Skip to content

Update Rust crate reqwest to 0.13.0 - abandoned#8319

Closed
hash-worker[bot] wants to merge 2 commits intomainfrom
deps/rs/reqwest-0.x
Closed

Update Rust crate reqwest to 0.13.0 - abandoned#8319
hash-worker[bot] wants to merge 2 commits intomainfrom
deps/rs/reqwest-0.x

Conversation

@hash-worker
Copy link
Copy Markdown
Contributor

@hash-worker hash-worker Bot commented Jan 24, 2026

This PR contains the following updates:

Package Type Update Change Pending
reqwest workspace.dependencies minor 0.12.24 -> 0.13.0 0.13.3

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

seanmonstar/reqwest (reqwest)

v0.13.2

Compare Source

  • Fix HTTP/2 and native-tls ALPN feature combinations.
  • Fix HTTP/3 to send h3 ALPN.
  • (wasm) fix RequestBuilder::json() from override previously set content-type.

v0.13.1

Compare Source

  • Fixes compiling with rustls on Android targets.

v0.13.0

Compare Source

  • Breaking changes:
    • rustls is now the default TLS backend, instead of native-tls.
    • rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
    • rustls-tls has been renamed to rustls.
    • rustls roots features removed, rustls-platform-verifier is used by default.
      • To use different roots, call tls_certs_only(your_roots).
    • native-tls now includes ALPN. To disable, use native-tls-no-alpn.
    • query and form are now crate features, disabled by default.
    • Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).
  • Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)
    • For example, prefer tls_backend_rustls() over use_rustls_tls().

v0.12.28

  • Fix compiling on Windows if TLS and SOCKS features are not enabled.

v0.12.27

  • Add ClientBuilder::windows_named_pipe(name) option that will force all requests over that Windows Named Piper.

v0.12.26

  • Fix sending Accept-Encoding header only with values configured with reqwest, regardless of underlying tower-http config.

v0.12.25

  • Add Error::is_upgrade() to determine if the error was from an HTTP upgrade.
  • Fix sending Proxy-Authorization if only username is configured.
  • Fix sending Proxy-Authorization to HTTPS proxies when the target is HTTP.
  • Refactor internal decompression handling to use tower-http.

v0.12.24

  • Refactor cookie handling to an internal middleware.
  • Refactor internal random generator.
  • Refactor base64 encoding to reduce a copy.
  • Documentation updates.

v0.12.23

  • Add ClientBuilder::unix_socket(path) option that will force all requests over that Unix Domain Socket.
  • Add ClientBuilder::retry(policy) and reqwest::retry::Builder to configure automatic retries.
  • Add ClientBuilder::dns_resolver2() with more ergonomic argument bounds, allowing more resolver implementations.
  • Add http3_* options to blocking::ClientBuilder.
  • Fix default TCP timeout values to enabled and faster.
  • Fix SOCKS proxies to default to port 1080
  • (wasm) Add cache methods to RequestBuilder.

v0.12.22

  • Fix socks proxies when resolving IPv6 destinations.

v0.12.21

  • Fix socks proxy to use socks4a:// instead of socks4h://.
  • Fix Error::is_timeout() to check for hyper and IO timeouts too.
  • Fix request Error to again include URLs when possible.
  • Fix socks connect error to include more context.
  • (wasm) implement Default for Body.

v0.12.20

  • Add ClientBuilder::tcp_user_timeout(Duration) option to set TCP_USER_TIMEOUT.
  • Fix proxy headers only using the first matched proxy.
  • (wasm) Fix re-adding Error::is_status().

v0.12.19

  • Fix redirect that changes the method to GET should remove payload headers.
  • Fix redirect to only check the next scheme if the policy action is to follow.
  • (wasm) Fix compilation error if cookies feature is enabled (by the way, it's a noop feature in wasm).

v0.12.18

  • Fix compilation when socks enabled without TLS.

v0.12.17

  • Fix compilation on macOS.

