Update npm package `lodash-es` to v4.17.23 [SECURITY] by hash-worker[bot] · Pull Request #8280 · hashintel/hash

hash-worker · 2026-01-21T23:16:08Z

This PR contains the following updates:

Package	Change	Age	Confidence
lodash-es (source)	`4.17.21` -> `4.17.23`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-13465

Impact

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

Patches

This issue is patched on 4.17.23.

Release Notes

lodash/lodash (lodash-es)

`v4.17.23`

Compare Source

`v4.17.22`

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

vercel · 2026-01-21T23:16:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ds-theme	Ready	Preview, Comment	Feb 3, 2026 4:47pm
hash	Ready	Preview, Comment	Feb 3, 2026 4:47pm
hashdotdesign	Ready	Preview, Comment	Feb 3, 2026 4:47pm
hashdotdesign-tokens	Ready	Preview, Comment	Feb 3, 2026 4:47pm
petrinaut	Ready	Preview	Feb 3, 2026 4:47pm

cursor · 2026-01-21T23:16:14Z

PR Summary

Low Risk
Low risk dependency patch bump; main risk is minor behavioral/compatibility changes in Lodash utility functions.

Overview
Updates lodash-es from 4.17.21 to 4.17.23 in @local/hash-isomorphic-utils and @local/status, with corresponding yarn.lock resolution changes.

This is a security-driven patch upgrade addressing a Lodash prototype-pollution vulnerability affecting versions <= 4.17.22.

^{Written by Cursor Bugbot for commit a306821. This will update automatically on new commits. Configure here.}

augmentcode · 2026-01-21T23:16:55Z

🤖 Augment PR Summary

Summary: Updates the pinned lodash-es dependency to 4.17.23 across affected workspace packages to address a security advisory.
Changes: Bumps lodash-es from 4.17.21 to 4.17.23 in libs/@local/hash-isomorphic-utils and libs/@local/status/typescript (lockfile updated accordingly).

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

codspeed-hq · 2026-01-21T23:20:35Z

CodSpeed Performance Report

Merging this PR will not alter performance

_{Comparing deps/js/npm-lodash-es-vulnerability (a306821) with main (3b21d31)}

Summary

✅ 21 untouched benchmarks
🗄️ 12 archived benchmarks run¹

12 benchmarks were run, but are now archived. If they were deleted in another branch, consider rebasing to remove them from the report. Instead if they were added back, click here to restore them. ↩

codecov · 2026-01-21T23:21:11Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.10%. Comparing base (3b21d31) to head (a306821).
⚠️ Report is 16 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8280   +/-   ##
=======================================
  Coverage   60.10%   60.10%           
=======================================
  Files        1235     1235           
  Lines      118201   118201           
  Branches     5180     5180           
=======================================
  Hits        71050    71050           
  Misses      46324    46324           
  Partials      827      827

