fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 - #2457

Merged
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix
Jun 16, 2026
Merged

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299#2457
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

Resolves VULN-11836CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, High): Host header SSRF in prerendered error page fetch in astro.

The advisory's only patched version is astro 6.4.6 (< 6.4.6 is vulnerable) — there is no 5.x backport, so the fix requires moving to the 6.x line.

Changes

  • workbench/astro (the flagged app, resolved to astro@5.16.3):
    • astro^5.15.6^6.4.6
    • @astrojs/node9.5.010.1.4 (astro 6 peer compat)
    • @astrojs/vercel^9.0.0^10.0.8 (astro 6 peer compat)
  • packages/astro (@workflow/astro): astro devDependency 5.18.06.4.6 (typecheck-only, not shipped) — clears the last vulnerable astro from the lockfile.

After the bump the lockfile contains only astro@6.4.6 — both astro@5.16.3 and astro@5.18.0 are gone.

Notes

  • Pinned 6.4.6 rather than the latest 6.4.7 because the repo's minimumReleaseAge (48h) guard blocks 6.4.7 (published <48h ago); 6.4.6 is the advisory's patched version.
  • astro 6 requires Node >=22.12.0; CI runs node 22.x/24.x, so this is satisfied.

Verification

  • @workflow/astro integration typechecks (tsc) against astro 6.4.6.
  • workbench/astro builds cleanly under both the @astrojs/node (local/CI) and @astrojs/vercel (deploy) adapter paths.

🤖 Generated with Claude Code

Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CopilotAI review requested due to automatic review settings June 16, 2026 19:19
@pranaygp
pranaygp requested a review from a team as a code ownerJune 16, 2026 19:19
@vercel

vercelBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: e6702f6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/astroPatch
workflowPatch
@workflow/world-testingPatch
@workflow/corePatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

All tests passed

Summary

PassedFailedSkippedTotal
✅ ▲ Vercel Production144202191661
✅ 💻 Local Development189502192114
✅ 📦 Local Production189502192114
✅ 🐘 Local Postgres188102332114
✅ 🪟 Windows15100151
✅ 📋 Other87901781057
Total8143010689211

Details by Category

✅ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro125026
✅ example125026
✅ express125026
✅ fastify125026
✅ hono125026
✅ nextjs-turbopack14902
✅ nextjs-webpack14902
✅ nitro125026
✅ nuxt125026
✅ sveltekit14407
✅ vite125026
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable125026
✅ express-stable125026
✅ fastify-stable125026
✅ hono-stable125026
✅ nextjs-turbopack-canary131020
✅ nextjs-turbopack-stable-lazy-discovery-disabled15001
✅ nextjs-turbopack-stable-lazy-discovery-enabled15001
✅ nextjs-webpack-canary131020
✅ nextjs-webpack-stable-lazy-discovery-disabled15001
✅ nextjs-webpack-stable-lazy-discovery-enabled15001
✅ nitro-stable125026
✅ nuxt-stable125026
✅ sveltekit-stable14407
✅ vite-stable125026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15100
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable126025
✅ e2e-local-dev-tanstack-start-126025
✅ e2e-local-postgres-nest-stable125026
✅ e2e-local-postgres-tanstack-start-125026
✅ e2e-local-prod-nest-stable126025
✅ e2e-local-prod-tanstack-start-126025
✅ e2e-vercel-prod-tanstack-start125026

📋 View full workflow run

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.045s (-6.4% 🟢)1.006s (~)0.960s101.00x
💻 LocalNitro0.047s (+12.2% 🔺)1.008s (~)0.961s101.04x
🐘 PostgresNitro0.062s (-4.5%)1.013s (~)0.951s101.37x
💻 LocalNext.js (Turbopack)0.063s (+2.8%)1.007s (~)0.944s101.38x
🐘 PostgresExpress0.063s (+3.1%)1.012s (~)0.949s101.39x
🐘 PostgresNext.js (Turbopack)0.068s (-6.3% 🟢)1.012s (~)0.944s101.51x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express0.321s (-71.0% 🟢)2.398s (-33.0% 🟢)2.077s101.00x
▲ VercelNext.js (Turbopack)0.325s (-83.6% 🟢)2.160s (-47.4% 🟢)1.836s101.01x
▲ VercelNitro0.355s (-40.9% 🟢)2.479s (-6.8% 🟢)2.125s101.10x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.094s (~)2.007s (~)0.913s101.00x
💻 LocalExpress1.107s (+0.7%)2.006s (~)0.899s101.01x
🐘 PostgresExpress1.108s (-0.6%)2.010s (~)0.902s101.01x
🐘 PostgresNitro1.114s (~)2.011s (~)0.897s101.02x
🐘 PostgresNext.js (Turbopack)1.139s (-1.6%)2.010s (~)0.871s101.04x
💻 LocalNext.js (Turbopack)1.143s (~)2.007s (~)0.864s101.04x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.843s (-34.7% 🟢)3.753s (-17.4% 🟢)1.911s101.00x
▲ VercelExpress1.853s (-30.9% 🟢)3.656s (-26.9% 🟢)1.804s101.01x
▲ VercelNext.js (Turbopack)1.862s (-30.6% 🟢)3.901s (-13.8% 🟢)2.039s101.01x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express10.539s (~)11.023s (~)0.484s31.00x
💻 LocalNitro10.551s (~)11.023s (~)0.472s31.00x
🐘 PostgresExpress10.560s (~)11.018s (~)0.458s31.00x
🐘 PostgresNitro10.573s (~)11.019s (~)0.446s31.00x
💻 LocalNext.js (Turbopack)10.809s (~)11.024s (~)0.214s31.03x
🐘 PostgresNext.js (Turbopack)10.889s (~)11.352s (+3.0%)0.462s31.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro14.280s (-21.4% 🟢)16.322s (-17.9% 🟢)2.043s21.00x
▲ VercelExpress14.736s (-9.4% 🟢)16.736s (-10.2% 🟢)1.999s21.03x
▲ VercelNext.js (Turbopack)14.834s (-30.7% 🟢)16.703s (-28.2% 🟢)1.869s21.04x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express13.791s (~)14.017s (~)0.226s51.00x
💻 LocalExpress13.820s (~)14.028s (~)0.208s51.00x
🐘 PostgresNitro13.823s (~)14.021s (~)0.198s51.00x
💻 LocalNitro13.849s (~)14.028s (~)0.179s51.00x
💻 LocalNext.js (Turbopack)14.360s (~)15.030s (~)0.670s41.04x
🐘 PostgresNext.js (Turbopack)14.490s (~)15.017s (~)0.527s41.05x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)23.277s (-24.4% 🟢)25.483s (-22.4% 🟢)2.206s31.00x
▲ VercelExpress23.554s (-32.5% 🟢)25.626s (-30.6% 🟢)2.072s31.01x
▲ VercelNitro23.646s (-28.3% 🟢)25.447s (-27.0% 🟢)1.801s31.02x