v0.12.16

  • Add ClientBuilder::http3_congestion_bbr() to enable BBR congestion control.
  • Add ClientBuilder::http3_send_grease() to configure whether to send use QUIC grease.
  • Add ClientBuilder::http3_max_field_section_size() to configure the maximum response headers.
  • Add ClientBuilder::tcp_keepalive_interval() to configure TCP probe interval.
  • Add ClientBuilder::tcp_keepalive_retries() to configure TCP probe count.
  • Add Proxy::headers() to add extra headers that should be sent to a proxy.
  • Fix redirect::Policy::limit() which had an off-by-1 error, allowing 1 more redirect than specified.
  • Fix HTTP/3 to support streaming request bodies.
  • (wasm) Fix null bodies when calling Response::bytes_stream().

v0.12.15

  • Fix Windows to support both ProxyOverride and NO_PROXY.
  • Fix http3 to support streaming response bodies.
  • Fix http3 dependency from public API misuse.

v0.12.14

  • Fix missing fetch_mode_no_cors(), marking as deprecated when not on WASM.

v0.12.13

  • Add Form::into_reader() for blocking multipart forms.
  • Add Form::into_stream() for async multipart forms.
  • Add support for SOCKS4a proxies.
  • Fix decoding responses with multiple zstd frames.
  • Fix RequestBuilder::form() from overwriting a previously set Content-Type header, like the other builder methods.
  • Fix cloning of request timeout in blocking::Request.
  • Fix http3 synchronization of connection creation, reducing unneccesary extra connections.
  • Fix Windows system proxy to use ProxyOverride as a NO_PROXY value.
  • Fix blocking read to correctly reserve and zero read buffer.
  • (wasm) Add support for request timeouts.
  • (wasm) Fix Error::is_timeout() to return true when from a request timeout.

v0.12.12

  • (wasm) Fix compilation by not compiler tokio/time on WASM.

v0.12.11

  • Fix decompression returning an error when HTTP/2 ends with an empty data frame.

v0.12.10

  • Add ClientBuilder::connector_layer() to allow customizing the connector stack.
  • Add ClientBuilder::http2_max_header_list_size() option.
  • Fix propagating body size hint (content-length) information when wrapping bodies.
  • Fix decompression of chunked bodies so the connections can be reused more often.

v0.12.9

  • Add tls::CertificateRevocationLists support.
  • Add crate features to enable webpki roots without selecting a rustls provider.
  • Fix connection_verbose() to output read logs.
  • Fix multipart::Part::file() to automatically include content-length.
  • Fix proxy to internally no longer cache system proxy settings.

v0.12.8

  • Add support for SOCKS4 proxies.
  • Add multipart::Form::file() method for adding files easily.
  • Add Body::wrap() to wrap any http_body::Body type.
  • Fix the pool configuration to use a timer to remove expired connections.

v0.12.7

  • Revert adding impl Service<http::Request<_>> for Client.

v0.12.6

  • Add support for danger_accept_invalid_hostnames for rustls.
  • Add impl Service<http::Request<Body>> for Client and &'_ Client.
  • Add support for !Sync bodies in Body::wrap_stream().
  • Enable happy eyeballs when hickory-dns is used.
  • Fix Proxy so that HTTP(S)_PROXY values take precedence over ALL_PROXY.
  • Fix blocking::RequestBuilder::header() from unsetting sensitive on passed header values.

v0.12.5

  • Add blocking::ClientBuilder::dns_resolver() method to change DNS resolver in blocking client.
  • Add http3 feature back, still requiring reqwest_unstable.
  • Add rustls-tls-no-provider Cargo feature to use rustls without a crypto provider.
  • Fix Accept-Encoding header combinations.
  • Fix http3 resolving IPv6 addresses.
  • Internal: upgrade to rustls 0.23.

v0.12.4

  • Add zstd support, enabled with zstd Cargo feature.
  • Add ClientBuilder::read_timeout(Duration), which applies the duration for each read operation. The timeout resets after a successful read.

v0.12.3

  • Add FromStr for dns::Name.
  • Add ClientBuilder::built_in_webpki_certs(bool) to enable them separately.
  • Add ClientBuilder::built_in_native_certs(bool) to enable them separately.
  • Fix sending content-length: 0 for GET requests.
  • Fix response body content_length() to return value when timeout is configured.
  • Fix ClientBuilder::resolve() to use lowercase domain names.

v0.12.2

  • Fix missing ALPN when connecting to socks5 proxy with rustls.
  • Fix TLS version limits with rustls.
  • Fix not detected ALPN h2 from server with native-tls.

v0.12.1

  • Fix ClientBuilder::interface() when no TLS is enabled.
  • Fix TlsInfo::peer_certificate() being truncated with rustls.
  • Fix panic if http2 feature disabled but TLS negotiated h2 in ALPN.
  • Fix Display for Error to not include its source error.