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.41% <ø> (ø)`
apps.hash-api	`0.00% <ø> (ø)`
blockprotocol.type-system	`40.84% <ø> (ø)`
local.claude-hooks	`0.00% <ø> (ø)`
local.harpc-client	`51.24% <ø> (ø)`
local.hash-graph-sdk	`10.88% <ø> (ø)`
local.hash-isomorphic-utils	`0.00% <ø> (ø)`
rust.antsi	`0.00% <ø> (ø)`
rust.error-stack	`90.88% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-net	`96.16% <ø> (ø)`
rust.harpc-tower	`66.80% <ø> (ø)`
rust.harpc-types	`0.00% <ø> (ø)`
rust.harpc-wire-protocol	`92.23% <ø> (ø)`
rust.hash-codec	`72.76% <ø> (ø)`
rust.hash-graph-api	`2.88% <ø> (ø)`
rust.hash-graph-authorization	`62.47% <ø> (ø)`
rust.hash-graph-postgres-store	`25.61% <ø> (ø)`
rust.hash-graph-store	`30.54% <ø> (ø)`
rust.hash-graph-temporal-versioning	`47.95% <ø> (ø)`
rust.hash-graph-types	`0.00% <ø> (ø)`
rust.hash-graph-validation	`83.45% <ø> (ø)`
rust.hashql-ast	`87.25% <ø> (ø)`
rust.hashql-compiletest	`46.65% <ø> (ø)`
rust.hashql-core	`81.77% <ø> (ø)`
rust.hashql-diagnostics	`72.43% <ø> (ø)`
rust.hashql-eval	`68.54% <ø> (ø)`
rust.hashql-hir	`89.10% <ø> (ø)`
rust.hashql-mir	`87.91% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.05% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-02-03T17:06:16Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$26.4 \mathrm{ms} \pm 182 \mathrm{μs}\left({\color{gray}-3.330 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.23 \mathrm{ms} \pm 19.4 \mathrm{μs}\left({\color{gray}-2.158 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1001	$$11.9 \mathrm{ms} \pm 84.0 \mathrm{μs}\left({\color{lightgreen}-11.456 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$41.8 \mathrm{ms} \pm 308 \mathrm{μs}\left({\color{gray}-4.837 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$14.0 \mathrm{ms} \pm 99.3 \mathrm{μs}\left({\color{lightgreen}-6.530 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1526	$$23.4 \mathrm{ms} \pm 151 \mathrm{μs}\left({\color{lightgreen}-5.107 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$43.0 \mathrm{ms} \pm 253 \mathrm{μs}\left({\color{gray}-1.508 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$19.6 \mathrm{ms} \pm 128 \mathrm{μs}\left({\color{lightgreen}-5.575 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$27.4 \mathrm{ms} \pm 174 \mathrm{μs}\left({\color{lightgreen}-5.123 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.60 \mathrm{ms} \pm 17.8 \mathrm{μs}\left({\color{gray}-1.002 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.87 \mathrm{ms} \pm 12.5 \mathrm{μs}\left({\color{gray}0.984 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 51	$$3.23 \mathrm{ms} \pm 18.6 \mathrm{μs}\left({\color{gray}1.24 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.06 \mathrm{ms} \pm 40.9 \mathrm{μs}\left({\color{gray}1.51 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.37 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}-0.046 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 107	$$3.92 \mathrm{ms} \pm 23.2 \mathrm{μs}\left({\color{gray}-1.121 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.27 \mathrm{ms} \pm 29.7 \mathrm{μs}\left({\color{gray}1.73 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.24 \mathrm{ms} \pm 17.3 \mathrm{μs}\left({\color{gray}-3.288 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$3.86 \mathrm{ms} \pm 21.3 \mathrm{μs}\left({\color{gray}-0.484 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.40 \mathrm{ms} \pm 12.7 \mathrm{μs}\left({\color{gray}0.785 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.33 \mathrm{ms} \pm 8.92 \mathrm{μs}\left({\color{gray}0.140 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1	$$2.43 \mathrm{ms} \pm 12.8 \mathrm{μs}\left({\color{gray}-0.328 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.62 \mathrm{ms} \pm 11.7 \mathrm{μs}\left({\color{gray}-1.417 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.52 \mathrm{ms} \pm 13.3 \mathrm{μs}\left({\color{gray}-0.021 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.69 \mathrm{ms} \pm 13.1 \mathrm{μs}\left({\color{gray}-0.124 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$2.78 \mathrm{ms} \pm 14.3 \mathrm{μs}\left({\color{gray}-1.140 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.42 \mathrm{ms} \pm 11.4 \mathrm{μs}\left({\color{gray}-1.253 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 25	$$2.58 \mathrm{ms} \pm 12.5 \mathrm{μs}\left({\color{gray}-0.585 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.08 \mathrm{ms} \pm 15.6 \mathrm{μs}\left({\color{gray}-0.440 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.66 \mathrm{ms} \pm 12.4 \mathrm{μs}\left({\color{gray}-2.563 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 26	$$2.86 \mathrm{ms} \pm 12.8 \mathrm{μs}\left({\color{gray}-1.761 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.03 \mathrm{ms} \pm 20.1 \mathrm{μs}\left({\color{gray}0.623 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.62 \mathrm{ms} \pm 11.1 \mathrm{μs}\left({\color{gray}-2.547 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$2.85 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}-0.974 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$38.7 \mathrm{ms} \pm 187 \mathrm{μs}\left({\color{gray}-2.104 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$75.5 \mathrm{ms} \pm 378 \mathrm{μs}\left({\color{gray}-3.098 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$44.1 \mathrm{ms} \pm 233 \mathrm{μs}\left({\color{gray}-1.604 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$45.4 \mathrm{ms} \pm 176 \mathrm{μs}\left({\color{gray}-2.464 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$55.6 \mathrm{ms} \pm 364 \mathrm{μs}\left({\color{gray}-0.198 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$41.5 \mathrm{ms} \pm 142 \mathrm{μs}\left({\color{gray}1.17 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$419 \mathrm{ms} \pm 1.15 \mathrm{ms}\left({\color{gray}-0.475 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$97.7 \mathrm{ms} \pm 417 \mathrm{μs}\left({\color{gray}1.18 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$86.4 \mathrm{ms} \pm 424 \mathrm{μs}\left({\color{gray}-0.392 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$290 \mathrm{ms} \pm 824 \mathrm{μs}\left({\color{lightgreen}-8.104 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$14.9 \mathrm{ms} \pm 66.2 \mathrm{μs}\left({\color{gray}-2.436 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$15.4 \mathrm{ms} \pm 86.5 \mathrm{μs}\left({\color{gray}1.68 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$15.6 \mathrm{ms} \pm 83.4 \mathrm{μs}\left({\color{gray}1.14 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$15.6 \mathrm{ms} \pm 76.2 \mathrm{μs}\left({\color{gray}3.55 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$18.5 \mathrm{ms} \pm 93.4 \mathrm{μs}\left({\color{gray}0.689 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$15.0 \mathrm{ms} \pm 74.7 \mathrm{μs}\left({\color{gray}1.29 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$15.2 \mathrm{ms} \pm 81.4 \mathrm{μs}\left({\color{gray}1.83 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$15.1 \mathrm{ms} \pm 88.8 \mathrm{μs}\left({\color{gray}1.69 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$15.7 \mathrm{ms} \pm 74.2 \mathrm{μs}\left({\color{gray}-0.281 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$23.1 \mathrm{ms} \pm 164 \mathrm{μs}\left({\color{gray}1.73 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$30.6 \mathrm{ms} \pm 319 \mathrm{μs}\left({\color{red}5.15 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$30.3 \mathrm{ms} \pm 326 \mathrm{μs}\left({\color{gray}3.23 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$31.4 \mathrm{ms} \pm 270 \mathrm{μs}\left({\color{gray}4.64 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$30.0 \mathrm{ms} \pm 253 \mathrm{μs}\left({\color{gray}-0.891 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$30.9 \mathrm{ms} \pm 276 \mathrm{μs}\left({\color{gray}1.28 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$31.1 \mathrm{ms} \pm 297 \mathrm{μs}\left({\color{gray}4.63 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$31.7 \mathrm{ms} \pm 286 \mathrm{μs}\left({\color{red}6.97 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$30.9 \mathrm{ms} \pm 336 \mathrm{μs}\left({\color{gray}2.68 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$31.3 \mathrm{ms} \pm 302 \mathrm{μs}\left({\color{red}6.26 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$8.25 \mathrm{ms} \pm 33.5 \mathrm{μs}\left({\color{gray}1.95 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$47.8 \mathrm{ms} \pm 225 \mathrm{μs}\left({\color{gray}0.858 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$96.6 \mathrm{ms} \pm 423 \mathrm{μs}\left({\color{gray}1.87 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$53.7 \mathrm{ms} \pm 358 \mathrm{μs}\left({\color{gray}1.46 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$61.9 \mathrm{ms} \pm 357 \mathrm{μs}\left({\color{gray}0.931 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$70.5 \mathrm{ms} \pm 371 \mathrm{μs}\left({\color{gray}2.06 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$76.9 \mathrm{ms} \pm 376 \mathrm{μs}\left({\color{gray}1.44 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$52.4 \mathrm{ms} \pm 347 \mathrm{μs}\left({\color{gray}3.90 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$79.2 \mathrm{ms} \pm 419 \mathrm{μs}\left({\color{gray}2.73 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$59.5 \mathrm{ms} \pm 486 \mathrm{μs}\left({\color{gray}2.90 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$66.4 \mathrm{ms} \pm 358 \mathrm{μs}\left({\color{gray}1.54 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$69.3 \mathrm{ms} \pm 416 \mathrm{μs}\left({\color{gray}3.47 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$68.9 \mathrm{ms} \pm 391 \mathrm{μs}\left({\color{gray}3.39 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$134 \mathrm{ms} \pm 592 \mathrm{μs}\left({\color{gray}4.78 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$136 \mathrm{ms} \pm 492 \mathrm{μs}\left({\color{red}5.05 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$102 \mathrm{ms} \pm 496 \mathrm{μs}\left({\color{gray}-4.046 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$587 \mathrm{ms} \pm 2.19 \mathrm{ms}\left({\color{lightgreen}-7.120 \mathrm{\%}}\right) $$	Flame Graph

hash-worker Bot enabled auto-merge January 21, 2026 23:16

github-actions Bot added area/deps Relates to third-party dependencies (area) area/apps > hash* Affects HASH (a `hash-*` app) area/libs Relates to first-party libraries/crates/packages (area) type/eng > backend Owned by the @backend team labels Jan 21, 2026

augmentcode Bot reviewed Jan 21, 2026

View reviewed changes

vercel Bot deployed to Preview – ds-theme January 21, 2026 23:18 View deployment

vercel Bot deployed to Preview – hashdotdesign January 21, 2026 23:19 View deployment

vercel Bot deployed to Preview – petrinaut January 21, 2026 23:20 View deployment

vercel Bot deployed to Preview – hash January 21, 2026 23:30 View deployment

hash-worker Bot assigned CiaranMn Jan 21, 2026

vercel Bot deployed to Preview – hashdotdesign-tokens January 25, 2026 14:58 View deployment

vercel Bot deployed to Preview – hashdotdesign January 25, 2026 14:59 View deployment

vercel Bot deployed to Preview – petrinaut January 25, 2026 15:00 View deployment

vercel Bot deployed to Preview – hash January 25, 2026 15:09 View deployment

graphite-app Bot requested review from a team January 25, 2026 16:04

Update npm package lodash-es to v4.17.23 [SECURITY]

a306821

hash-worker Bot force-pushed the deps/js/npm-lodash-es-vulnerability branch from 59d41ed to a306821 Compare February 3, 2026 15:56

vercel Bot deployed to Preview – hashdotdesign-tokens February 3, 2026 16:35 View deployment

vercel Bot deployed to Preview – hashdotdesign February 3, 2026 16:36 View deployment

vercel Bot deployed to Preview – petrinaut February 3, 2026 16:38 View deployment

vercel Bot deployed to Preview – hash February 3, 2026 16:47 View deployment

CiaranMn approved these changes Feb 9, 2026

View reviewed changes

hash-worker Bot added this pull request to the merge queue Feb 9, 2026

Merged via the queue into main with commit 1c46a2e Feb 9, 2026
176 checks passed

hash-worker Bot deleted the deps/js/npm-lodash-es-vulnerability branch February 9, 2026 11:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update npm package `lodash-es` to v4.17.23 [SECURITY]#8280

Update npm package `lodash-es` to v4.17.23 [SECURITY]#8280
hash-worker[bot] merged 1 commit intomainfrom
deps/js/npm-lodash-es-vulnerability

hash-worker Bot commented Jan 21, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jan 21, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jan 21, 2026 •

edited

Loading

Uh oh!

augmentcode Bot commented Jan 21, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

codspeed-hq Bot commented Jan 21, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jan 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 3, 2026

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Conversation

hash-worker Bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2025-13465

Impact

Patches

Release Notes

v4.17.23

v4.17.22

Configuration

Uh oh!

vercel Bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

augmentcode Bot commented Jan 21, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codspeed-hq Bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CodSpeed Performance Report

Merging this PR will not alter performance

Summary

Footnotes

Uh oh!

codecov Bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Feb 3, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

hash-worker Bot commented Jan 21, 2026 •

edited

Loading

`v4.17.23`

`v4.17.22`

vercel Bot commented Jan 21, 2026 •

edited

Loading

cursor Bot commented Jan 21, 2026 •

edited

Loading

codspeed-hq Bot commented Jan 21, 2026 •

edited

Loading

codecov Bot commented Jan 21, 2026 •

edited

Loading