H-6309: Upgrade minimatch, jsonpath, brace-expansion, react-syntax-highlighter

[CiaranMn]

🌟 What is the purpose of this PR?

See title. Dependency housekeeping.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Mar 9, 2026 7:14pm
petrinaut	Ready	Preview, Comment	Mar 9, 2026 7:14pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hashdotdesign	Ignored	Preview	Mar 9, 2026 7:14pm
hashdotdesign-tokens	Ignored	Preview	Mar 9, 2026 7:14pm

[cursor]

PR Summary

Medium Risk
Mostly dependency upgrades, but next.config.js now enables experimental esmExternals: "loose", which can change bundling/runtime behavior and surface new build or SSR edge cases.

Overview
Dependency housekeeping. Bumps jsonpath to 1.3.0 in both hash-api and hash-frontend, and upgrades react-syntax-highlighter to 16.1.1 in @hashintel/block-design-system (with associated lockfile updates like refractor, minimatch, and brace-expansion).

Build configuration change. Enables Next.js experimental esmExternals: "loose" in apps/hash-frontend/next.config.js to alter how externals are resolved during bundling.

^{Written by Cursor Bugbot for commit 87555ec. This will update automatically on new commits. Configure here.}

[augmentcode]

🤖 Augment PR Summary

Summary: This PR performs dependency housekeeping by upgrading several JS dependencies across the monorepo.

Changes:

• Bumped jsonpath from 1.2.1 to 1.3.0 in apps/hash-api and apps/hash-frontend
• Bumped react-syntax-highlighter from 15.6.6 to 16.1.1 in libs/@hashintel/block-design-system
• Updated yarn.lock accordingly (including transitive upgrades mentioned in the title such as minimatch / brace-expansion)

Technical Notes: react-syntax-highlighter v16 is a major release that updates its underlying highlighting dependency chain (notably refractor), so it’s worth validating frontend bundling/SSR behavior and any dependency override assumptions after the upgrade.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[codspeed-hq]

Merging this PR will not alter performance

✅ 80 untouched benchmarks

---

_{Comparing cm/upgrade-js-deps (87555ec) with main (15ebcfe)¹}

Footnotes

1. No successful run was found on main (9f3aa5b) during the generation of this report, so 15ebcfe was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.65%. Comparing base (bb10349) to head (87555ec).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8527   +/-   ##
=======================================
  Coverage   62.65%   62.65%           
=======================================
  Files        1312     1312           
  Lines      133689   133689           
  Branches     5510     5510           
=======================================
  Hits        83757    83757           
  Misses      49018    49018           
  Partials      914      914           

Flag	Coverage Δ
rust.hash-graph-validation	83.45% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[github-actions]