Configuration

📅 Schedule: Branch creation - "before 4am every weekday,every weekend" (UTC), Automerge - "before 4am every weekday,every weekend" (UTC).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@hash-worker hash-worker Bot enabled auto-merge January 24, 2026 09:16
@hash-worker hash-worker Bot requested a review from a team January 24, 2026 09:16
@cursor
Copy link
Copy Markdown

cursor Bot commented Jan 24, 2026

PR Summary

Medium Risk
Dependency-only change, but reqwest 0.13 includes breaking TLS/feature behavior changes that could affect HTTP client behavior or compilation in crates that rely on specific reqwest features.

Overview
Updates the workspace dependency on reqwest from 0.12.24 to 0.13.0 in Cargo.toml (still using default-features = false with rustls-tls).

No code changes are included; any impact will come from reqwest’s new defaults/feature behavior in downstream crates that use it.

Reviewed by Cursor Bugbot for commit 09b509b. Bugbot is set up for automated code reviews on this repo. Configure here.

@github-actions github-actions Bot added the area/deps Relates to third-party dependencies (area) label Jan 24, 2026
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented Jan 24, 2026

Merging this PR will not alter performance

✅ 80 untouched benchmarks


Comparing deps/rs/reqwest-0.x (45524ce) with main (37eba4a)1

Open in CodSpeed

Footnotes

  1. No successful run was found on main (329f529) during the generation of this report, so 37eba4a was used instead as the comparison base. There might be some changes unrelated to this pull request in this report.

@augmentcode
Copy link
Copy Markdown

augmentcode Bot commented Jan 24, 2026

🤖 Augment PR Summary

Summary: Updates the workspace Rust dependency on reqwest from 0.12.24 to 0.13.0.
Why: Keeps the HTTP client stack current, though reqwest 0.13 includes breaking changes (notably feature/TLS-related).

🤖 Was this summary useful? React with 👍 or 👎

Copy link
Copy Markdown

@augmentcode augmentcode Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 3 suggestions posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

Comment thread Cargo.toml Outdated
Comment thread Cargo.toml Outdated
Comment thread Cargo.toml Outdated
@codecov
Copy link
Copy Markdown

codecov Bot commented Jan 24, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.49%. Comparing base (37eba4a) to head (45524ce).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #8319   +/-   ##
=======================================
  Coverage   62.49%   62.49%           
=======================================
  Files        1318     1318           
  Lines      134235   134235           
  Branches     5521     5521           
=======================================
+ Hits        83894    83896    +2     
+ Misses      49426    49424    -2     
  Partials      915      915           
Flag Coverage Δ
apps.hash-ai-worker-ts 1.40% <ø> (ø)
apps.hash-api 0.00% <ø> (ø)
blockprotocol.type-system 40.84% <ø> (ø)
local.claude-hooks 0.00% <ø> (ø)
local.harpc-client 51.24% <ø> (ø)
local.hash-graph-sdk 9.63% <ø> (ø)
local.hash-isomorphic-utils 0.00% <ø> (ø)
rust.antsi 0.00% <ø> (ø)
rust.error-stack 90.87% <ø> (ø)
rust.harpc-codec 84.70% <ø> (ø)
rust.harpc-net 96.22% <ø> (+0.03%) ⬆️
rust.harpc-tower 67.03% <ø> (ø)
rust.harpc-types 0.00% <ø> (ø)
rust.harpc-wire-protocol 92.23% <ø> (ø)
rust.hash-codec 72.76% <ø> (ø)
rust.hash-graph-api 2.52% <ø> (ø)
rust.hash-graph-authorization 62.34% <ø> (ø)
rust.hash-graph-postgres-store 26.38% <ø> (ø)
rust.hash-graph-store 37.76% <ø> (ø)
rust.hash-graph-temporal-versioning 47.95% <ø> (ø)
rust.hash-graph-types 0.00% <ø> (ø)
rust.hash-graph-validation 83.45% <ø> (ø)
rust.hashql-ast 87.23% <ø> (ø)
rust.hashql-compiletest 29.69% <ø> (ø)
rust.hashql-core 82.29% <ø> (ø)
rust.hashql-diagnostics 72.43% <ø> (ø)
rust.hashql-eval 69.13% <ø> (ø)
rust.hashql-hir 89.06% <ø> (ø)
rust.hashql-mir 92.64% <ø> (ø)
rust.hashql-syntax-jexpr 94.05% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@hash-worker hash-worker Bot force-pushed the deps/rs/reqwest-0.x branch from d683999 to f4d15d3 Compare February 6, 2026 19:53
@hash-worker
Copy link
Copy Markdown
Contributor Author

hash-worker Bot commented Feb 6, 2026

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock
Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --package reqwest@0.12.28 --precise 0.13.2
    Updating crates.io index
error: failed to select a version for `reqwest`.
    ... required by package `hash-graph-api v0.0.0 (/tmp/renovate/repos/github/hashintel/hash/libs/@local/graph/api)`
    ... which satisfies path dependency `hash-graph-api` (locked to 0.0.0) of package `hash-graph v0.0.0 (/tmp/renovate/repos/github/hashintel/hash/apps/hash-graph)`
versions that meet the requirements `^0.13.0` are: 0.13.2, 0.13.1, 0.13.0

package `hash-graph-api` depends on `reqwest` with feature `rustls-tls` but `reqwest` does not have that feature.
 available features: __native-tls, __native-tls-alpn, __rustls, __rustls-aws-lc-rs, __tls, blocking, brotli, charset, cookies, default, default-tls, deflate, form, gzip, h2, hickory-dns, http2, http3, json, multipart, native-tls, native-tls-no-alpn, native-tls-vendored, native-tls-vendored-no-alpn, query, rustls, rustls-native-certs, rustls-no-provider, socks, stream, system-proxy, webpki-roots, zstd


failed to select a version for `reqwest` which could resolve this conflict

@vercel
Copy link
Copy Markdown

vercel Bot commented Feb 6, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
hash Ready Ready Preview, Comment Apr 29, 2026 8:15am
hashdotdesign Ready Ready Preview, Comment Apr 29, 2026 8:15am
hashdotdesign-tokens Ready Ready Preview, Comment Apr 29, 2026 8:15am
petrinaut Ready Ready Preview Apr 29, 2026 8:15am

@hash-worker hash-worker Bot changed the title Update Rust crate reqwest to 0.13.0 Update Rust crate reqwest to 0.13.0 - autoclosed Apr 20, 2026
@hash-worker hash-worker Bot closed this Apr 20, 2026
auto-merge was automatically disabled April 20, 2026 14:47

Pull request was closed

@hash-worker hash-worker Bot deleted the deps/rs/reqwest-0.x branch April 20, 2026 14:47
@hash-worker hash-worker Bot changed the title Update Rust crate reqwest to 0.13.0 - autoclosed Update Rust crate reqwest to 0.13.0 Apr 21, 2026
@hash-worker hash-worker Bot reopened this Apr 21, 2026
@hash-worker hash-worker Bot force-pushed the deps/rs/reqwest-0.x branch 2 times, most recently from f4d15d3 to 09b509b Compare April 21, 2026 00:55
@semgrep-code-hashintel
Copy link
Copy Markdown

Semgrep found 1 tainted-path finding:

  • libs/@local/hashql/compiletest/src/harness/trial/stats.rs

The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.

View Dataflow Graph
flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>libs/@local/hashql/compiletest/src/harness/trial/stats.rs</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/hashintel/hash/blob/09b509b7401f864c848d6a790650cf97731c746d/libs/@local/hashql/compiletest/src/harness/trial/stats.rs#L43 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 43] path</a>"]
        end
        %% Intermediate

        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/hashintel/hash/blob/09b509b7401f864c848d6a790650cf97731c746d/libs/@local/hashql/compiletest/src/harness/trial/stats.rs#L43 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 43] path</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    File0:::invis

    %% Connections

    Source --> Sink

Loading

@semgrep-code-hashintel
Copy link
Copy Markdown

Semgrep found 1 ssc-4759c514-b537-20ef-d52f-ebb0a5c388fa finding:

Risk: Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise.

Fix: Upgrade this library to at least version 1.15.0 at hash/yarn.lock:23147.