🔍 Observability: Next.js (Turbopack) | Express | Nitro

workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.466s (-1.7%)13.016s (~)0.549s71.00x
💻 LocalNitro12.523s (~)13.025s (~)0.502s71.00x
💻 LocalExpress12.597s (~)13.027s (~)0.431s71.01x
🐘 PostgresExpress12.831s (+1.9%)13.303s (+2.2%)0.472s71.03x
💻 LocalNext.js (Turbopack)13.682s (~)14.027s (~)0.345s71.10x
🐘 PostgresNext.js (Turbopack)13.752s (-1.6%)14.019s (-1.0%)0.268s71.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express33.719s (-3.0%)36.136s (-2.6%)2.417s31.00x
▲ VercelNext.js (Turbopack)34.038s (-3.1%)36.769s (-2.0%)2.731s31.01x
▲ VercelNitro37.427s (-1.3%)40.332s (+2.1%)2.905s31.11x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.212s (+0.5%)2.008s (~)0.796s151.00x
💻 LocalExpress1.212s (+1.7%)2.007s (~)0.795s151.00x
🐘 PostgresNitro1.213s (~)2.008s (~)0.794s151.00x
💻 LocalNitro1.248s (+7.3% 🔺)2.006s (~)0.758s151.03x
🐘 PostgresNext.js (Turbopack)1.303s (-4.0%)2.007s (-3.3%)0.704s151.08x
💻 LocalNext.js (Turbopack)1.366s (+2.8%)2.006s (~)0.640s151.13x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.318s (-25.0% 🟢)3.899s (-15.0% 🟢)1.581s81.00x
▲ VercelNext.js (Turbopack)2.378s (+1.3%)3.969s (-1.2%)1.591s81.03x
▲ VercelExpress2.454s (-3.8%)3.990s (-2.0%)1.536s81.06x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.334s (-0.6%)2.592s (+3.3%)1.258s121.00x
🐘 PostgresExpress1.407s (+3.6%)2.393s (-4.6%)0.986s131.05x
🐘 PostgresNext.js (Turbopack)1.592s (-2.8%)2.294s (-8.6% 🟢)0.702s141.19x
💻 LocalNext.js (Turbopack)1.600s (~)2.006s (~)0.406s151.20x
💻 LocalNitro1.711s (+5.0% 🔺)2.006s (~)0.295s151.28x
💻 LocalExpress2.065s (+9.0% 🔺)2.471s (+14.8% 🔺)0.406s131.55x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.392s (-17.6% 🟢)5.282s (-12.8% 🟢)1.890s71.00x
▲ VercelNitro3.657s (-3.0%)5.390s (~)1.732s61.08x
▲ VercelNext.js (Turbopack)3.834s (+9.4% 🔺)5.777s (+10.0% 🔺)1.943s61.13x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.653s (+1.9%)4.014s (+3.3%)2.361s81.00x
🐘 PostgresNitro1.727s (+6.3% 🔺)4.012s (-3.1%)2.285s81.04x
🐘 PostgresNext.js (Turbopack)2.772s (-27.6% 🟢)3.760s (-15.4% 🟢)0.988s81.68x
💻 LocalNext.js (Turbopack)4.577s (~)5.178s (~)0.602s62.77x
💻 LocalNitro4.749s (+18.1% 🔺)5.179s (+13.0% 🔺)0.430s62.87x
💻 LocalExpress5.519s (+5.4% 🔺)5.845s (~)0.326s63.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express5.467s (+19.5% 🔺)7.579s (+15.5% 🔺)2.112s41.00x
▲ VercelNext.js (Turbopack)6.098s (+61.0% 🔺)7.907s (+46.2% 🔺)1.808s41.12x
▲ VercelNitro6.220s (+46.5% 🔺)8.628s (+50.6% 🔺)2.408s41.14x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.195s (-2.2%)2.007s (~)0.812s151.00x
🐘 PostgresExpress1.208s (~)2.007s (~)0.799s151.01x
🐘 PostgresNext.js (Turbopack)1.304s (+1.4%)2.008s (~)0.704s151.09x
💻 LocalNext.js (Turbopack)1.384s (~)2.006s (~)0.622s151.16x
💻 LocalNitro1.547s (+2.4%)2.006s (~)0.460s151.29x
💻 LocalExpress1.578s (-2.2%)2.007s (~)0.429s151.32x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.405s (+4.3%)3.820s (-3.2%)1.415s81.00x
▲ VercelNitro2.423s (-62.6% 🟢)3.700s (-53.9% 🟢)1.278s91.01x
▲ VercelExpress2.461s (+8.2% 🔺)4.085s (+6.0% 🔺)1.624s81.02x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.350s (-3.3%)2.509s (+1.6%)1.160s121.00x
🐘 PostgresNitro1.364s (+0.5%)2.317s (-10.6% 🟢)0.953s131.01x
🐘 PostgresNext.js (Turbopack)1.545s (+0.5%)2.221s (~)0.676s141.14x
💻 LocalNitro1.887s (+5.4% 🔺)2.315s (+11.7% 🔺)0.428s131.40x
💻 LocalNext.js (Turbopack)2.020s (+4.6%)2.591s (+16.6% 🔺)0.571s121.50x
💻 LocalExpress2.186s (-15.1% 🟢)2.591s (-16.6% 🟢)0.405s121.62x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.686s (-28.3% 🟢)3.995s (-26.8% 🟢)1.308s81.00x
▲ VercelNext.js (Turbopack)3.121s (-22.2% 🟢)5.152s (-10.3% 🟢)2.031s61.16x
▲ VercelExpress3.368s (+1.1%)4.862s (-9.0% 🟢)1.494s71.25x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.642s (-5.0%)4.299s (+10.6% 🔺)2.656s71.00x
🐘 PostgresExpress1.693s (-3.4%)4.012s (-3.0%)2.319s81.03x
🐘 PostgresNext.js (Turbopack)2.857s (-25.6% 🟢)4.013s (-9.7% 🟢)1.156s81.74x
💻 LocalNext.js (Turbopack)5.016s (-5.2% 🟢)5.515s (-8.3% 🟢)0.499s63.05x
💻 LocalExpress5.795s (-8.6% 🟢)6.216s (-11.4% 🟢)0.420s53.53x
💻 LocalNitro6.023s (+26.5% 🔺)6.819s (+27.5% 🔺)0.796s53.67x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro4.371s (-33.7% 🟢)6.186s (-25.9% 🟢)1.815s51.00x
▲ VercelNext.js (Turbopack)5.040s (+2.3%)7.308s (+12.5% 🔺)2.268s51.15x
▲ VercelExpress5.213s (~)7.552s (+8.4% 🔺)2.338s41.19x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.583s (-9.5% 🟢)1.023s (-1.8%)0.440s591.00x
🐘 PostgresExpress0.587s (-0.8%)1.023s (+1.7%)0.436s591.01x
💻 LocalNitro0.601s (+3.1%)1.005s (~)0.404s601.03x
💻 LocalExpress0.663s (+0.6%)1.022s (-1.7%)0.359s591.14x
🐘 PostgresNext.js (Turbopack)0.817s (-3.8%)1.006s (-1.7%)0.189s601.40x
💻 LocalNext.js (Turbopack)0.878s (-0.8%)1.039s (-1.7%)0.161s581.50x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.186s (-26.9% 🟢)7.879s (-22.0% 🟢)1.693s81.00x
▲ VercelExpress6.507s (-1.1%)8.264s (-4.2%)1.757s81.05x
▲ VercelNext.js (Turbopack)6.927s (-6.6% 🟢)8.857s (-5.2% 🟢)1.930s71.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.372s (-5.1% 🟢)2.052s (+2.2%)0.680s441.00x
🐘 PostgresExpress1.430s (~)2.053s (+1.1%)0.622s441.04x
💻 LocalNitro1.508s (+2.1%)2.006s (~)0.498s451.10x
💻 LocalExpress1.588s (~)2.007s (~)0.419s451.16x
🐘 PostgresNext.js (Turbopack)1.941s (-4.7%)2.151s (-16.1% 🟢)0.210s421.41x
💻 LocalNext.js (Turbopack)2.145s (+0.8%)3.009s (~)0.864s301.56x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro15.095s (-19.6% 🟢)17.268s (-16.8% 🟢)2.174s61.00x
▲ VercelNext.js (Turbopack)15.916s (-20.1% 🟢)18.292s (-18.3% 🟢)2.376s51.05x
▲ VercelExpress16.686s (-17.1% 🟢)18.647s (-14.7% 🟢)1.961s51.11x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express2.727s (-1.9%)3.086s (-1.6%)0.359s391.00x
🐘 PostgresNitro2.976s (+5.5% 🔺)3.397s (+8.3% 🔺)0.422s361.09x
💻 LocalNitro3.313s (+4.6%)4.043s (+3.3%)0.730s301.21x
💻 LocalExpress3.405s (+1.9%)4.011s (~)0.606s301.25x
🐘 PostgresNext.js (Turbopack)3.831s (-4.8%)4.110s (-6.7% 🟢)0.279s301.40x
💻 LocalNext.js (Turbopack)4.575s (+0.8%)5.053s (~)0.478s241.68x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro30.084s (-17.0% 🟢)32.889s (-13.9% 🟢)2.806s41.00x
▲ VercelExpress30.093s (-22.2% 🟢)32.724s (-19.0% 🟢)2.631s41.00x
▲ VercelNext.js (Turbopack)33.218s (-26.0% 🟢)36.130s (-22.6% 🟢)2.912s41.10x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.244s (-6.4% 🟢)1.006s (~)0.762s601.00x
🐘 PostgresExpress0.250s (-4.2%)1.006s (~)0.756s601.02x
🐘 PostgresNext.js (Turbopack)0.311s (+0.8%)1.006s (~)0.696s601.27x
💻 LocalNitro0.454s (+5.2% 🔺)1.005s (~)0.551s601.86x
💻 LocalExpress0.462s (+8.0% 🔺)1.005s (~)0.543s601.89x
💻 LocalNext.js (Turbopack)0.564s (-12.7% 🟢)1.005s (-5.1% 🟢)0.441s602.31x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.833s (-36.5% 🟢)3.794s (-24.6% 🟢)1.962s161.00x
▲ VercelNext.js (Turbopack)2.203s (-28.3% 🟢)4.190s (-16.4% 🟢)1.986s151.20x
▲ VercelExpress2.247s (-37.1% 🟢)4.134s (-26.0% 🟢)1.887s151.23x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.400s (-12.6% 🟢)1.006s (-6.7% 🟢)0.606s901.00x
🐘 PostgresExpress0.423s (+2.8%)1.041s (+3.4%)0.618s871.06x
🐘 PostgresNext.js (Turbopack)0.618s (-8.8% 🟢)1.240s (-2.8%)0.622s731.55x
💻 LocalNitro2.184s (+8.6% 🔺)2.767s (+13.4% 🔺)0.584s335.46x
💻 LocalExpress2.245s (+2.5%)2.913s (+2.1%)0.668s315.62x
💻 LocalNext.js (Turbopack)2.497s (-2.4%)3.224s (-1.1%)0.728s286.25x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.219s (-37.6% 🟢)4.988s (-30.9% 🟢)1.769s191.00x
▲ VercelNitro3.388s (-2.8%)5.242s (+1.4%)1.854s181.05x
▲ VercelNext.js (Turbopack)3.690s (-3.0%)5.812s (+1.3%)2.122s161.15x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.798s (-5.3% 🟢)1.326s (-9.9% 🟢)0.528s911.00x
🐘 PostgresExpress0.824s (-2.8%)1.352s (-10.3% 🟢)0.528s901.03x
🐘 PostgresNext.js (Turbopack)2.866s (-7.2% 🟢)3.681s (-3.8%)0.816s333.59x
💻 LocalNitro9.345s (+7.1% 🔺)10.032s (+8.4% 🔺)0.687s1211.71x
💻 LocalExpress9.995s (+1.3%)10.696s (+4.0%)0.701s1212.52x
💻 LocalNext.js (Turbopack)11.013s (+5.0%)11.850s (+4.0%)0.837s1113.80x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.218s (-7.9% 🟢)8.141s (-5.7% 🟢)1.922s151.00x
▲ VercelExpress6.430s (-5.9% 🟢)8.691s (+0.8%)2.261s141.03x
▲ VercelNext.js (Turbopack)7.483s (+4.0%)10.018s (+11.7% 🔺)2.535s121.20x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.160s (~)2.005s (~)0.010s (+2.0%)2.018s (~)0.858s101.00x
💻 LocalExpress1.170s (~)2.005s (~)0.012s (+1.6%)2.020s (~)0.850s101.01x
🐘 PostgresExpress1.174s (~)1.998s (~)0.001s (+27.3% 🔺)2.010s (~)0.837s101.01x
🐘 PostgresNitro1.178s (-1.7%)1.997s (~)0.001s (~)2.010s (~)0.832s101.02x
🐘 PostgresNext.js (Turbopack)1.226s (-1.4%)2.002s (~)0.001s (-16.7% 🟢)2.011s (~)0.784s101.06x
💻 LocalNext.js (Turbopack)1.228s (-1.7%)2.003s (~)0.011s (-1.9%)2.018s (~)0.790s101.06x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.527s (-5.8% 🟢)3.723s (-0.6%)1.524s (+82.0% 🔺)5.771s (+13.5% 🔺)3.244s101.00x
▲ VercelNitro2.557s (~)3.645s (-1.8%)1.154s (+55.9% 🔺)5.296s (+6.7% 🔺)2.738s101.01x
▲ VercelExpress2.620s (+10.9% 🔺)3.621s (+2.6%)1.247s (+77.3% 🔺)5.373s (+12.2% 🔺)2.754s101.04x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.578s (+0.7%)2.010s (~)0.013s (+14.6% 🔺)2.025s (~)0.448s301.00x
🐘 PostgresExpress1.603s (~)2.005s (~)0.005s (+2.7%)2.027s (~)0.424s301.02x
🐘 PostgresNitro1.608s (-1.9%)2.007s (~)0.005s (+0.6%)2.028s (~)0.420s301.02x
💻 LocalExpress1.611s (~)2.011s (~)0.013s (+6.2% 🔺)2.026s (~)0.416s301.02x
💻 LocalNext.js (Turbopack)1.735s (-0.7%)2.008s (~)0.011s (-17.3% 🟢)2.023s (~)0.288s301.10x
🐘 PostgresNext.js (Turbopack)1.761s (-1.7%)2.011s (~)0.005s (-3.6%)2.026s (~)0.265s301.12x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express6.370s (-7.7% 🟢)7.860s (-5.9% 🟢)0.277s (-19.6% 🟢)8.601s (-6.8% 🟢)2.231s71.00x
▲ VercelNext.js (Turbopack)6.386s (-7.0% 🟢)8.159s (-4.9%)0.282s (-9.9% 🟢)8.937s (-4.7%)2.551s71.00x
▲ VercelNitro6.476s (-3.8%)7.838s (-2.6%)0.234s (+6.5% 🔺)8.506s (-3.4%)2.030s81.02x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.782s (-3.8%)1.047s (-1.6%)0.000s (+194.7% 🔺)1.064s (-1.5%)0.282s571.00x
🐘 PostgresExpress0.802s (+0.6%)1.050s (~)0.000s (NaN%)1.082s (+2.0%)0.280s561.03x
🐘 PostgresNext.js (Turbopack)0.975s (-5.1% 🟢)1.418s (-12.5% 🟢)0.000s (-100.0% 🟢)1.426s (-12.5% 🟢)0.451s431.25x
💻 LocalExpress1.466s (+3.3%)2.013s (~)0.000s (-28.6% 🟢)2.015s (~)0.549s301.88x
💻 LocalNitro1.535s (+13.6% 🔺)2.015s (~)0.000s (~)2.017s (~)0.482s301.96x
💻 LocalNext.js (Turbopack)1.539s (+1.7%)2.013s (~)0.000s (-9.1% 🟢)2.017s (~)0.478s301.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)3.032s (-19.5% 🟢)4.491s (-15.8% 🟢)0.000s (-100.0% 🟢)4.989s (-15.2% 🟢)1.957s131.00x
▲ VercelNitro3.082s (-25.0% 🟢)4.281s (-25.5% 🟢)0.000s (+Infinity% 🔺)4.733s (-24.2% 🟢)1.651s131.02x
▲ VercelExpress3.181s (-13.9% 🟢)4.530s (-7.6% 🟢)0.000s (+Infinity% 🔺)5.012s (-9.8% 🟢)1.831s121.05x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.593s (-3.6%)2.137s (-1.8%)0.000s (+Infinity% 🔺)2.152s (-1.6%)0.559s281.00x
🐘 PostgresNitro1.736s (+2.5%)2.253s (+3.6%)0.000s (-48.1% 🟢)2.272s (+3.6%)0.536s271.09x
🐘 PostgresNext.js (Turbopack)2.135s (-5.3% 🟢)2.653s (-2.8%)0.000s (NaN%)2.662s (-2.8%)0.526s231.34x
💻 LocalNext.js (Turbopack)3.046s (+7.4% 🔺)3.468s (+1.5%)0.000s (-11.1% 🟢)3.476s (+1.7%)0.430s181.91x
💻 LocalNitro3.322s (+7.8% 🔺)3.893s (~)0.001s (+28.6% 🔺)3.906s (~)0.583s162.09x
💻 LocalExpress3.347s (+0.9%)4.028s (~)0.000s (-53.3% 🟢)4.030s (~)0.683s152.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro5.059s (+2.8%)6.517s (+5.7% 🔺)0.000s (NaN%)7.047s (+3.6%)1.988s91.00x
▲ VercelExpress5.187s (-14.5% 🟢)6.629s (-12.7% 🟢)0.006s (+655.6% 🔺)7.277s (-11.1% 🟢)2.090s91.03x
▲ VercelNext.js (Turbopack)5.652s (-20.0% 🟢)7.189s (-12.6% 🟢)0.000s (-100.0% 🟢)7.744s (-11.6% 🟢)2.091s81.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNitro11/21
🐘 PostgresNitro11/21
▲ VercelNitro11/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres16/21
Nitro🐘 Postgres16/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​@​astrojs/​node@​10.1.41001008297100
Addednpm/​@​astrojs/​vercel@​10.0.81001008397100
Addednpm/​astro@​6.4.6881008898100

View full report

@pranaygp
pranaygp merged commit b92dfbb into mainJun 16, 2026
121 checks passed
@pranaygp
pranaygp deleted the pgp/issue-fix branch June 16, 2026 21:18
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
github-actionsBot added a commit that referenced this pull request Jun 16, 2026
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2461. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 16, 2026
…2461)
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
pranaygp added a commit that referenced this pull request Jun 16, 2026
* origin/main:
fix(core): make deploymentId 'latest' a no-op in non-Vercel worlds (#2397)
fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457)
Small detail panel cleanup (#2459)
Fix lazy Next workflow HMR (#2438)
Prevent peer dependency-only major bumps (#2437)
fix(changesets): only major-bump peer dependents when out of range (#2439)
Version Packages (beta) (#2428)
otel: explicit traceparent injection + linked-trace mode for bounded per-invocation traces (#2363)
[next] Clarify `serverExternalPackages` warning (#2417)
Add .swc gitignore handling to builder (#2427)
Version Packages (beta) (#2390)
[ci] Increase dev.test.ts cleanup hook timeout (#2416)
[world-vercel] Switch event endpoints to v4 wire format (#2055)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@karthikscale3
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 - #2457

Merged
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix
Jun 16, 2026
Merged

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299#2457
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

Resolves VULN-11836CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, High): Host header SSRF in prerendered error page fetch in astro.

The advisory's only patched version is astro 6.4.6 (< 6.4.6 is vulnerable) — there is no 5.x backport, so the fix requires moving to the 6.x line.

Changes

  • workbench/astro (the flagged app, resolved to astro@5.16.3):
    • astro^5.15.6^6.4.6
    • @astrojs/node9.5.010.1.4 (astro 6 peer compat)
    • @astrojs/vercel^9.0.0^10.0.8 (astro 6 peer compat)
  • packages/astro (@workflow/astro): astro devDependency 5.18.06.4.6 (typecheck-only, not shipped) — clears the last vulnerable astro from the lockfile.

After the bump the lockfile contains only astro@6.4.6 — both astro@5.16.3 and astro@5.18.0 are gone.

Notes

  • Pinned 6.4.6 rather than the latest 6.4.7 because the repo's minimumReleaseAge (48h) guard blocks 6.4.7 (published <48h ago); 6.4.6 is the advisory's patched version.
  • astro 6 requires Node >=22.12.0; CI runs node 22.x/24.x, so this is satisfied.

Verification

  • @workflow/astro integration typechecks (tsc) against astro 6.4.6.
  • workbench/astro builds cleanly under both the @astrojs/node (local/CI) and @astrojs/vercel (deploy) adapter paths.

🤖 Generated with Claude Code

Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CopilotAI review requested due to automatic review settings June 16, 2026 19:19
@pranaygp
pranaygp requested a review from a team as a code ownerJune 16, 2026 19:19
@vercel

vercelBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: e6702f6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/astroPatch
workflowPatch
@workflow/world-testingPatch
@workflow/corePatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

All tests passed

Summary

PassedFailedSkippedTotal
✅ ▲ Vercel Production144202191661
✅ 💻 Local Development189502192114
✅ 📦 Local Production189502192114
✅ 🐘 Local Postgres188102332114
✅ 🪟 Windows15100151
✅ 📋 Other87901781057
Total8143010689211

Details by Category

✅ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro125026
✅ example125026
✅ express125026
✅ fastify125026
✅ hono125026
✅ nextjs-turbopack14902
✅ nextjs-webpack14902
✅ nitro125026
✅ nuxt125026
✅ sveltekit14407
✅ vite125026
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable125026
✅ express-stable125026
✅ fastify-stable125026
✅ hono-stable125026
✅ nextjs-turbopack-canary131020
✅ nextjs-turbopack-stable-lazy-discovery-disabled15001
✅ nextjs-turbopack-stable-lazy-discovery-enabled15001
✅ nextjs-webpack-canary131020
✅ nextjs-webpack-stable-lazy-discovery-disabled15001
✅ nextjs-webpack-stable-lazy-discovery-enabled15001
✅ nitro-stable125026
✅ nuxt-stable125026
✅ sveltekit-stable14407
✅ vite-stable125026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15100
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable126025
✅ e2e-local-dev-tanstack-start-126025
✅ e2e-local-postgres-nest-stable125026
✅ e2e-local-postgres-tanstack-start-125026
✅ e2e-local-prod-nest-stable126025
✅ e2e-local-prod-tanstack-start-126025
✅ e2e-vercel-prod-tanstack-start125026

📋 View full workflow run

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.045s (-6.4% 🟢)1.006s (~)0.960s101.00x
💻 LocalNitro0.047s (+12.2% 🔺)1.008s (~)0.961s101.04x
🐘 PostgresNitro0.062s (-4.5%)1.013s (~)0.951s101.37x
💻 LocalNext.js (Turbopack)0.063s (+2.8%)1.007s (~)0.944s101.38x
🐘 PostgresExpress0.063s (+3.1%)1.012s (~)0.949s101.39x
🐘 PostgresNext.js (Turbopack)0.068s (-6.3% 🟢)1.012s (~)0.944s101.51x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express0.321s (-71.0% 🟢)2.398s (-33.0% 🟢)2.077s101.00x
▲ VercelNext.js (Turbopack)0.325s (-83.6% 🟢)2.160s (-47.4% 🟢)1.836s101.01x
▲ VercelNitro0.355s (-40.9% 🟢)2.479s (-6.8% 🟢)2.125s101.10x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.094s (~)2.007s (~)0.913s101.00x
💻 LocalExpress1.107s (+0.7%)2.006s (~)0.899s101.01x
🐘 PostgresExpress1.108s (-0.6%)2.010s (~)0.902s101.01x
🐘 PostgresNitro1.114s (~)2.011s (~)0.897s101.02x
🐘 PostgresNext.js (Turbopack)1.139s (-1.6%)2.010s (~)0.871s101.04x
💻 LocalNext.js (Turbopack)1.143s (~)2.007s (~)0.864s101.04x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.843s (-34.7% 🟢)3.753s (-17.4% 🟢)1.911s101.00x
▲ VercelExpress1.853s (-30.9% 🟢)3.656s (-26.9% 🟢)1.804s101.01x
▲ VercelNext.js (Turbopack)1.862s (-30.6% 🟢)3.901s (-13.8% 🟢)2.039s101.01x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express10.539s (~)11.023s (~)0.484s31.00x
💻 LocalNitro10.551s (~)11.023s (~)0.472s31.00x
🐘 PostgresExpress10.560s (~)11.018s (~)0.458s31.00x
🐘 PostgresNitro10.573s (~)11.019s (~)0.446s31.00x
💻 LocalNext.js (Turbopack)10.809s (~)11.024s (~)0.214s31.03x
🐘 PostgresNext.js (Turbopack)10.889s (~)11.352s (+3.0%)0.462s31.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro14.280s (-21.4% 🟢)16.322s (-17.9% 🟢)2.043s21.00x
▲ VercelExpress14.736s (-9.4% 🟢)16.736s (-10.2% 🟢)1.999s21.03x
▲ VercelNext.js (Turbopack)14.834s (-30.7% 🟢)16.703s (-28.2% 🟢)1.869s21.04x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express13.791s (~)14.017s (~)0.226s51.00x
💻 LocalExpress13.820s (~)14.028s (~)0.208s51.00x
🐘 PostgresNitro13.823s (~)14.021s (~)0.198s51.00x
💻 LocalNitro13.849s (~)14.028s (~)0.179s51.00x
💻 LocalNext.js (Turbopack)14.360s (~)15.030s (~)0.670s41.04x
🐘 PostgresNext.js (Turbopack)14.490s (~)15.017s (~)0.527s41.05x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)23.277s (-24.4% 🟢)25.483s (-22.4% 🟢)2.206s31.00x
▲ VercelExpress23.554s (-32.5% 🟢)25.626s (-30.6% 🟢)2.072s31.01x
▲ VercelNitro23.646s (-28.3% 🟢)25.447s (-27.0% 🟢)1.801s31.02x

🔍 Observability: Next.js (Turbopack) | Express | Nitro

workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.466s (-1.7%)13.016s (~)0.549s71.00x
💻 LocalNitro12.523s (~)13.025s (~)0.502s71.00x
💻 LocalExpress12.597s (~)13.027s (~)0.431s71.01x
🐘 PostgresExpress12.831s (+1.9%)13.303s (+2.2%)0.472s71.03x
💻 LocalNext.js (Turbopack)13.682s (~)14.027s (~)0.345s71.10x
🐘 PostgresNext.js (Turbopack)13.752s (-1.6%)14.019s (-1.0%)0.268s71.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express33.719s (-3.0%)36.136s (-2.6%)2.417s31.00x
▲ VercelNext.js (Turbopack)34.038s (-3.1%)36.769s (-2.0%)2.731s31.01x
▲ VercelNitro37.427s (-1.3%)40.332s (+2.1%)2.905s31.11x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.212s (+0.5%)2.008s (~)0.796s151.00x
💻 LocalExpress1.212s (+1.7%)2.007s (~)0.795s151.00x
🐘 PostgresNitro1.213s (~)2.008s (~)0.794s151.00x
💻 LocalNitro1.248s (+7.3% 🔺)2.006s (~)0.758s151.03x
🐘 PostgresNext.js (Turbopack)1.303s (-4.0%)2.007s (-3.3%)0.704s151.08x
💻 LocalNext.js (Turbopack)1.366s (+2.8%)2.006s (~)0.640s151.13x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.318s (-25.0% 🟢)3.899s (-15.0% 🟢)1.581s81.00x
▲ VercelNext.js (Turbopack)2.378s (+1.3%)3.969s (-1.2%)1.591s81.03x
▲ VercelExpress2.454s (-3.8%)3.990s (-2.0%)1.536s81.06x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.334s (-0.6%)2.592s (+3.3%)1.258s121.00x
🐘 PostgresExpress1.407s (+3.6%)2.393s (-4.6%)0.986s131.05x
🐘 PostgresNext.js (Turbopack)1.592s (-2.8%)2.294s (-8.6% 🟢)0.702s141.19x
💻 LocalNext.js (Turbopack)1.600s (~)2.006s (~)0.406s151.20x
💻 LocalNitro1.711s (+5.0% 🔺)2.006s (~)0.295s151.28x
💻 LocalExpress2.065s (+9.0% 🔺)2.471s (+14.8% 🔺)0.406s131.55x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.392s (-17.6% 🟢)5.282s (-12.8% 🟢)1.890s71.00x
▲ VercelNitro3.657s (-3.0%)5.390s (~)1.732s61.08x
▲ VercelNext.js (Turbopack)3.834s (+9.4% 🔺)5.777s (+10.0% 🔺)1.943s61.13x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.653s (+1.9%)4.014s (+3.3%)2.361s81.00x
🐘 PostgresNitro1.727s (+6.3% 🔺)4.012s (-3.1%)2.285s81.04x
🐘 PostgresNext.js (Turbopack)2.772s (-27.6% 🟢)3.760s (-15.4% 🟢)0.988s81.68x
💻 LocalNext.js (Turbopack)4.577s (~)5.178s (~)0.602s62.77x
💻 LocalNitro4.749s (+18.1% 🔺)5.179s (+13.0% 🔺)0.430s62.87x
💻 LocalExpress5.519s (+5.4% 🔺)5.845s (~)0.326s63.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express5.467s (+19.5% 🔺)7.579s (+15.5% 🔺)2.112s41.00x
▲ VercelNext.js (Turbopack)6.098s (+61.0% 🔺)7.907s (+46.2% 🔺)1.808s41.12x
▲ VercelNitro6.220s (+46.5% 🔺)8.628s (+50.6% 🔺)2.408s41.14x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.195s (-2.2%)2.007s (~)0.812s151.00x
🐘 PostgresExpress1.208s (~)2.007s (~)0.799s151.01x
🐘 PostgresNext.js (Turbopack)1.304s (+1.4%)2.008s (~)0.704s151.09x
💻 LocalNext.js (Turbopack)1.384s (~)2.006s (~)0.622s151.16x
💻 LocalNitro1.547s (+2.4%)2.006s (~)0.460s151.29x
💻 LocalExpress1.578s (-2.2%)2.007s (~)0.429s151.32x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.405s (+4.3%)3.820s (-3.2%)1.415s81.00x
▲ VercelNitro2.423s (-62.6% 🟢)3.700s (-53.9% 🟢)1.278s91.01x
▲ VercelExpress2.461s (+8.2% 🔺)4.085s (+6.0% 🔺)1.624s81.02x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.350s (-3.3%)2.509s (+1.6%)1.160s121.00x
🐘 PostgresNitro1.364s (+0.5%)2.317s (-10.6% 🟢)0.953s131.01x
🐘 PostgresNext.js (Turbopack)1.545s (+0.5%)2.221s (~)0.676s141.14x
💻 LocalNitro1.887s (+5.4% 🔺)2.315s (+11.7% 🔺)0.428s131.40x
💻 LocalNext.js (Turbopack)2.020s (+4.6%)2.591s (+16.6% 🔺)0.571s121.50x
💻 LocalExpress2.186s (-15.1% 🟢)2.591s (-16.6% 🟢)0.405s121.62x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.686s (-28.3% 🟢)3.995s (-26.8% 🟢)1.308s81.00x
▲ VercelNext.js (Turbopack)3.121s (-22.2% 🟢)5.152s (-10.3% 🟢)2.031s61.16x
▲ VercelExpress3.368s (+1.1%)4.862s (-9.0% 🟢)1.494s71.25x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.642s (-5.0%)4.299s (+10.6% 🔺)2.656s71.00x
🐘 PostgresExpress1.693s (-3.4%)4.012s (-3.0%)2.319s81.03x
🐘 PostgresNext.js (Turbopack)2.857s (-25.6% 🟢)4.013s (-9.7% 🟢)1.156s81.74x
💻 LocalNext.js (Turbopack)5.016s (-5.2% 🟢)5.515s (-8.3% 🟢)0.499s63.05x
💻 LocalExpress5.795s (-8.6% 🟢)6.216s (-11.4% 🟢)0.420s53.53x
💻 LocalNitro6.023s (+26.5% 🔺)6.819s (+27.5% 🔺)0.796s53.67x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro4.371s (-33.7% 🟢)6.186s (-25.9% 🟢)1.815s51.00x
▲ VercelNext.js (Turbopack)5.040s (+2.3%)7.308s (+12.5% 🔺)2.268s51.15x
▲ VercelExpress5.213s (~)7.552s (+8.4% 🔺)2.338s41.19x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.583s (-9.5% 🟢)1.023s (-1.8%)0.440s591.00x
🐘 PostgresExpress0.587s (-0.8%)1.023s (+1.7%)0.436s591.01x
💻 LocalNitro0.601s (+3.1%)1.005s (~)0.404s601.03x
💻 LocalExpress0.663s (+0.6%)1.022s (-1.7%)0.359s591.14x
🐘 PostgresNext.js (Turbopack)0.817s (-3.8%)1.006s (-1.7%)0.189s601.40x
💻 LocalNext.js (Turbopack)0.878s (-0.8%)1.039s (-1.7%)0.161s581.50x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.186s (-26.9% 🟢)7.879s (-22.0% 🟢)1.693s81.00x
▲ VercelExpress6.507s (-1.1%)8.264s (-4.2%)1.757s81.05x
▲ VercelNext.js (Turbopack)6.927s (-6.6% 🟢)8.857s (-5.2% 🟢)1.930s71.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.372s (-5.1% 🟢)2.052s (+2.2%)0.680s441.00x
🐘 PostgresExpress1.430s (~)2.053s (+1.1%)0.622s441.04x
💻 LocalNitro1.508s (+2.1%)2.006s (~)0.498s451.10x
💻 LocalExpress1.588s (~)2.007s (~)0.419s451.16x
🐘 PostgresNext.js (Turbopack)1.941s (-4.7%)2.151s (-16.1% 🟢)0.210s421.41x
💻 LocalNext.js (Turbopack)2.145s (+0.8%)3.009s (~)0.864s301.56x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro15.095s (-19.6% 🟢)17.268s (-16.8% 🟢)2.174s61.00x
▲ VercelNext.js (Turbopack)15.916s (-20.1% 🟢)18.292s (-18.3% 🟢)2.376s51.05x
▲ VercelExpress16.686s (-17.1% 🟢)18.647s (-14.7% 🟢)1.961s51.11x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express2.727s (-1.9%)3.086s (-1.6%)0.359s391.00x
🐘 PostgresNitro2.976s (+5.5% 🔺)3.397s (+8.3% 🔺)0.422s361.09x
💻 LocalNitro3.313s (+4.6%)4.043s (+3.3%)0.730s301.21x
💻 LocalExpress3.405s (+1.9%)4.011s (~)0.606s301.25x
🐘 PostgresNext.js (Turbopack)3.831s (-4.8%)4.110s (-6.7% 🟢)0.279s301.40x
💻 LocalNext.js (Turbopack)4.575s (+0.8%)5.053s (~)0.478s241.68x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro30.084s (-17.0% 🟢)32.889s (-13.9% 🟢)2.806s41.00x
▲ VercelExpress30.093s (-22.2% 🟢)32.724s (-19.0% 🟢)2.631s41.00x
▲ VercelNext.js (Turbopack)33.218s (-26.0% 🟢)36.130s (-22.6% 🟢)2.912s41.10x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.244s (-6.4% 🟢)1.006s (~)0.762s601.00x
🐘 PostgresExpress0.250s (-4.2%)1.006s (~)0.756s601.02x
🐘 PostgresNext.js (Turbopack)0.311s (+0.8%)1.006s (~)0.696s601.27x
💻 LocalNitro0.454s (+5.2% 🔺)1.005s (~)0.551s601.86x
💻 LocalExpress0.462s (+8.0% 🔺)1.005s (~)0.543s601.89x
💻 LocalNext.js (Turbopack)0.564s (-12.7% 🟢)1.005s (-5.1% 🟢)0.441s602.31x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.833s (-36.5% 🟢)3.794s (-24.6% 🟢)1.962s161.00x
▲ VercelNext.js (Turbopack)2.203s (-28.3% 🟢)4.190s (-16.4% 🟢)1.986s151.20x
▲ VercelExpress2.247s (-37.1% 🟢)4.134s (-26.0% 🟢)1.887s151.23x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.400s (-12.6% 🟢)1.006s (-6.7% 🟢)0.606s901.00x
🐘 PostgresExpress0.423s (+2.8%)1.041s (+3.4%)0.618s871.06x
🐘 PostgresNext.js (Turbopack)0.618s (-8.8% 🟢)1.240s (-2.8%)0.622s731.55x
💻 LocalNitro2.184s (+8.6% 🔺)2.767s (+13.4% 🔺)0.584s335.46x
💻 LocalExpress2.245s (+2.5%)2.913s (+2.1%)0.668s315.62x
💻 LocalNext.js (Turbopack)2.497s (-2.4%)3.224s (-1.1%)0.728s286.25x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.219s (-37.6% 🟢)4.988s (-30.9% 🟢)1.769s191.00x
▲ VercelNitro3.388s (-2.8%)5.242s (+1.4%)1.854s181.05x
▲ VercelNext.js (Turbopack)3.690s (-3.0%)5.812s (+1.3%)2.122s161.15x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.798s (-5.3% 🟢)1.326s (-9.9% 🟢)0.528s911.00x
🐘 PostgresExpress0.824s (-2.8%)1.352s (-10.3% 🟢)0.528s901.03x
🐘 PostgresNext.js (Turbopack)2.866s (-7.2% 🟢)3.681s (-3.8%)0.816s333.59x
💻 LocalNitro9.345s (+7.1% 🔺)10.032s (+8.4% 🔺)0.687s1211.71x
💻 LocalExpress9.995s (+1.3%)10.696s (+4.0%)0.701s1212.52x
💻 LocalNext.js (Turbopack)11.013s (+5.0%)11.850s (+4.0%)0.837s1113.80x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.218s (-7.9% 🟢)8.141s (-5.7% 🟢)1.922s151.00x
▲ VercelExpress6.430s (-5.9% 🟢)8.691s (+0.8%)2.261s141.03x
▲ VercelNext.js (Turbopack)7.483s (+4.0%)10.018s (+11.7% 🔺)2.535s121.20x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.160s (~)2.005s (~)0.010s (+2.0%)2.018s (~)0.858s101.00x
💻 LocalExpress1.170s (~)2.005s (~)0.012s (+1.6%)2.020s (~)0.850s101.01x
🐘 PostgresExpress1.174s (~)1.998s (~)0.001s (+27.3% 🔺)2.010s (~)0.837s101.01x
🐘 PostgresNitro1.178s (-1.7%)1.997s (~)0.001s (~)2.010s (~)0.832s101.02x
🐘 PostgresNext.js (Turbopack)1.226s (-1.4%)2.002s (~)0.001s (-16.7% 🟢)2.011s (~)0.784s101.06x
💻 LocalNext.js (Turbopack)1.228s (-1.7%)2.003s (~)0.011s (-1.9%)2.018s (~)0.790s101.06x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.527s (-5.8% 🟢)3.723s (-0.6%)1.524s (+82.0% 🔺)5.771s (+13.5% 🔺)3.244s101.00x
▲ VercelNitro2.557s (~)3.645s (-1.8%)1.154s (+55.9% 🔺)5.296s (+6.7% 🔺)2.738s101.01x
▲ VercelExpress2.620s (+10.9% 🔺)3.621s (+2.6%)1.247s (+77.3% 🔺)5.373s (+12.2% 🔺)2.754s101.04x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.578s (+0.7%)2.010s (~)0.013s (+14.6% 🔺)2.025s (~)0.448s301.00x
🐘 PostgresExpress1.603s (~)2.005s (~)0.005s (+2.7%)2.027s (~)0.424s301.02x
🐘 PostgresNitro1.608s (-1.9%)2.007s (~)0.005s (+0.6%)2.028s (~)0.420s301.02x
💻 LocalExpress1.611s (~)2.011s (~)0.013s (+6.2% 🔺)2.026s (~)0.416s301.02x
💻 LocalNext.js (Turbopack)1.735s (-0.7%)2.008s (~)0.011s (-17.3% 🟢)2.023s (~)0.288s301.10x
🐘 PostgresNext.js (Turbopack)1.761s (-1.7%)2.011s (~)0.005s (-3.6%)2.026s (~)0.265s301.12x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express6.370s (-7.7% 🟢)7.860s (-5.9% 🟢)0.277s (-19.6% 🟢)8.601s (-6.8% 🟢)2.231s71.00x
▲ VercelNext.js (Turbopack)6.386s (-7.0% 🟢)8.159s (-4.9%)0.282s (-9.9% 🟢)8.937s (-4.7%)2.551s71.00x
▲ VercelNitro6.476s (-3.8%)7.838s (-2.6%)0.234s (+6.5% 🔺)8.506s (-3.4%)2.030s81.02x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.782s (-3.8%)1.047s (-1.6%)0.000s (+194.7% 🔺)1.064s (-1.5%)0.282s571.00x
🐘 PostgresExpress0.802s (+0.6%)1.050s (~)0.000s (NaN%)1.082s (+2.0%)0.280s561.03x
🐘 PostgresNext.js (Turbopack)0.975s (-5.1% 🟢)1.418s (-12.5% 🟢)0.000s (-100.0% 🟢)1.426s (-12.5% 🟢)0.451s431.25x
💻 LocalExpress1.466s (+3.3%)2.013s (~)0.000s (-28.6% 🟢)2.015s (~)0.549s301.88x
💻 LocalNitro1.535s (+13.6% 🔺)2.015s (~)0.000s (~)2.017s (~)0.482s301.96x
💻 LocalNext.js (Turbopack)1.539s (+1.7%)2.013s (~)0.000s (-9.1% 🟢)2.017s (~)0.478s301.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)3.032s (-19.5% 🟢)4.491s (-15.8% 🟢)0.000s (-100.0% 🟢)4.989s (-15.2% 🟢)1.957s131.00x
▲ VercelNitro3.082s (-25.0% 🟢)4.281s (-25.5% 🟢)0.000s (+Infinity% 🔺)4.733s (-24.2% 🟢)1.651s131.02x
▲ VercelExpress3.181s (-13.9% 🟢)4.530s (-7.6% 🟢)0.000s (+Infinity% 🔺)5.012s (-9.8% 🟢)1.831s121.05x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.593s (-3.6%)2.137s (-1.8%)0.000s (+Infinity% 🔺)2.152s (-1.6%)0.559s281.00x
🐘 PostgresNitro1.736s (+2.5%)2.253s (+3.6%)0.000s (-48.1% 🟢)2.272s (+3.6%)0.536s271.09x
🐘 PostgresNext.js (Turbopack)2.135s (-5.3% 🟢)2.653s (-2.8%)0.000s (NaN%)2.662s (-2.8%)0.526s231.34x
💻 LocalNext.js (Turbopack)3.046s (+7.4% 🔺)3.468s (+1.5%)0.000s (-11.1% 🟢)3.476s (+1.7%)0.430s181.91x
💻 LocalNitro3.322s (+7.8% 🔺)3.893s (~)0.001s (+28.6% 🔺)3.906s (~)0.583s162.09x
💻 LocalExpress3.347s (+0.9%)4.028s (~)0.000s (-53.3% 🟢)4.030s (~)0.683s152.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro5.059s (+2.8%)6.517s (+5.7% 🔺)0.000s (NaN%)7.047s (+3.6%)1.988s91.00x
▲ VercelExpress5.187s (-14.5% 🟢)6.629s (-12.7% 🟢)0.006s (+655.6% 🔺)7.277s (-11.1% 🟢)2.090s91.03x
▲ VercelNext.js (Turbopack)5.652s (-20.0% 🟢)7.189s (-12.6% 🟢)0.000s (-100.0% 🟢)7.744s (-11.6% 🟢)2.091s81.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNitro11/21
🐘 PostgresNitro11/21
▲ VercelNitro11/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres16/21
Nitro🐘 Postgres16/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​@​astrojs/​node@​10.1.41001008297100
Addednpm/​@​astrojs/​vercel@​10.0.81001008397100
Addednpm/​astro@​6.4.6881008898100

View full report

@pranaygp
pranaygp merged commit b92dfbb into mainJun 16, 2026
121 checks passed
@pranaygp
pranaygp deleted the pgp/issue-fix branch June 16, 2026 21:18
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
github-actionsBot added a commit that referenced this pull request Jun 16, 2026
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2461. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 16, 2026
…2461)
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
pranaygp added a commit that referenced this pull request Jun 16, 2026
* origin/main:
fix(core): make deploymentId 'latest' a no-op in non-Vercel worlds (#2397)
fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457)
Small detail panel cleanup (#2459)
Fix lazy Next workflow HMR (#2438)
Prevent peer dependency-only major bumps (#2437)
fix(changesets): only major-bump peer dependents when out of range (#2439)
Version Packages (beta) (#2428)
otel: explicit traceparent injection + linked-trace mode for bounded per-invocation traces (#2363)
[next] Clarify `serverExternalPackages` warning (#2417)
Add .swc gitignore handling to builder (#2427)
Version Packages (beta) (#2390)
[ci] Increase dev.test.ts cleanup hook timeout (#2416)
[world-vercel] Switch event endpoints to v4 wire format (#2055)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@karthikscale3
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 - #2457

Merged
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix
Jun 16, 2026
Merged

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299#2457
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

Resolves VULN-11836CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, High): Host header SSRF in prerendered error page fetch in astro.

The advisory's only patched version is astro 6.4.6 (< 6.4.6 is vulnerable) — there is no 5.x backport, so the fix requires moving to the 6.x line.

Changes

  • workbench/astro (the flagged app, resolved to astro@5.16.3):
    • astro^5.15.6^6.4.6
    • @astrojs/node9.5.010.1.4 (astro 6 peer compat)
    • @astrojs/vercel^9.0.0^10.0.8 (astro 6 peer compat)
  • packages/astro (@workflow/astro): astro devDependency 5.18.06.4.6 (typecheck-only, not shipped) — clears the last vulnerable astro from the lockfile.

After the bump the lockfile contains only astro@6.4.6 — both astro@5.16.3 and astro@5.18.0 are gone.

Notes

  • Pinned 6.4.6 rather than the latest 6.4.7 because the repo's minimumReleaseAge (48h) guard blocks 6.4.7 (published <48h ago); 6.4.6 is the advisory's patched version.
  • astro 6 requires Node >=22.12.0; CI runs node 22.x/24.x, so this is satisfied.

Verification

  • @workflow/astro integration typechecks (tsc) against astro 6.4.6.
  • workbench/astro builds cleanly under both the @astrojs/node (local/CI) and @astrojs/vercel (deploy) adapter paths.

🤖 Generated with Claude Code

Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CopilotAI review requested due to automatic review settings June 16, 2026 19:19
@pranaygp
pranaygp requested a review from a team as a code ownerJune 16, 2026 19:19
@vercel

vercelBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: e6702f6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/astroPatch
workflowPatch
@workflow/world-testingPatch
@workflow/corePatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

All tests passed

Summary

PassedFailedSkippedTotal
✅ ▲ Vercel Production144202191661
✅ 💻 Local Development189502192114
✅ 📦 Local Production189502192114
✅ 🐘 Local Postgres188102332114
✅ 🪟 Windows15100151
✅ 📋 Other87901781057
Total8143010689211

Details by Category

✅ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro125026
✅ example125026
✅ express125026
✅ fastify125026
✅ hono125026
✅ nextjs-turbopack14902
✅ nextjs-webpack14902
✅ nitro125026
✅ nuxt125026
✅ sveltekit14407
✅ vite125026
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable125026
✅ express-stable125026
✅ fastify-stable125026
✅ hono-stable125026
✅ nextjs-turbopack-canary131020
✅ nextjs-turbopack-stable-lazy-discovery-disabled15001
✅ nextjs-turbopack-stable-lazy-discovery-enabled15001
✅ nextjs-webpack-canary131020
✅ nextjs-webpack-stable-lazy-discovery-disabled15001
✅ nextjs-webpack-stable-lazy-discovery-enabled15001
✅ nitro-stable125026
✅ nuxt-stable125026
✅ sveltekit-stable14407
✅ vite-stable125026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15100
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable126025
✅ e2e-local-dev-tanstack-start-126025
✅ e2e-local-postgres-nest-stable125026
✅ e2e-local-postgres-tanstack-start-125026
✅ e2e-local-prod-nest-stable126025
✅ e2e-local-prod-tanstack-start-126025
✅ e2e-vercel-prod-tanstack-start125026

📋 View full workflow run

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.045s (-6.4% 🟢)1.006s (~)0.960s101.00x
💻 LocalNitro0.047s (+12.2% 🔺)1.008s (~)0.961s101.04x
🐘 PostgresNitro0.062s (-4.5%)1.013s (~)0.951s101.37x
💻 LocalNext.js (Turbopack)0.063s (+2.8%)1.007s (~)0.944s101.38x
🐘 PostgresExpress0.063s (+3.1%)1.012s (~)0.949s101.39x
🐘 PostgresNext.js (Turbopack)0.068s (-6.3% 🟢)1.012s (~)0.944s101.51x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express0.321s (-71.0% 🟢)2.398s (-33.0% 🟢)2.077s101.00x
▲ VercelNext.js (Turbopack)0.325s (-83.6% 🟢)2.160s (-47.4% 🟢)1.836s101.01x
▲ VercelNitro0.355s (-40.9% 🟢)2.479s (-6.8% 🟢)2.125s101.10x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.094s (~)2.007s (~)0.913s101.00x
💻 LocalExpress1.107s (+0.7%)2.006s (~)0.899s101.01x
🐘 PostgresExpress1.108s (-0.6%)2.010s (~)0.902s101.01x
🐘 PostgresNitro1.114s (~)2.011s (~)0.897s101.02x
🐘 PostgresNext.js (Turbopack)1.139s (-1.6%)2.010s (~)0.871s101.04x
💻 LocalNext.js (Turbopack)1.143s (~)2.007s (~)0.864s101.04x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.843s (-34.7% 🟢)3.753s (-17.4% 🟢)1.911s101.00x
▲ VercelExpress1.853s (-30.9% 🟢)3.656s (-26.9% 🟢)1.804s101.01x
▲ VercelNext.js (Turbopack)1.862s (-30.6% 🟢)3.901s (-13.8% 🟢)2.039s101.01x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express10.539s (~)11.023s (~)0.484s31.00x
💻 LocalNitro10.551s (~)11.023s (~)0.472s31.00x
🐘 PostgresExpress10.560s (~)11.018s (~)0.458s31.00x
🐘 PostgresNitro10.573s (~)11.019s (~)0.446s31.00x
💻 LocalNext.js (Turbopack)10.809s (~)11.024s (~)0.214s31.03x
🐘 PostgresNext.js (Turbopack)10.889s (~)11.352s (+3.0%)0.462s31.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro14.280s (-21.4% 🟢)16.322s (-17.9% 🟢)2.043s21.00x
▲ VercelExpress14.736s (-9.4% 🟢)16.736s (-10.2% 🟢)1.999s21.03x
▲ VercelNext.js (Turbopack)14.834s (-30.7% 🟢)16.703s (-28.2% 🟢)1.869s21.04x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express13.791s (~)14.017s (~)0.226s51.00x
💻 LocalExpress13.820s (~)14.028s (~)0.208s51.00x
🐘 PostgresNitro13.823s (~)14.021s (~)0.198s51.00x
💻 LocalNitro13.849s (~)14.028s (~)0.179s51.00x
💻 LocalNext.js (Turbopack)14.360s (~)15.030s (~)0.670s41.04x
🐘 PostgresNext.js (Turbopack)14.490s (~)15.017s (~)0.527s41.05x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)23.277s (-24.4% 🟢)25.483s (-22.4% 🟢)2.206s31.00x
▲ VercelExpress23.554s (-32.5% 🟢)25.626s (-30.6% 🟢)2.072s31.01x
▲ VercelNitro23.646s (-28.3% 🟢)25.447s (-27.0% 🟢)1.801s31.02x

🔍 Observability: Next.js (Turbopack) | Express | Nitro

workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.466s (-1.7%)13.016s (~)0.549s71.00x
💻 LocalNitro12.523s (~)13.025s (~)0.502s71.00x
💻 LocalExpress12.597s (~)13.027s (~)0.431s71.01x
🐘 PostgresExpress12.831s (+1.9%)13.303s (+2.2%)0.472s71.03x
💻 LocalNext.js (Turbopack)13.682s (~)14.027s (~)0.345s71.10x
🐘 PostgresNext.js (Turbopack)13.752s (-1.6%)14.019s (-1.0%)0.268s71.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express33.719s (-3.0%)36.136s (-2.6%)2.417s31.00x
▲ VercelNext.js (Turbopack)34.038s (-3.1%)36.769s (-2.0%)2.731s31.01x
▲ VercelNitro37.427s (-1.3%)40.332s (+2.1%)2.905s31.11x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.212s (+0.5%)2.008s (~)0.796s151.00x
💻 LocalExpress1.212s (+1.7%)2.007s (~)0.795s151.00x
🐘 PostgresNitro1.213s (~)2.008s (~)0.794s151.00x
💻 LocalNitro1.248s (+7.3% 🔺)2.006s (~)0.758s151.03x
🐘 PostgresNext.js (Turbopack)1.303s (-4.0%)2.007s (-3.3%)0.704s151.08x
💻 LocalNext.js (Turbopack)1.366s (+2.8%)2.006s (~)0.640s151.13x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.318s (-25.0% 🟢)3.899s (-15.0% 🟢)1.581s81.00x
▲ VercelNext.js (Turbopack)2.378s (+1.3%)3.969s (-1.2%)1.591s81.03x
▲ VercelExpress2.454s (-3.8%)3.990s (-2.0%)1.536s81.06x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.334s (-0.6%)2.592s (+3.3%)1.258s121.00x
🐘 PostgresExpress1.407s (+3.6%)2.393s (-4.6%)0.986s131.05x
🐘 PostgresNext.js (Turbopack)1.592s (-2.8%)2.294s (-8.6% 🟢)0.702s141.19x
💻 LocalNext.js (Turbopack)1.600s (~)2.006s (~)0.406s151.20x
💻 LocalNitro1.711s (+5.0% 🔺)2.006s (~)0.295s151.28x
💻 LocalExpress2.065s (+9.0% 🔺)2.471s (+14.8% 🔺)0.406s131.55x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.392s (-17.6% 🟢)5.282s (-12.8% 🟢)1.890s71.00x
▲ VercelNitro3.657s (-3.0%)5.390s (~)1.732s61.08x
▲ VercelNext.js (Turbopack)3.834s (+9.4% 🔺)5.777s (+10.0% 🔺)1.943s61.13x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.653s (+1.9%)4.014s (+3.3%)2.361s81.00x
🐘 PostgresNitro1.727s (+6.3% 🔺)4.012s (-3.1%)2.285s81.04x
🐘 PostgresNext.js (Turbopack)2.772s (-27.6% 🟢)3.760s (-15.4% 🟢)0.988s81.68x
💻 LocalNext.js (Turbopack)4.577s (~)5.178s (~)0.602s62.77x
💻 LocalNitro4.749s (+18.1% 🔺)5.179s (+13.0% 🔺)0.430s62.87x
💻 LocalExpress5.519s (+5.4% 🔺)5.845s (~)0.326s63.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express5.467s (+19.5% 🔺)7.579s (+15.5% 🔺)2.112s41.00x
▲ VercelNext.js (Turbopack)6.098s (+61.0% 🔺)7.907s (+46.2% 🔺)1.808s41.12x
▲ VercelNitro6.220s (+46.5% 🔺)8.628s (+50.6% 🔺)2.408s41.14x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.195s (-2.2%)2.007s (~)0.812s151.00x
🐘 PostgresExpress1.208s (~)2.007s (~)0.799s151.01x
🐘 PostgresNext.js (Turbopack)1.304s (+1.4%)2.008s (~)0.704s151.09x
💻 LocalNext.js (Turbopack)1.384s (~)2.006s (~)0.622s151.16x
💻 LocalNitro1.547s (+2.4%)2.006s (~)0.460s151.29x
💻 LocalExpress1.578s (-2.2%)2.007s (~)0.429s151.32x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.405s (+4.3%)3.820s (-3.2%)1.415s81.00x
▲ VercelNitro2.423s (-62.6% 🟢)3.700s (-53.9% 🟢)1.278s91.01x
▲ VercelExpress2.461s (+8.2% 🔺)4.085s (+6.0% 🔺)1.624s81.02x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.350s (-3.3%)2.509s (+1.6%)1.160s121.00x
🐘 PostgresNitro1.364s (+0.5%)2.317s (-10.6% 🟢)0.953s131.01x
🐘 PostgresNext.js (Turbopack)1.545s (+0.5%)2.221s (~)0.676s141.14x
💻 LocalNitro1.887s (+5.4% 🔺)2.315s (+11.7% 🔺)0.428s131.40x
💻 LocalNext.js (Turbopack)2.020s (+4.6%)2.591s (+16.6% 🔺)0.571s121.50x
💻 LocalExpress2.186s (-15.1% 🟢)2.591s (-16.6% 🟢)0.405s121.62x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.686s (-28.3% 🟢)3.995s (-26.8% 🟢)1.308s81.00x
▲ VercelNext.js (Turbopack)3.121s (-22.2% 🟢)5.152s (-10.3% 🟢)2.031s61.16x
▲ VercelExpress3.368s (+1.1%)4.862s (-9.0% 🟢)1.494s71.25x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.642s (-5.0%)4.299s (+10.6% 🔺)2.656s71.00x
🐘 PostgresExpress1.693s (-3.4%)4.012s (-3.0%)2.319s81.03x
🐘 PostgresNext.js (Turbopack)2.857s (-25.6% 🟢)4.013s (-9.7% 🟢)1.156s81.74x
💻 LocalNext.js (Turbopack)5.016s (-5.2% 🟢)5.515s (-8.3% 🟢)0.499s63.05x
💻 LocalExpress5.795s (-8.6% 🟢)6.216s (-11.4% 🟢)0.420s53.53x
💻 LocalNitro6.023s (+26.5% 🔺)6.819s (+27.5% 🔺)0.796s53.67x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro4.371s (-33.7% 🟢)6.186s (-25.9% 🟢)1.815s51.00x
▲ VercelNext.js (Turbopack)5.040s (+2.3%)7.308s (+12.5% 🔺)2.268s51.15x
▲ VercelExpress5.213s (~)7.552s (+8.4% 🔺)2.338s41.19x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.583s (-9.5% 🟢)1.023s (-1.8%)0.440s591.00x
🐘 PostgresExpress0.587s (-0.8%)1.023s (+1.7%)0.436s591.01x
💻 LocalNitro0.601s (+3.1%)1.005s (~)0.404s601.03x
💻 LocalExpress0.663s (+0.6%)1.022s (-1.7%)0.359s591.14x
🐘 PostgresNext.js (Turbopack)0.817s (-3.8%)1.006s (-1.7%)0.189s601.40x
💻 LocalNext.js (Turbopack)0.878s (-0.8%)1.039s (-1.7%)0.161s581.50x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.186s (-26.9% 🟢)7.879s (-22.0% 🟢)1.693s81.00x
▲ VercelExpress6.507s (-1.1%)8.264s (-4.2%)1.757s81.05x
▲ VercelNext.js (Turbopack)6.927s (-6.6% 🟢)8.857s (-5.2% 🟢)1.930s71.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.372s (-5.1% 🟢)2.052s (+2.2%)0.680s441.00x
🐘 PostgresExpress1.430s (~)2.053s (+1.1%)0.622s441.04x
💻 LocalNitro1.508s (+2.1%)2.006s (~)0.498s451.10x
💻 LocalExpress1.588s (~)2.007s (~)0.419s451.16x
🐘 PostgresNext.js (Turbopack)1.941s (-4.7%)2.151s (-16.1% 🟢)0.210s421.41x
💻 LocalNext.js (Turbopack)2.145s (+0.8%)3.009s (~)0.864s301.56x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro15.095s (-19.6% 🟢)17.268s (-16.8% 🟢)2.174s61.00x
▲ VercelNext.js (Turbopack)15.916s (-20.1% 🟢)18.292s (-18.3% 🟢)2.376s51.05x
▲ VercelExpress16.686s (-17.1% 🟢)18.647s (-14.7% 🟢)1.961s51.11x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express2.727s (-1.9%)3.086s (-1.6%)0.359s391.00x
🐘 PostgresNitro2.976s (+5.5% 🔺)3.397s (+8.3% 🔺)0.422s361.09x
💻 LocalNitro3.313s (+4.6%)4.043s (+3.3%)0.730s301.21x
💻 LocalExpress3.405s (+1.9%)4.011s (~)0.606s301.25x
🐘 PostgresNext.js (Turbopack)3.831s (-4.8%)4.110s (-6.7% 🟢)0.279s301.40x
💻 LocalNext.js (Turbopack)4.575s (+0.8%)5.053s (~)0.478s241.68x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro30.084s (-17.0% 🟢)32.889s (-13.9% 🟢)2.806s41.00x
▲ VercelExpress30.093s (-22.2% 🟢)32.724s (-19.0% 🟢)2.631s41.00x
▲ VercelNext.js (Turbopack)33.218s (-26.0% 🟢)36.130s (-22.6% 🟢)2.912s41.10x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.244s (-6.4% 🟢)1.006s (~)0.762s601.00x
🐘 PostgresExpress0.250s (-4.2%)1.006s (~)0.756s601.02x
🐘 PostgresNext.js (Turbopack)0.311s (+0.8%)1.006s (~)0.696s601.27x
💻 LocalNitro0.454s (+5.2% 🔺)1.005s (~)0.551s601.86x
💻 LocalExpress0.462s (+8.0% 🔺)1.005s (~)0.543s601.89x
💻 LocalNext.js (Turbopack)0.564s (-12.7% 🟢)1.005s (-5.1% 🟢)0.441s602.31x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.833s (-36.5% 🟢)3.794s (-24.6% 🟢)1.962s161.00x
▲ VercelNext.js (Turbopack)2.203s (-28.3% 🟢)4.190s (-16.4% 🟢)1.986s151.20x
▲ VercelExpress2.247s (-37.1% 🟢)4.134s (-26.0% 🟢)1.887s151.23x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.400s (-12.6% 🟢)1.006s (-6.7% 🟢)0.606s901.00x
🐘 PostgresExpress0.423s (+2.8%)1.041s (+3.4%)0.618s871.06x
🐘 PostgresNext.js (Turbopack)0.618s (-8.8% 🟢)1.240s (-2.8%)0.622s731.55x
💻 LocalNitro2.184s (+8.6% 🔺)2.767s (+13.4% 🔺)0.584s335.46x
💻 LocalExpress2.245s (+2.5%)2.913s (+2.1%)0.668s315.62x
💻 LocalNext.js (Turbopack)2.497s (-2.4%)3.224s (-1.1%)0.728s286.25x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.219s (-37.6% 🟢)4.988s (-30.9% 🟢)1.769s191.00x
▲ VercelNitro3.388s (-2.8%)5.242s (+1.4%)1.854s181.05x
▲ VercelNext.js (Turbopack)3.690s (-3.0%)5.812s (+1.3%)2.122s161.15x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.798s (-5.3% 🟢)1.326s (-9.9% 🟢)0.528s911.00x
🐘 PostgresExpress0.824s (-2.8%)1.352s (-10.3% 🟢)0.528s901.03x
🐘 PostgresNext.js (Turbopack)2.866s (-7.2% 🟢)3.681s (-3.8%)0.816s333.59x
💻 LocalNitro9.345s (+7.1% 🔺)10.032s (+8.4% 🔺)0.687s1211.71x
💻 LocalExpress9.995s (+1.3%)10.696s (+4.0%)0.701s1212.52x
💻 LocalNext.js (Turbopack)11.013s (+5.0%)11.850s (+4.0%)0.837s1113.80x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.218s (-7.9% 🟢)8.141s (-5.7% 🟢)1.922s151.00x
▲ VercelExpress6.430s (-5.9% 🟢)8.691s (+0.8%)2.261s141.03x
▲ VercelNext.js (Turbopack)7.483s (+4.0%)10.018s (+11.7% 🔺)2.535s121.20x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.160s (~)2.005s (~)0.010s (+2.0%)2.018s (~)0.858s101.00x
💻 LocalExpress1.170s (~)2.005s (~)0.012s (+1.6%)2.020s (~)0.850s101.01x
🐘 PostgresExpress1.174s (~)1.998s (~)0.001s (+27.3% 🔺)2.010s (~)0.837s101.01x
🐘 PostgresNitro1.178s (-1.7%)1.997s (~)0.001s (~)2.010s (~)0.832s101.02x
🐘 PostgresNext.js (Turbopack)1.226s (-1.4%)2.002s (~)0.001s (-16.7% 🟢)2.011s (~)0.784s101.06x
💻 LocalNext.js (Turbopack)1.228s (-1.7%)2.003s (~)0.011s (-1.9%)2.018s (~)0.790s101.06x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.527s (-5.8% 🟢)3.723s (-0.6%)1.524s (+82.0% 🔺)5.771s (+13.5% 🔺)3.244s101.00x
▲ VercelNitro2.557s (~)3.645s (-1.8%)1.154s (+55.9% 🔺)5.296s (+6.7% 🔺)2.738s101.01x
▲ VercelExpress2.620s (+10.9% 🔺)3.621s (+2.6%)1.247s (+77.3% 🔺)5.373s (+12.2% 🔺)2.754s101.04x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.578s (+0.7%)2.010s (~)0.013s (+14.6% 🔺)2.025s (~)0.448s301.00x
🐘 PostgresExpress1.603s (~)2.005s (~)0.005s (+2.7%)2.027s (~)0.424s301.02x
🐘 PostgresNitro1.608s (-1.9%)2.007s (~)0.005s (+0.6%)2.028s (~)0.420s301.02x
💻 LocalExpress1.611s (~)2.011s (~)0.013s (+6.2% 🔺)2.026s (~)0.416s301.02x
💻 LocalNext.js (Turbopack)1.735s (-0.7%)2.008s (~)0.011s (-17.3% 🟢)2.023s (~)0.288s301.10x
🐘 PostgresNext.js (Turbopack)1.761s (-1.7%)2.011s (~)0.005s (-3.6%)2.026s (~)0.265s301.12x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express6.370s (-7.7% 🟢)7.860s (-5.9% 🟢)0.277s (-19.6% 🟢)8.601s (-6.8% 🟢)2.231s71.00x
▲ VercelNext.js (Turbopack)6.386s (-7.0% 🟢)8.159s (-4.9%)0.282s (-9.9% 🟢)8.937s (-4.7%)2.551s71.00x
▲ VercelNitro6.476s (-3.8%)7.838s (-2.6%)0.234s (+6.5% 🔺)8.506s (-3.4%)2.030s81.02x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.782s (-3.8%)1.047s (-1.6%)0.000s (+194.7% 🔺)1.064s (-1.5%)0.282s571.00x
🐘 PostgresExpress0.802s (+0.6%)1.050s (~)0.000s (NaN%)1.082s (+2.0%)0.280s561.03x
🐘 PostgresNext.js (Turbopack)0.975s (-5.1% 🟢)1.418s (-12.5% 🟢)0.000s (-100.0% 🟢)1.426s (-12.5% 🟢)0.451s431.25x
💻 LocalExpress1.466s (+3.3%)2.013s (~)0.000s (-28.6% 🟢)2.015s (~)0.549s301.88x
💻 LocalNitro1.535s (+13.6% 🔺)2.015s (~)0.000s (~)2.017s (~)0.482s301.96x
💻 LocalNext.js (Turbopack)1.539s (+1.7%)2.013s (~)0.000s (-9.1% 🟢)2.017s (~)0.478s301.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)3.032s (-19.5% 🟢)4.491s (-15.8% 🟢)0.000s (-100.0% 🟢)4.989s (-15.2% 🟢)1.957s131.00x
▲ VercelNitro3.082s (-25.0% 🟢)4.281s (-25.5% 🟢)0.000s (+Infinity% 🔺)4.733s (-24.2% 🟢)1.651s131.02x
▲ VercelExpress3.181s (-13.9% 🟢)4.530s (-7.6% 🟢)0.000s (+Infinity% 🔺)5.012s (-9.8% 🟢)1.831s121.05x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.593s (-3.6%)2.137s (-1.8%)0.000s (+Infinity% 🔺)2.152s (-1.6%)0.559s281.00x
🐘 PostgresNitro1.736s (+2.5%)2.253s (+3.6%)0.000s (-48.1% 🟢)2.272s (+3.6%)0.536s271.09x
🐘 PostgresNext.js (Turbopack)2.135s (-5.3% 🟢)2.653s (-2.8%)0.000s (NaN%)2.662s (-2.8%)0.526s231.34x
💻 LocalNext.js (Turbopack)3.046s (+7.4% 🔺)3.468s (+1.5%)0.000s (-11.1% 🟢)3.476s (+1.7%)0.430s181.91x
💻 LocalNitro3.322s (+7.8% 🔺)3.893s (~)0.001s (+28.6% 🔺)3.906s (~)0.583s162.09x
💻 LocalExpress3.347s (+0.9%)4.028s (~)0.000s (-53.3% 🟢)4.030s (~)0.683s152.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro5.059s (+2.8%)6.517s (+5.7% 🔺)0.000s (NaN%)7.047s (+3.6%)1.988s91.00x
▲ VercelExpress5.187s (-14.5% 🟢)6.629s (-12.7% 🟢)0.006s (+655.6% 🔺)7.277s (-11.1% 🟢)2.090s91.03x
▲ VercelNext.js (Turbopack)5.652s (-20.0% 🟢)7.189s (-12.6% 🟢)0.000s (-100.0% 🟢)7.744s (-11.6% 🟢)2.091s81.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNitro11/21
🐘 PostgresNitro11/21
▲ VercelNitro11/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres16/21
Nitro🐘 Postgres16/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​@​astrojs/​node@​10.1.41001008297100
Addednpm/​@​astrojs/​vercel@​10.0.81001008397100
Addednpm/​astro@​6.4.6881008898100