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$28.4 \mathrm{ms} \pm 180 \mathrm{μs}\left({\color{gray}1.01 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.60 \mathrm{ms} \pm 22.2 \mathrm{μs}\left({\color{gray}1.18 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1001	$$13.6 \mathrm{ms} \pm 76.2 \mathrm{μs}\left({\color{gray}3.40 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$44.7 \mathrm{ms} \pm 321 \mathrm{μs}\left({\color{gray}1.64 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$15.7 \mathrm{ms} \pm 112 \mathrm{μs}\left({\color{gray}0.908 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1526	$$25.3 \mathrm{ms} \pm 166 \mathrm{μs}\left({\color{gray}0.292 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$29.0 \mathrm{ms} \pm 145 \mathrm{μs}\left({\color{gray}-0.807 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.94 \mathrm{ms} \pm 29.4 \mathrm{μs}\left({\color{gray}2.39 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$14.8 \mathrm{ms} \pm 104 \mathrm{μs}\left({\color{red}6.76 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.95 \mathrm{ms} \pm 18.9 \mathrm{μs}\left({\color{gray}0.136 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.15 \mathrm{ms} \pm 15.6 \mathrm{μs}\left({\color{gray}-0.122 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 51	$$3.65 \mathrm{ms} \pm 22.6 \mathrm{μs}\left({\color{gray}2.23 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.43 \mathrm{ms} \pm 29.1 \mathrm{μs}\left({\color{gray}0.359 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.77 \mathrm{ms} \pm 21.5 \mathrm{μs}\left({\color{gray}0.076 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 107	$$4.37 \mathrm{ms} \pm 24.6 \mathrm{μs}\left({\color{gray}0.424 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.65 \mathrm{ms} \pm 36.3 \mathrm{μs}\left({\color{gray}0.670 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.58 \mathrm{ms} \pm 16.9 \mathrm{μs}\left({\color{gray}-0.011 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.30 \mathrm{ms} \pm 30.1 \mathrm{μs}\left({\color{gray}1.42 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.87 \mathrm{ms} \pm 13.1 \mathrm{μs}\left({\color{gray}0.099 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.81 \mathrm{ms} \pm 18.1 \mathrm{μs}\left({\color{gray}-0.240 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1	$$2.97 \mathrm{ms} \pm 16.5 \mathrm{μs}\left({\color{gray}0.031 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$3.23 \mathrm{ms} \pm 15.8 \mathrm{μs}\left({\color{gray}1.32 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.05 \mathrm{ms} \pm 16.8 \mathrm{μs}\left({\color{gray}0.493 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$3.33 \mathrm{ms} \pm 18.3 \mathrm{μs}\left({\color{gray}0.736 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.22 \mathrm{ms} \pm 13.4 \mathrm{μs}\left({\color{gray}-0.764 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.95 \mathrm{ms} \pm 18.7 \mathrm{μs}\left({\color{gray}0.134 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 25	$$3.10 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{gray}-1.152 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.71 \mathrm{ms} \pm 22.0 \mathrm{μs}\left({\color{gray}1.02 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.21 \mathrm{ms} \pm 17.6 \mathrm{μs}\left({\color{gray}-0.781 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 26	$$3.49 \mathrm{ms} \pm 23.0 \mathrm{μs}\left({\color{gray}-0.833 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.71 \mathrm{ms} \pm 16.4 \mathrm{μs}\left({\color{gray}2.37 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.23 \mathrm{ms} \pm 15.9 \mathrm{μs}\left({\color{gray}0.894 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.52 \mathrm{ms} \pm 17.2 \mathrm{μs}\left({\color{gray}0.294 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$42.6 \mathrm{ms} \pm 163 \mathrm{μs}\left({\color{gray}-1.345 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$81.7 \mathrm{ms} \pm 456 \mathrm{μs}\left({\color{gray}1.70 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$48.1 \mathrm{ms} \pm 197 \mathrm{μs}\left({\color{gray}2.71 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$49.8 \mathrm{ms} \pm 275 \mathrm{μs}\left({\color{gray}1.26 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$60.2 \mathrm{ms} \pm 389 \mathrm{μs}\left({\color{gray}4.65 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$44.5 \mathrm{ms} \pm 257 \mathrm{μs}\left({\color{gray}0.766 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$428 \mathrm{ms} \pm 1.28 \mathrm{ms}\left({\color{gray}2.29 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$101 \mathrm{ms} \pm 393 \mathrm{μs}\left({\color{gray}0.937 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$88.5 \mathrm{ms} \pm 422 \mathrm{μs}\left({\color{gray}0.074 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$289 \mathrm{ms} \pm 712 \mathrm{μs}\left({\color{lightgreen}-10.180 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$16.4 \mathrm{ms} \pm 85.5 \mathrm{μs}\left({\color{gray}3.06 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$16.7 \mathrm{ms} \pm 109 \mathrm{μs}\left({\color{gray}1.94 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$16.7 \mathrm{ms} \pm 95.9 \mathrm{μs}\left({\color{gray}0.117 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$16.3 \mathrm{ms} \pm 87.6 \mathrm{μs}\left({\color{gray}-0.098 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$19.6 \mathrm{ms} \pm 116 \mathrm{μs}\left({\color{gray}0.059 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$16.1 \mathrm{ms} \pm 76.2 \mathrm{μs}\left({\color{gray}-0.976 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$16.2 \mathrm{ms} \pm 87.6 \mathrm{μs}\left({\color{gray}-0.571 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$16.4 \mathrm{ms} \pm 95.3 \mathrm{μs}\left({\color{gray}2.69 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$16.9 \mathrm{ms} \pm 118 \mathrm{μs}\left({\color{gray}1.66 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$24.5 \mathrm{ms} \pm 201 \mathrm{μs}\left({\color{gray}0.858 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1	$$32.3 \mathrm{ms} \pm 285 \mathrm{μs}\left({\color{gray}0.860 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1	$$32.1 \mathrm{ms} \pm 295 \mathrm{μs}\left({\color{gray}-2.296 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1	$$31.8 \mathrm{ms} \pm 297 \mathrm{μs}\left({\color{gray}-0.034 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1	$$31.6 \mathrm{ms} \pm 281 \mathrm{μs}\left({\color{gray}-1.257 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2	$$31.9 \mathrm{ms} \pm 292 \mathrm{μs}\left({\color{gray}-2.821 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1	$$32.9 \mathrm{ms} \pm 275 \mathrm{μs}\left({\color{gray}3.97 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1	$$33.5 \mathrm{ms} \pm 293 \mathrm{μs}\left({\color{gray}4.28 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1	$$32.1 \mathrm{ms} \pm 284 \mathrm{μs}\left({\color{gray}-2.021 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1	$$31.2 \mathrm{ms} \pm 290 \mathrm{μs}\left({\color{gray}-3.504 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba	$$9.15 \mathrm{ms} \pm 40.9 \mathrm{μs}\left({\color{gray}1.60 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$94.1 \mathrm{ms} \pm 441 \mathrm{μs}\left({\color{gray}0.960 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$148 \mathrm{ms} \pm 590 \mathrm{μs}\left({\color{gray}1.32 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$102 \mathrm{ms} \pm 543 \mathrm{μs}\left({\color{gray}1.16 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$110 \mathrm{ms} \pm 488 \mathrm{μs}\left({\color{gray}2.75 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$118 \mathrm{ms} \pm 480 \mathrm{μs}\left({\color{gray}1.95 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$124 \mathrm{ms} \pm 624 \mathrm{μs}\left({\color{gray}-0.863 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$90.5 \mathrm{ms} \pm 456 \mathrm{μs}\left({\color{gray}0.459 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$121 \mathrm{ms} \pm 674 \mathrm{μs}\left({\color{gray}-1.542 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$97.5 \mathrm{ms} \pm 425 \mathrm{μs}\left({\color{gray}-2.111 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$106 \mathrm{ms} \pm 445 \mathrm{μs}\left({\color{gray}-2.662 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$108 \mathrm{ms} \pm 520 \mathrm{μs}\left({\color{gray}-2.623 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$110 \mathrm{ms} \pm 687 \mathrm{μs}\left({\color{gray}-2.759 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$133 \mathrm{ms} \pm 501 \mathrm{μs}\left({\color{gray}-1.160 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$136 \mathrm{ms} \pm 598 \mathrm{μs}\left({\color{gray}-0.383 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$106 \mathrm{ms} \pm 511 \mathrm{μs}\left({\color{gray}-0.739 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$563 \mathrm{ms} \pm 2.40 \mathrm{ms}\left({\color{lightgreen}-5.730 \mathrm{\%}}\right) $$	Flame Graph