Reference(s): GHSA-fvcv-3m26-pcqx, CVE-2026-40175

Semgrep found 1 ssc-5ea2c631-7cef-a4e0-e641-d179af079827 finding:

Risk: Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying NO_PROXY, so requests to loopback or internal hosts such as localhost. or [::1] can be sent through a configured proxy instead of bypassing it. If an attacker can influence request URLs, they may force local/internal Axios traffic through an attacker-controlled proxy, undermining SSRF protections and exposing sensitive responses.

Manual Review Advice: A vulnerability from this advisory is reachable if you have NO_PROXY configured in your environment

Fix: Upgrade this library to at least version 1.15.0 at hash/yarn.lock:23147.

Reference(s): GHSA-3p68-rc4w-qgx5, CVE-2025-62718

@hash-worker hash-worker Bot enabled auto-merge April 21, 2026 01:49
@indietyp indietyp force-pushed the deps/rs/reqwest-0.x branch from 09b509b to 45524ce Compare April 29, 2026 08:03
@github-actions github-actions Bot added area/apps > hash* Affects HASH (a `hash-*` app) type/eng > backend Owned by the @backend team area/apps area/apps > hash-graph labels Apr 29, 2026
Copy link
Copy Markdown
Member

This stack of pull requests is managed by Graphite. Learn more about stacking.

@hash-worker
Copy link
Copy Markdown
Contributor Author

hash-worker Bot commented Apr 29, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@indietyp indietyp requested a review from TimDiekmann April 29, 2026 08:47
@graphite-app graphite-app Bot requested review from a team April 29, 2026 09:06
@hash-worker hash-worker Bot changed the title Update Rust crate reqwest to 0.13.0 Update Rust crate reqwest to 0.13.0 - abandoned Apr 29, 2026
@hash-worker
Copy link
Copy Markdown
Contributor Author

hash-worker Bot commented Apr 29, 2026

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

@github-actions
Copy link
Copy Markdown
Contributor

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 2002 $$28.1 \mathrm{ms} \pm 199 \mathrm{μs}\left({\color{gray}2.90 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$3.56 \mathrm{ms} \pm 20.9 \mathrm{μs}\left({\color{gray}0.377 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 1001 $$12.9 \mathrm{ms} \pm 83.5 \mathrm{μs}\left({\color{gray}2.65 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 3314 $$44.7 \mathrm{ms} \pm 354 \mathrm{μs}\left({\color{gray}2.85 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$15.8 \mathrm{ms} \pm 104 \mathrm{μs}\left({\color{gray}3.58 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 1526 $$24.7 \mathrm{ms} \pm 187 \mathrm{μs}\left({\color{gray}0.863 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 2078 $$29.1 \mathrm{ms} \pm 224 \mathrm{μs}\left({\color{gray}2.51 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.93 \mathrm{ms} \pm 23.4 \mathrm{μs}\left({\color{gray}1.48 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 1033 $$14.5 \mathrm{ms} \pm 131 \mathrm{μs}\left({\color{gray}4.00 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_medium

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 102 $$3.84 \mathrm{ms} \pm 21.6 \mathrm{μs}\left({\color{gray}-0.022 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$3.04 \mathrm{ms} \pm 17.6 \mathrm{μs}\left({\color{gray}0.228 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 51 $$3.39 \mathrm{ms} \pm 17.4 \mathrm{μs}\left({\color{gray}0.667 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 269 $$5.25 \mathrm{ms} \pm 37.4 \mathrm{μs}\left({\color{gray}-0.343 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$3.58 \mathrm{ms} \pm 22.6 \mathrm{μs}\left({\color{gray}-1.401 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 107 $$4.16 \mathrm{ms} \pm 25.4 \mathrm{μs}\left({\color{gray}-1.199 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 133 $$4.46 \mathrm{ms} \pm 23.9 \mathrm{μs}\left({\color{gray}-0.186 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.49 \mathrm{ms} \pm 15.8 \mathrm{μs}\left({\color{gray}0.043 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 63 $$4.18 \mathrm{ms} \pm 30.8 \mathrm{μs}\left({\color{gray}1.02 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_none

