H-6609: Remove hash-backend-load, updates for uuid vuln#8889
Conversation
PR SummaryMedium Risk Overview Alongside that cleanup, Temporal packages are upgraded from 1.12.1 → 1.18.1 across API, workers, graph SDK, and backend utils. Smaller bumps include
Reviewed by Cursor Bugbot for commit 785cdc6. Bugbot is set up for automated code reviews on this repo. Configure here. |
Dependency ReviewThe following issues were found:
|
There was a problem hiding this comment.
Pull request overview
This PR removes the unused @tests/hash-backend-load load-testing package (and its Artillery/OpenTelemetry setup) to reduce dependency maintenance, and applies dependency updates intended to address uuid-related vulnerabilities (plus a few other version bumps).
Changes:
- Removed the entire
tests/hash-backend-loadworkspace (configs, scripts, scenarios, and source). - Updated Temporal dependencies across multiple packages to
1.18.1(plus a few other dependency bumps). - Removed the
slonik-based Postgres pool helper from@local/hash-backend-utilsand dropped theslonikdependency.
Reviewed changes
Copilot reviewed 40 out of 41 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/hash-backend-load/turbo.json | Removed turbo task configuration for the deleted load-testing workspace. |
| tests/hash-backend-load/tsconfig.json | Removed TS config for the deleted load-testing workspace. |
| tests/hash-backend-load/tsconfig.build.json | Removed build TS config for the deleted load-testing workspace. |
| tests/hash-backend-load/src/types.ts | Removed shared Artillery hook/type definitions for the deleted load-testing workspace. |
| tests/hash-backend-load/src/tracing/sdk.ts | Removed OpenTelemetry SDK wiring used by the load tests. |
| tests/hash-backend-load/src/tracing/request.ts | Removed per-request span injection hooks used by the load tests. |
| tests/hash-backend-load/src/main.ts | Removed package entrypoint exporting Artillery processors/hooks. |
| tests/hash-backend-load/src/graph/user.ts | Removed Graph helper used by load-test scenarios. |
| tests/hash-backend-load/src/graph/api.ts | Removed Graph API client setup used by load tests. |
| tests/hash-backend-load/src/authentication/session.ts | Removed Kratos session refresh hook used by load tests. |
| tests/hash-backend-load/src/authentication/registration.ts | Removed signup/registration flow helpers used by load tests. |
| tests/hash-backend-load/src/authentication/reauthenticate.ts | Removed reauth logic used by load tests. |
| tests/hash-backend-load/src/authentication/kratos.ts | Removed Kratos client setup/types used by load tests. |
| tests/hash-backend-load/scripts/test.sh | Removed integration test runner script for Artillery scenarios. |
| tests/hash-backend-load/scenarios/register.yml | Removed Artillery “Register” scenario. |
| tests/hash-backend-load/scenarios/read-property-types.yml | Removed Artillery scenario for reading property types. |
| tests/hash-backend-load/scenarios/read-property-types-value-property-refs.yml | Removed Artillery scenario variant for deeper references. |
| tests/hash-backend-load/scenarios/read-property-types-property-refs.yml | Removed Artillery scenario variant for property references. |
| tests/hash-backend-load/scenarios/read-entity-types.yml | Removed Artillery scenario for reading entity types. |
| tests/hash-backend-load/scenarios/read-entity-types-value-property-entity-refs.yml | Removed Artillery scenario variant for deeper type references. |
| tests/hash-backend-load/scenarios/read-entity-types-property-entity-refs.yml | Removed Artillery scenario variant for type refs. |
| tests/hash-backend-load/scenarios/read-entity-types-parents.yml | Removed Artillery scenario variant for parents. |
| tests/hash-backend-load/scenarios/read-entity-types-entity-refs.yml | Removed Artillery scenario variant for entity refs. |
| tests/hash-backend-load/scenarios/read-data-types.yml | Removed Artillery scenario for reading data types. |
| tests/hash-backend-load/scenarios/ontology-read.yml | Removed Artillery scenario for ontology read queries. |
| tests/hash-backend-load/scenarios/flow.yml | Removed Artillery scenario for “flow run” style load. |
| tests/hash-backend-load/rollup.config.ts | Removed bundling configuration for the deleted load-testing workspace. |
| tests/hash-backend-load/package.json | Removed workspace manifest for the deleted load-testing workspace. |
| tests/hash-backend-load/LICENSE.md | Removed workspace-local license file with the deleted package. |
| tests/hash-backend-load/eslint.config.js | Removed workspace-local ESLint config with the deleted package. |
| tests/hash-backend-load/artillery.yml | Removed Artillery config with the deleted package. |
| package.json | Added a resolutions entry intended to address uuid vulnerability exposure. |
| libs/@local/hash-isomorphic-utils/package.json | Bumped @temporalio/workflow to 1.18.1. |
| libs/@local/hash-backend-utils/src/postgres.ts | Removed Slonik-based Postgres pool helper implementation. |
