Update npm package `@apollo/server` to v5.4.0 [SECURITY] by hash-worker[bot] · Pull Request #8357 · hashintel/hash

hash-worker · 2026-02-04T18:28:00Z

This PR contains the following updates:

Package	Change	Age	Confidence
@apollo/server (source)	`5.0.0` -> `5.4.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-23897

Impact

The default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to Denial of Service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

This issue does not affect users that use @apollo/server as a dependency for integration packages, like @as integrations/express5 or @as-integrations/next, only direct usage of startStandaloneServer.

Who is impacted

Users directly using startStandaloneServer from @apollo/server/standalone.

This issue affects Apollo Server from v5.0.0 through v5.3.x.

It also affects all releases of the end-of-life major versions v4, v3, and v2. Although Apollo Server v4 is EOL and Apollo no longer commits to providing support or updates for it, a fix for it was released in v4.13.0. Apollo Server v3 and v2 are no longer updated, as they have been EOL since 2024 and 2023 respectively.

Patches

Patches for this issue are released as @apollo/server versions 5.4.0 and 4.13.0.

In accordance with RFC 7159, these versions now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, [RFC 8259 (https://datatracker.ietf.org/doc/html/rfc8259#section-8.1), is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, the restriction may be tightened further to only allow UTF-8.

Workarounds

Users of apollo-server v2 or v3 that cannot upgrade for some reason could switch from the standalone apollo-server
package to an integration package like apollo-server-express or apollo-server-koa and set up their own server. Please note that these old packages are generally EOL and do not receive any more support or bug fixes. This can only be seen as a short-term workaround. Updating to @apollo/server v5 should be a priority.

Release Notes

apollographql/apollo-server (@apollo/server)

`v5.4.0`

Compare Source

Minor Changes

d25a5bd Thanks @phryneas! - ⚠️ SECURITY @apollo/server/standalone:

The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
Any other character set will be rejected with a 415 Unsupported Media Type error.
Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8.
Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now.
In a future major release, we may tighten this restriction further to only allow UTF-8.

If you were not using startStandaloneServer, you were not affected by this vulnerability.

Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

`v5.3.0`

Compare Source

Minor Changes

#8062 8e54e58 Thanks @cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

const server = new ApolloServer({
  typeDefs,
  resolvers,
  executionOptions: {
    maxCoercionErrors: 50,
  },
});

#8014 26320bc Thanks @mo4islona! - Expose graphql validation options.

const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationOptions: {
    maxErrors: 10,
  },
});

`v5.2.0`

Compare Source

Minor Changes

#8161 51acbeb Thanks @jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.
```
import { legacyExecuteIncrementally } from '@&#8203;yaacovcr/transform';

const server = new ApolloServer({
  // ...
  legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
});
```
If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

`v5.1.0`

Compare Source

Minor Changes

#8148 80a1a1a Thanks @jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with graphql@17.0.0-alpha.9. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.

Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

vercel · 2026-02-04T18:28:05Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Feb 4, 2026 6:40pm
hashdotdesign	Ready	Preview, Comment	Feb 4, 2026 6:40pm
hashdotdesign-tokens	Ready	Preview, Comment	Feb 4, 2026 6:40pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
petrinaut	Skipped		Feb 4, 2026 6:40pm

cursor · 2026-02-04T18:28:07Z

PR Summary

Low Risk
Dependency-only upgrade with lockfile updates; low risk aside from potential runtime behavior changes in Apollo Server request parsing.

Overview
Updates @apollo/server in @apps/hash-api from 5.0.0 to 5.4.0 and refreshes the lockfile accordingly.

The yarn.lock changes pull in updated transitive dependencies (notably body-parser ^2.2.2, qs 6.14.1, and new content-type entry) as part of the Apollo Server upgrade.

^{Written by Cursor Bugbot for commit 706de08. This will update automatically on new commits. Configure here.}

augmentcode · 2026-02-04T18:29:33Z

🤖 Augment PR Summary

Summary: Updates the Hash API’s Apollo Server dependency to pick up the upstream security fix.

Changes:

Bumps @apollo/server from 5.0.0 to 5.4.0 (and updates the lockfile accordingly).

Technical Notes: Apollo Server 5.4.0 rejects request bodies with non-UTF (UTF-8/16/32) JSON encodings with 415 Unsupported Media Type, addressing CVE-2026-23897 affecting startStandaloneServer defaults.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

codecov · 2026-02-04T18:31:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.11%. Comparing base (1492bce) to head (706de08).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8357   +/-   ##
=======================================
  Coverage   60.10%   60.11%           
=======================================
  Files        1235     1235           
  Lines      118201   118201           
  Branches     5180     5180           
=======================================
+ Hits        71050    71052    +2     
+ Misses      46324    46322    -2     
  Partials      827      827

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.41% <ø> (ø)`
apps.hash-api	`0.00% <ø> (ø)`
blockprotocol.type-system	`40.84% <ø> (ø)`
local.claude-hooks	`0.00% <ø> (ø)`
local.harpc-client	`51.24% <ø> (ø)`
local.hash-graph-sdk	`10.88% <ø> (ø)`
local.hash-isomorphic-utils	`0.00% <ø> (ø)`
rust.antsi	`0.00% <ø> (ø)`
rust.error-stack	`90.88% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-net	`96.19% <ø> (+0.03%)`	⬆️
rust.harpc-tower	`66.80% <ø> (ø)`
rust.harpc-types	`0.00% <ø> (ø)`
rust.harpc-wire-protocol	`92.23% <ø> (ø)`
rust.hash-codec	`72.76% <ø> (ø)`
rust.hash-graph-api	`2.88% <ø> (ø)`
rust.hash-graph-authorization	`62.47% <ø> (ø)`
rust.hash-graph-postgres-store	`25.61% <ø> (ø)`
rust.hash-graph-store	`30.54% <ø> (ø)`
rust.hash-graph-temporal-versioning	`47.95% <ø> (ø)`
rust.hash-graph-types	`0.00% <ø> (ø)`
rust.hash-graph-validation	`83.45% <ø> (ø)`
rust.hashql-ast	`87.25% <ø> (ø)`
rust.hashql-compiletest	`46.65% <ø> (ø)`
rust.hashql-core	`81.77% <ø> (ø)`
rust.hashql-diagnostics	`72.43% <ø> (ø)`
rust.hashql-eval	`68.54% <ø> (ø)`
rust.hashql-hir	`89.10% <ø> (ø)`
rust.hashql-mir	`87.91% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.05% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codspeed-hq · 2026-02-04T18:32:27Z

Merging this PR will not alter performance

✅ 21 untouched benchmarks
🗄️ 12 archived benchmarks run¹

_{Comparing deps/js/npm-apollo-server-vulnerability (706de08) with main (1492bce)}

12 benchmarks were run, but are now archived. If they were deleted in another branch, consider rebasing to remove them from the report. Instead if they were added back, click here to restore them. ↩

github-actions · 2026-02-04T19:37:51Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$27.0 \mathrm{ms} \pm 191 \mathrm{μs}\left({\color{gray}-0.103 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.29 \mathrm{ms} \pm 14.9 \mathrm{μs}\left({\color{gray}0.879 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1001	$$12.8 \mathrm{ms} \pm 101 \mathrm{μs}\left({\color{gray}2.51 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$43.4 \mathrm{ms} \pm 310 \mathrm{μs}\left({\color{gray}0.159 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$14.3 \mathrm{ms} \pm 91.8 \mathrm{μs}\left({\color{gray}1.19 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1526	$$24.4 \mathrm{ms} \pm 193 \mathrm{μs}\left({\color{gray}1.41 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$43.3 \mathrm{ms} \pm 206 \mathrm{μs}\left({\color{gray}-0.227 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$20.0 \mathrm{ms} \pm 105 \mathrm{μs}\left({\color{gray}-1.895 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$28.4 \mathrm{ms} \pm 165 \mathrm{μs}\left({\color{lightgreen}-9.290 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.62 \mathrm{ms} \pm 18.2 \mathrm{μs}\left({\color{gray}0.116 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.89 \mathrm{ms} \pm 15.2 \mathrm{μs}\left({\color{gray}1.17 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 51	$$3.21 \mathrm{ms} \pm 14.3 \mathrm{μs}\left({\color{gray}0.181 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$4.99 \mathrm{ms} \pm 24.7 \mathrm{μs}\left({\color{gray}0.187 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.41 \mathrm{ms} \pm 15.7 \mathrm{μs}\left({\color{gray}0.280 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 107	$$3.96 \mathrm{ms} \pm 30.7 \mathrm{μs}\left({\color{gray}-0.364 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.04 \mathrm{ms} \pm 34.5 \mathrm{μs}\left({\color{gray}-4.341 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.29 \mathrm{ms} \pm 15.7 \mathrm{μs}\left({\color{gray}-0.558 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$3.88 \mathrm{ms} \pm 23.2 \mathrm{μs}\left({\color{gray}0.079 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.39 \mathrm{ms} \pm 10.6 \mathrm{μs}\left({\color{gray}0.115 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.35 \mathrm{ms} \pm 11.5 \mathrm{μs}\left({\color{gray}0.352 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1	$$2.44 \mathrm{ms} \pm 12.0 \mathrm{μs}\left({\color{gray}0.582 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.66 \mathrm{ms} \pm 16.0 \mathrm{μs}\left({\color{gray}1.33 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.52 \mathrm{ms} \pm 10.4 \mathrm{μs}\left({\color{gray}0.200 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.70 \mathrm{ms} \pm 11.5 \mathrm{μs}\left({\color{gray}-0.427 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$2.80 \mathrm{ms} \pm 16.9 \mathrm{μs}\left({\color{gray}0.190 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.47 \mathrm{ms} \pm 13.4 \mathrm{μs}\left({\color{gray}0.942 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 25	$$2.63 \mathrm{ms} \pm 12.3 \mathrm{μs}\left({\color{gray}0.202 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.11 \mathrm{ms} \pm 15.5 \mathrm{μs}\left({\color{gray}-0.616 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.67 \mathrm{ms} \pm 12.2 \mathrm{μs}\left({\color{gray}-1.106 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 26	$$2.89 \mathrm{ms} \pm 14.6 \mathrm{μs}\left({\color{gray}-0.917 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.02 \mathrm{ms} \pm 15.3 \mathrm{μs}\left({\color{gray}0.062 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.66 \mathrm{ms} \pm 15.6 \mathrm{μs}\left({\color{gray}0.751 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$2.89 \mathrm{ms} \pm 15.7 \mathrm{μs}\left({\color{gray}0.576 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$39.7 \mathrm{ms} \pm 199 \mathrm{μs}\left({\color{gray}0.655 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$77.3 \mathrm{ms} \pm 428 \mathrm{μs}\left({\color{gray}0.576 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$44.6 \mathrm{ms} \pm 230 \mathrm{μs}\left({\color{gray}1.37 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$46.3 \mathrm{ms} \pm 210 \mathrm{μs}\left({\color{gray}1.09 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$54.0 \mathrm{ms} \pm 276 \mathrm{μs}\left({\color{gray}1.06 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$41.4 \mathrm{ms} \pm 189 \mathrm{μs}\left({\color{gray}0.311 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$415 \mathrm{ms} \pm 957 \mathrm{μs}\left({\color{gray}-1.222 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$96.5 \mathrm{ms} \pm 497 \mathrm{μs}\left({\color{red}7.01 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$85.2 \mathrm{ms} \pm 499 \mathrm{μs}\left({\color{gray}0.585 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$285 \mathrm{ms} \pm 808 \mathrm{μs}\left({\color{gray}0.595 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$15.0 \mathrm{ms} \pm 70.5 \mathrm{μs}\left({\color{gray}1.12 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$15.1 \mathrm{ms} \pm 80.9 \mathrm{μs}\left({\color{gray}2.02 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$15.3 \mathrm{ms} \pm 102 \mathrm{μs}\left({\color{gray}1.59 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$14.9 \mathrm{ms} \pm 73.0 \mathrm{μs}\left({\color{gray}0.725 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$17.8 \mathrm{ms} \pm 128 \mathrm{μs}\left({\color{gray}-1.347 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$15.0 \mathrm{ms} \pm 89.0 \mathrm{μs}\left({\color{gray}-0.061 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$14.7 \mathrm{ms} \pm 81.9 \mathrm{μs}\left({\color{gray}0.067 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$14.8 \mathrm{ms} \pm 76.1 \mathrm{μs}\left({\color{gray}0.265 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$15.5 \mathrm{ms} \pm 70.0 \mathrm{μs}\left({\color{gray}1.19 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$23.0 \mathrm{ms} \pm 163 \mathrm{μs}\left({\color{gray}1.45 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$30.9 \mathrm{ms} \pm 277 \mathrm{μs}\left({\color{gray}3.76 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$30.5 \mathrm{ms} \pm 277 \mathrm{μs}\left({\color{gray}1.14 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$30.1 \mathrm{ms} \pm 274 \mathrm{μs}\left({\color{gray}-1.055 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$29.7 \mathrm{ms} \pm 321 \mathrm{μs}\left({\color{gray}-1.465 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$29.9 \mathrm{ms} \pm 263 \mathrm{μs}\left({\color{gray}-3.661 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$30.4 \mathrm{ms} \pm 283 \mathrm{μs}\left({\color{gray}-1.371 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$30.8 \mathrm{ms} \pm 280 \mathrm{μs}\left({\color{gray}2.05 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$29.9 \mathrm{ms} \pm 318 \mathrm{μs}\left({\color{gray}-2.084 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$29.7 \mathrm{ms} \pm 310 \mathrm{μs}\left({\color{gray}-3.218 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$8.22 \mathrm{ms} \pm 42.5 \mathrm{μs}\left({\color{gray}0.864 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$47.9 \mathrm{ms} \pm 241 \mathrm{μs}\left({\color{gray}0.473 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$95.7 \mathrm{ms} \pm 515 \mathrm{μs}\left({\color{gray}-0.364 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$53.7 \mathrm{ms} \pm 383 \mathrm{μs}\left({\color{gray}1.72 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$61.9 \mathrm{ms} \pm 419 \mathrm{μs}\left({\color{gray}1.36 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$70.8 \mathrm{ms} \pm 450 \mathrm{μs}\left({\color{gray}1.07 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$75.8 \mathrm{ms} \pm 327 \mathrm{μs}\left({\color{gray}-0.914 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$50.3 \mathrm{ms} \pm 312 \mathrm{μs}\left({\color{gray}-1.301 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$77.1 \mathrm{ms} \pm 387 \mathrm{μs}\left({\color{gray}-1.518 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$57.4 \mathrm{ms} \pm 356 \mathrm{μs}\left({\color{gray}-1.381 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$64.9 \mathrm{ms} \pm 460 \mathrm{μs}\left({\color{gray}-0.640 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$66.9 \mathrm{ms} \pm 369 \mathrm{μs}\left({\color{gray}-0.456 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$66.7 \mathrm{ms} \pm 380 \mathrm{μs}\left({\color{gray}-1.999 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$141 \mathrm{ms} \pm 564 \mathrm{μs}\left({\color{gray}1.39 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$138 \mathrm{ms} \pm 610 \mathrm{μs}\left({\color{gray}1.02 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$93.3 \mathrm{ms} \pm 2.37 \mathrm{ms}\left({\color{red}139 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$565 \mathrm{ms} \pm 1.18 \mathrm{ms}\left({\color{lightgreen}-5.368 \mathrm{\%}}\right) $$	Flame Graph

Update npm package @apollo/server to v5.4.0 [SECURITY]

706de08

hash-worker bot enabled auto-merge February 4, 2026 18:28

github-actions bot added area/deps Relates to third-party dependencies (area) area/apps > hash* Affects HASH (a `hash-*` app) area/apps > hash-api Affects the HASH API (app) type/eng > backend Owned by the @backend team area/apps labels Feb 4, 2026

augmentcode bot reviewed Feb 4, 2026

View reviewed changes

vercel bot deployed to Preview – hashdotdesign-tokens February 4, 2026 18:30 View deployment

vercel bot deployed to Preview – hashdotdesign February 4, 2026 18:31 View deployment

vercel bot deployed to Preview – hash February 4, 2026 18:40 View deployment

hash-worker bot assigned CiaranMn Feb 4, 2026

graphite-app bot requested a review from a team February 4, 2026 18:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update npm package `@apollo/server` to v5.4.0 [SECURITY]#8357

Update npm package `@apollo/server` to v5.4.0 [SECURITY]#8357
hash-worker[bot] wants to merge 1 commit intomainfrom
deps/js/npm-apollo-server-vulnerability

hash-worker bot commented Feb 4, 2026

Uh oh!

vercel bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

cursor bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

augmentcode bot commented Feb 4, 2026

Uh oh!

augmentcode bot left a comment

Uh oh!

codecov bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

codspeed-hq bot commented Feb 4, 2026

Uh oh!

github-actions bot commented Feb 4, 2026

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Conversation

hash-worker bot commented Feb 4, 2026

GitHub Vulnerability Alerts

CVE-2026-23897

Impact

Who is impacted

Patches

Workarounds

Release Notes

v5.4.0

Minor Changes

v5.3.0

Minor Changes

v5.2.0

Minor Changes

v5.1.0

Minor Changes

Configuration

Uh oh!

vercel bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

augmentcode bot commented Feb 4, 2026

Uh oh!

augmentcode bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed-hq bot commented Feb 4, 2026

Merging this PR will not alter performance

Footnotes

Uh oh!

github-actions bot commented Feb 4, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

`v5.4.0`

`v5.3.0`

`v5.2.0`

`v5.1.0`

vercel bot commented Feb 4, 2026 •

edited

Loading

cursor bot commented Feb 4, 2026 •

edited

Loading

codecov bot commented Feb 4, 2026 •

edited

Loading