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 2 $$2.69 \mathrm{ms} \pm 17.5 \mathrm{μs}\left({\color{gray}-1.012 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$2.57 \mathrm{ms} \pm 14.1 \mathrm{μs}\left({\color{gray}0.819 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 1 $$2.63 \mathrm{ms} \pm 13.9 \mathrm{μs}\left({\color{gray}-1.922 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 8 $$2.93 \mathrm{ms} \pm 16.4 \mathrm{μs}\left({\color{gray}-1.458 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$2.73 \mathrm{ms} \pm 17.6 \mathrm{μs}\left({\color{gray}-1.429 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 3 $$2.92 \mathrm{ms} \pm 15.9 \mathrm{μs}\left({\color{gray}-1.859 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_small

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 52 $$3.07 \mathrm{ms} \pm 16.4 \mathrm{μs}\left({\color{gray}0.934 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$2.77 \mathrm{ms} \pm 13.3 \mathrm{μs}\left({\color{gray}0.592 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 25 $$3.02 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}0.925 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 94 $$3.47 \mathrm{ms} \pm 19.5 \mathrm{μs}\left({\color{gray}0.258 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$3.00 \mathrm{ms} \pm 16.6 \mathrm{μs}\left({\color{gray}0.986 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 26 $$3.32 \mathrm{ms} \pm 19.6 \mathrm{μs}\left({\color{gray}0.983 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 66 $$3.43 \mathrm{ms} \pm 20.3 \mathrm{μs}\left({\color{gray}1.15 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.03 \mathrm{ms} \pm 21.3 \mathrm{μs}\left({\color{gray}2.08 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 29 $$3.41 \mathrm{ms} \pm 19.5 \mathrm{μs}\left({\color{gray}0.016 \mathrm{\%}}\right) $$ Flame Graph

read_scaling_complete

Function Value Mean Flame graphs
entity_by_id;one_depth 1 entities $$54.6 \mathrm{ms} \pm 361 \mathrm{μs}\left({\color{gray}-2.492 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 10 entities $$46.9 \mathrm{ms} \pm 254 \mathrm{μs}\left({\color{gray}1.06 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 25 entities $$51.0 \mathrm{ms} \pm 313 \mathrm{μs}\left({\color{gray}-0.361 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 5 entities $$45.3 \mathrm{ms} \pm 317 \mathrm{μs}\left({\color{gray}0.547 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 50 entities $$63.2 \mathrm{ms} \pm 427 \mathrm{μs}\left({\color{gray}-3.547 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 1 entities $$62.1 \mathrm{ms} \pm 366 \mathrm{μs}\left({\color{gray}-1.250 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 10 entities $$56.7 \mathrm{ms} \pm 360 \mathrm{μs}\left({\color{gray}-2.508 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 25 entities $$99.6 \mathrm{ms} \pm 442 \mathrm{μs}\left({\color{gray}-1.851 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 5 entities $$46.6 \mathrm{ms} \pm 259 \mathrm{μs}\left({\color{gray}-2.095 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 50 entities $$298 \mathrm{ms} \pm 926 \mathrm{μs}\left({\color{lightgreen}-8.719 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 1 entities $$19.6 \mathrm{ms} \pm 150 \mathrm{μs}\left({\color{gray}-0.364 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 10 entities $$20.5 \mathrm{ms} \pm 107 \mathrm{μs}\left({\color{gray}-0.990 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 25 entities $$20.6 \mathrm{ms} \pm 123 \mathrm{μs}\left({\color{gray}-0.642 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 5 entities $$19.8 \mathrm{ms} \pm 118 \mathrm{μs}\left({\color{gray}1.20 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 50 entities $$26.0 \mathrm{ms} \pm 148 \mathrm{μs}\left({\color{gray}0.655 \mathrm{\%}}\right) $$ Flame Graph

read_scaling_linkless

Function Value Mean Flame graphs
entity_by_id 1 entities $$19.9 \mathrm{ms} \pm 111 \mathrm{μs}\left({\color{gray}-0.072 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10 entities $$19.7 \mathrm{ms} \pm 102 \mathrm{μs}\left({\color{gray}-1.559 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 100 entities $$19.8 \mathrm{ms} \pm 142 \mathrm{μs}\left({\color{gray}0.010 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 1000 entities $$20.4 \mathrm{ms} \pm 106 \mathrm{μs}\left({\color{gray}-2.125 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10000 entities $$27.2 \mathrm{ms} \pm 229 \mathrm{μs}\left({\color{gray}-1.419 \mathrm{\%}}\right) $$ Flame Graph