| libs/@local/hash-backend-utils/package.json | Bumped Temporal packages to 1.18.1, removed slonik. |
| libs/@local/graph/sdk/typescript/package.json | Bumped @temporalio/client to 1.18.1. |
| apps/hash-integration-worker/package.json | Bumped Temporal packages to 1.18.1. |
| apps/hash-api/package.json | Bumped @temporalio/* to 1.18.1 and updated @snowplow/node-tracker. |
| apps/hash-ai-worker-ts/package.json | Bumped Temporal packages to 1.18.1 and updated @google-cloud/storage. |
| .claude/hooks/package.json | Bumped natural patch version. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8889 +/- ##
=======================================
Coverage 59.08% 59.09%
=======================================
Files 1347 1346 -1
Lines 130513 130507 -6
Branches 5906 5906
=======================================
- Hits 77118 77117 -1
+ Misses 52490 52485 -5
Partials 905 905 Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Benchmark results
|
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 2002 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 1001 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 3314 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 1526 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 2078 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 1033 | Flame Graph |
policy_resolution_medium
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 102 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 51 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 269 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 107 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 133 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 63 | Flame Graph |
policy_resolution_none
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 2 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 8 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 3 | Flame Graph |
policy_resolution_small
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 52 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 25 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 94 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 26 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 66 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 29 | Flame Graph |
read_scaling_complete
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id;one_depth | 1 entities | Flame Graph | |
| entity_by_id;one_depth | 10 entities | Flame Graph | |
| entity_by_id;one_depth | 25 entities | Flame Graph | |
| entity_by_id;one_depth | 5 entities | Flame Graph | |
| entity_by_id;one_depth | 50 entities | Flame Graph | |
| entity_by_id;two_depth | 1 entities | Flame Graph | |
| entity_by_id;two_depth | 10 entities | Flame Graph | |
| entity_by_id;two_depth | 25 entities | Flame Graph | |
| entity_by_id;two_depth | 5 entities | Flame Graph | |
| entity_by_id;two_depth | 50 entities | Flame Graph | |
| entity_by_id;zero_depth | 1 entities | Flame Graph | |
| entity_by_id;zero_depth | 10 entities | Flame Graph | |
| entity_by_id;zero_depth | 25 entities | Flame Graph | |
| entity_by_id;zero_depth | 5 entities | Flame Graph | |
| entity_by_id;zero_depth | 50 entities | Flame Graph |
read_scaling_linkless
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id | 1 entities | Flame Graph | |
| entity_by_id | 10 entities | Flame Graph | |
| entity_by_id | 100 entities | Flame Graph | |
| entity_by_id | 1000 entities | Flame Graph | |
| entity_by_id | 10000 entities | Flame Graph |
representative_read_entity
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1
|
Flame Graph |
representative_read_entity_type
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| get_entity_type_by_id | Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba
|
Flame Graph |
representative_read_multiple_entities
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_property | traversal_paths=0 | 0 | |
| entity_by_property | traversal_paths=255 | 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=0 | 0 | |
| link_by_source_by_property | traversal_paths=255 | 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true |
scenarios
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| full_test | query-limited | Flame Graph | |
| full_test | query-unlimited | Flame Graph | |
| linked_queries | query-limited | Flame Graph | |
| linked_queries | query-unlimited | Flame Graph |
🌟 What is the purpose of this PR?
We have a package
hash-backend-loadthat was used earlier for load testing.We're not really using it at the moment, and
artilleryis pulling in lots of dependencies that need maintenance.This PR removes the package, and makes some other small dependency updates to address vulnerabilities in
uuid.This doesn't remove all the old
uuid, but some dependencies haven't yet updated. I will revisit again tomorrow, but this is a start with the ones that are less messy.Pre-Merge Checklist 🚀
🚢 Has this modified a publishable library?
This PR:
📜 Does this require a change to the docs?
The changes in this PR:
🕸️ Does this require a change to the Turbo Graph?
The changes in this PR: