\color{gray}1.75 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$12.3 \mathrm{ms} \pm 80.0 \mathrm{μs}\left({\color{gray}1.85 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$12.2 \mathrm{ms} \pm 73.3 \mathrm{μs}\left({\color{gray}2.19 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$12.1 \mathrm{ms} \pm 76.1 \mathrm{μs}\left({\color{gray}1.48 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$12.2 \mathrm{ms} \pm 77.0 \mathrm{μs}\left({\color{gray}2.07 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$11.9 \mathrm{ms} \pm 63.4 \mathrm{μs}\left({\color{gray}-0.904 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$13.0 \mathrm{ms} \pm 112 \mathrm{μs}\left({\color{red}8.99 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$12.1 \mathrm{ms} \pm 96.6 \mathrm{μs}\left({\color{gray}0.402 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$12.3 \mathrm{ms} \pm 73.0 \mathrm{μs}\left({\color{gray}4.17 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$12.0 \mathrm{ms} \pm 75.4 \mathrm{μs}\left({\color{gray}1.11 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$8.94 \mathrm{ms} \pm 71.9 \mathrm{μs}\left({\color{gray}1.70 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$61.3 \mathrm{ms} \pm 416 \mathrm{μs}\left({\color{red}6.57 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$113 \mathrm{ms} \pm 567 \mathrm{μs}\left({\color{gray}3.63 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$70.7 \mathrm{ms} \pm 514 \mathrm{μs}\left({\color{red}7.51 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$76.5 \mathrm{ms} \pm 521 \mathrm{μs}\left({\color{gray}2.40 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$86.3 \mathrm{ms} \pm 484 \mathrm{μs}\left({\color{red}5.67 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$91.6 \mathrm{ms} \pm 687 \mathrm{μs}\left({\color{red}6.01 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$45.7 \mathrm{ms} \pm 252 \mathrm{μs}\left({\color{gray}3.73 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$74.6 \mathrm{ms} \pm 380 \mathrm{μs}\left({\color{gray}1.28 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$53.2 \mathrm{ms} \pm 399 \mathrm{μs}\left({\color{red}6.36 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$62.8 \mathrm{ms} \pm 367 \mathrm{μs}\left({\color{red}5.51 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$65.4 \mathrm{ms} \pm 483 \mathrm{μs}\left({\color{red}6.48 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$63.2 \mathrm{ms} \pm 465 \mathrm{μs}\left({\color{gray}1.93 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$119 \mathrm{ms} \pm 621 \mathrm{μs}\left({\color{gray}-1.625 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$132 \mathrm{ms} \pm 661 \mathrm{μs}\left({\color{gray}1.18 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$19.6 \mathrm{ms} \pm 116 \mathrm{μs}\left({\color{gray}-1.826 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$527 \mathrm{ms} \pm 1.34 \mathrm{ms}\left({\color{lightgreen}-6.426 \mathrm{\%}}\right) $$	Flame Graph

github-actions Bot added the area/infra Relates to version control, CI, CD or IaC (area) label Aug 12, 2026

claude Bot assigned TimDiekmann Aug 12, 2026

vercel Bot deployed to Preview – hashdotdesign-tokens August 12, 2026 20:46 View deployment

claude Bot temporarily deployed to pull-request August 12, 2026 20:46 Inactive

vercel Bot deployed to Preview – petrinaut August 12, 2026 20:48 View deployment

TimDiekmann approved these changes Aug 12, 2026

View reviewed changes

TimDiekmann marked this pull request as ready for review August 12, 2026 20:55

Copilot AI balanced review requested due to automatic review settings August 12, 2026 20:55

TimDiekmann enabled auto-merge August 12, 2026 20:55

Copilot started reviewing on behalf of TimDiekmann August 12, 2026 20:55 View session

Copilot AI reviewed Aug 12, 2026

View reviewed changes

vercel Bot deployed to Preview – hash August 12, 2026 20:58 View deployment

TimDiekmann added this pull request to the merge queue Aug 12, 2026

Merged via the queue into main with commit 7409d46 Aug 12, 2026
203 checks passed

TimDiekmann deleted the claude/sre-945-revert-ghsa-allowlist branch August 12, 2026 21:27

Navigation Menu

SRE-945: Remove the GHSA-frvp-7c67-39w9 allowlist from the Dependencies preflight - #9210

SRE-945: Remove the GHSA-frvp-7c67-39w9 allowlist from the Dependencies preflight#9210
TimDiekmann merged 1 commit into
mainfrom
claude/sre-945-revert-ghsa-allowlist

claude Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

codspeed Bot commented Aug 12, 2026

Uh oh!

cursor Bot commented Aug 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

github-actions Bot commented Aug 12, 2026

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

claude Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌟 What is the purpose of this PR?

🔗 Related links

🔍 What does this change?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🛡 What tests cover this?

❓ How to test this?

Uh oh!

vercel Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed Bot commented Aug 12, 2026

Merging this PR will not alter performance

Uh oh!

cursor Bot commented Aug 12, 2026

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

github-actions Bot commented Aug 12, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

claude Bot commented Aug 12, 2026 •

edited

Loading

vercel Bot commented Aug 12, 2026 •

edited

Loading

codecov Bot commented Aug 12, 2026 •

edited

Loading