representative_read_entity

Function Value Mean Flame graphs
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1 $$36.0 \mathrm{ms} \pm 325 \mathrm{μs}\left({\color{red}5.83 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1 $$36.0 \mathrm{ms} \pm 322 \mathrm{μs}\left({\color{red}5.79 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1 $$36.1 \mathrm{ms} \pm 283 \mathrm{μs}\left({\color{gray}4.54 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1 $$38.0 \mathrm{ms} \pm 308 \mathrm{μs}\left({\color{gray}4.21 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2 $$35.5 \mathrm{ms} \pm 322 \mathrm{μs}\left({\color{gray}2.76 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1 $$35.1 \mathrm{ms} \pm 332 \mathrm{μs}\left({\color{gray}-0.257 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1 $$37.7 \mathrm{ms} \pm 316 \mathrm{μs}\left({\color{gray}4.76 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1 $$36.3 \mathrm{ms} \pm 318 \mathrm{μs}\left({\color{gray}1.90 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1 $$37.1 \mathrm{ms} \pm 278 \mathrm{μs}\left({\color{gray}2.58 \mathrm{\%}}\right) $$ Flame Graph

representative_read_entity_type

Function Value Mean Flame graphs
get_entity_type_by_id Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba $$9.00 \mathrm{ms} \pm 49.0 \mathrm{μs}\left({\color{gray}2.80 \mathrm{\%}}\right) $$ Flame Graph

representative_read_multiple_entities

Function Value Mean Flame graphs
entity_by_property traversal_paths=0 0 $$100 \mathrm{ms} \pm 560 \mathrm{μs}\left({\color{red}7.12 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=255 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true $$151 \mathrm{ms} \pm 764 \mathrm{μs}\left({\color{gray}0.533 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false $$101 \mathrm{ms} \pm 525 \mathrm{μs}\left({\color{gray}-0.348 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true $$113 \mathrm{ms} \pm 551 \mathrm{μs}\left({\color{gray}-0.013 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true $$120 \mathrm{ms} \pm 605 \mathrm{μs}\left({\color{gray}-0.596 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true $$129 \mathrm{ms} \pm 676 \mathrm{μs}\left({\color{gray}-2.010 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=0 0 $$104 \mathrm{ms} \pm 689 \mathrm{μs}\left({\color{gray}-0.671 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=255 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true $$134 \mathrm{ms} \pm 617 \mathrm{μs}\left({\color{gray}-2.447 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false $$111 \mathrm{ms} \pm 502 \mathrm{μs}\left({\color{gray}-0.374 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true $$121 \mathrm{ms} \pm 600 \mathrm{μs}\left({\color{gray}-0.509 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true $$123 \mathrm{ms} \pm 747 \mathrm{μs}\left({\color{gray}-0.015 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true $$122 \mathrm{ms} \pm 629 \mathrm{μs}\left({\color{gray}-2.060 \mathrm{\%}}\right) $$

scenarios

Function Value Mean Flame graphs
full_test query-limited $$192 \mathrm{ms} \pm 818 \mathrm{μs}\left({\color{gray}3.28 \mathrm{\%}}\right) $$ Flame Graph
full_test query-unlimited $$166 \mathrm{ms} \pm 2.04 \mathrm{ms}\left({\color{gray}-1.769 \mathrm{\%}}\right) $$ Flame Graph
linked_queries query-limited $$42.4 \mathrm{ms} \pm 232 \mathrm{μs}\left({\color{red}5.74 \mathrm{\%}}\right) $$ Flame Graph
linked_queries query-unlimited $$547 \mathrm{ms} \pm 1.03 \mathrm{ms}\left({\color{gray}-0.102 \mathrm{\%}}\right) $$ Flame Graph

@hash-worker hash-worker Bot added this pull request to the merge queue Apr 29, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Apr 29, 2026
@indietyp
Copy link
Copy Markdown
Member

indietyp commented May 4, 2026

superseded by #8672

@indietyp indietyp closed this May 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/apps > hash* Affects HASH (a `hash-*` app) area/apps > hash-graph area/apps area/deps Relates to third-party dependencies (area) type/eng > backend Owned by the @backend team

Development

Successfully merging this pull request may close these issues.

2 participants