View full report

@pranaygp
pranaygp merged commit b92dfbb into mainJun 16, 2026
121 checks passed
@pranaygp
pranaygp deleted the pgp/issue-fix branch June 16, 2026 21:18
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
github-actionsBot added a commit that referenced this pull request Jun 16, 2026
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2461. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 16, 2026
…2461)
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
pranaygp added a commit that referenced this pull request Jun 16, 2026
* origin/main:
fix(core): make deploymentId 'latest' a no-op in non-Vercel worlds (#2397)
fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457)
Small detail panel cleanup (#2459)
Fix lazy Next workflow HMR (#2438)
Prevent peer dependency-only major bumps (#2437)
fix(changesets): only major-bump peer dependents when out of range (#2439)
Version Packages (beta) (#2428)
otel: explicit traceparent injection + linked-trace mode for bounded per-invocation traces (#2363)
[next] Clarify `serverExternalPackages` warning (#2417)
Add .swc gitignore handling to builder (#2427)
Version Packages (beta) (#2390)
[ci] Increase dev.test.ts cleanup hook timeout (#2416)
[world-vercel] Switch event endpoints to v4 wire format (#2055)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@karthikscale3
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 - #2457

Merged
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix
Jun 16, 2026
Merged

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299#2457
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

Resolves VULN-11836CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, High): Host header SSRF in prerendered error page fetch in astro.

The advisory's only patched version is astro 6.4.6 (< 6.4.6 is vulnerable) — there is no 5.x backport, so the fix requires moving to the 6.x line.

Changes

  • workbench/astro (the flagged app, resolved to astro@5.16.3):
    • astro^5.15.6^6.4.6
    • @astrojs/node9.5.010.1.4 (astro 6 peer compat)
    • @astrojs/vercel^9.0.0^10.0.8 (astro 6 peer compat)
  • packages/astro (@workflow/astro): astro devDependency 5.18.06.4.6 (typecheck-only, not shipped) — clears the last vulnerable astro from the lockfile.

After the bump the lockfile contains only astro@6.4.6 — both astro@5.16.3 and astro@5.18.0 are gone.

Notes

  • Pinned 6.4.6 rather than the latest 6.4.7 because the repo's minimumReleaseAge (48h) guard blocks 6.4.7 (published <48h ago); 6.4.6 is the advisory's patched version.
  • astro 6 requires Node >=22.12.0; CI runs node 22.x/24.x, so this is satisfied.

Verification

  • @workflow/astro integration typechecks (tsc) against astro 6.4.6.
  • workbench/astro builds cleanly under both the @astrojs/node (local/CI) and @astrojs/vercel (deploy) adapter paths.

🤖 Generated with Claude Code

Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CopilotAI review requested due to automatic review settings June 16, 2026 19:19
@pranaygp
pranaygp requested a review from a team as a code ownerJune 16, 2026 19:19
@vercel

vercelBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: e6702f6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/astroPatch
workflowPatch
@workflow/world-testingPatch
@workflow/corePatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

All tests passed

Summary

PassedFailedSkippedTotal
✅ ▲ Vercel Production144202191661
✅ 💻 Local Development189502192114
✅ 📦 Local Production189502192114
✅ 🐘 Local Postgres188102332114
✅ 🪟 Windows15100151
✅ 📋 Other87901781057
Total8143010689211

Details by Category

✅ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro125026
✅ example125026
✅ express125026
✅ fastify125026
✅ hono125026
✅ nextjs-turbopack14902
✅ nextjs-webpack14902
✅ nitro125026
✅ nuxt125026
✅ sveltekit14407
✅ vite125026
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable125026
✅ express-stable125026
✅ fastify-stable125026
✅ hono-stable125026
✅ nextjs-turbopack-canary131020
✅ nextjs-turbopack-stable-lazy-discovery-disabled15001
✅ nextjs-turbopack-stable-lazy-discovery-enabled15001
✅ nextjs-webpack-canary131020
✅ nextjs-webpack-stable-lazy-discovery-disabled15001
✅ nextjs-webpack-stable-lazy-discovery-enabled15001
✅ nitro-stable125026
✅ nuxt-stable125026
✅ sveltekit-stable14407
✅ vite-stable125026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15100
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable126025
✅ e2e-local-dev-tanstack-start-126025
✅ e2e-local-postgres-nest-stable125026
✅ e2e-local-postgres-tanstack-start-125026
✅ e2e-local-prod-nest-stable126025
✅ e2e-local-prod-tanstack-start-126025
✅ e2e-vercel-prod-tanstack-start125026

📋 View full workflow run

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.045s (-6.4% 🟢)1.006s (~)0.960s101.00x
💻 LocalNitro0.047s (+12.2% 🔺)1.008s (~)0.961s101.04x
🐘 PostgresNitro0.062s (-4.5%)1.013s (~)0.951s101.37x
💻 LocalNext.js (Turbopack)0.063s (+2.8%)1.007s (~)0.944s101.38x
🐘 PostgresExpress0.063s (+3.1%)1.012s (~)0.949s101.39x
🐘 PostgresNext.js (Turbopack)0.068s (-6.3% 🟢)1.012s (~)0.944s101.51x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express0.321s (-71.0% 🟢)2.398s (-33.0% 🟢)2.077s101.00x
▲ VercelNext.js (Turbopack)0.325s (-83.6% 🟢)2.160s (-47.4% 🟢)1.836s101.01x
▲ VercelNitro0.355s (-40.9% 🟢)2.479s (-6.8% 🟢)2.125s101.10x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.094s (~)2.007s (~)0.913s101.00x
💻 LocalExpress1.107s (+0.7%)2.006s (~)0.899s101.01x
🐘 PostgresExpress1.108s (-0.6%)2.010s (~)0.902s101.01x
🐘 PostgresNitro1.114s (~)2.011s (~)0.897s101.02x
🐘 PostgresNext.js (Turbopack)1.139s (-1.6%)2.010s (~)0.871s101.04x
💻 LocalNext.js (Turbopack)1.143s (~)2.007s (~)0.864s101.04x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.843s (-34.7% 🟢)3.753s (-17.4% 🟢)1.911s101.00x
▲ VercelExpress1.853s (-30.9% 🟢)3.656s (-26.9% 🟢)1.804s101.01x
▲ VercelNext.js (Turbopack)1.862s (-30.6% 🟢)3.901s (-13.8% 🟢)2.039s101.01x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express10.539s (~)11.023s (~)0.484s31.00x
💻 LocalNitro10.551s (~)11.023s (~)0.472s31.00x
🐘 PostgresExpress10.560s (~)11.018s (~)0.458s31.00x
🐘 PostgresNitro10.573s (~)11.019s (~)0.446s31.00x
💻 LocalNext.js (Turbopack)10.809s (~)11.024s (~)0.214s31.03x
🐘 PostgresNext.js (Turbopack)10.889s (~)11.352s (+3.0%)0.462s31.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro14.280s (-21.4% 🟢)16.322s (-17.9% 🟢)2.043s21.00x
▲ VercelExpress14.736s (-9.4% 🟢)16.736s (-10.2% 🟢)1.999s21.03x
▲ VercelNext.js (Turbopack)14.834s (-30.7% 🟢)16.703s (-28.2% 🟢)1.869s21.04x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express13.791s (~)14.017s (~)0.226s51.00x
💻 LocalExpress13.820s (~)14.028s (~)0.208s51.00x
🐘 PostgresNitro13.823s (~)14.021s (~)0.198s51.00x
💻 LocalNitro13.849s (~)14.028s (~)0.179s51.00x
💻 LocalNext.js (Turbopack)14.360s (~)15.030s (~)0.670s41.04x
🐘 PostgresNext.js (Turbopack)14.490s (~)15.017s (~)0.527s41.05x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)23.277s (-24.4% 🟢)25.483s (-22.4% 🟢)2.206s31.00x
▲ VercelExpress23.554s (-32.5% 🟢)25.626s (-30.6% 🟢)2.072s31.01x
▲ VercelNitro23.646s (-28.3% 🟢)25.447s (-27.0% 🟢)1.801s31.02x

🔍 Observability: Next.js (Turbopack) | Express | Nitro

workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.466s (-1.7%)13.016s (~)0.549s71.00x
💻 LocalNitro12.523s (~)13.025s (~)0.502s71.00x
💻 LocalExpress12.597s (~)13.027s (~)0.431s71.01x
🐘 PostgresExpress12.831s (+1.9%)13.303s (+2.2%)0.472s71.03x
💻 LocalNext.js (Turbopack)13.682s (~)14.027s (~)0.345s71.10x
🐘 PostgresNext.js (Turbopack)13.752s (-1.6%)14.019s (-1.0%)0.268s71.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express33.719s (-3.0%)36.136s (-2.6%)2.417s31.00x
▲ VercelNext.js (Turbopack)34.038s (-3.1%)36.769s (-2.0%)2.731s31.01x
▲ VercelNitro37.427s (-1.3%)40.332s (+2.1%)2.905s31.11x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.212s (+0.5%)2.008s (~)0.796s151.00x
💻 LocalExpress1.212s (+1.7%)2.007s (~)0.795s151.00x
🐘 PostgresNitro1.213s (~)2.008s (~)0.794s151.00x
💻 LocalNitro1.248s (+7.3% 🔺)2.006s (~)0.758s151.03x
🐘 PostgresNext.js (Turbopack)1.303s (-4.0%)2.007s (-3.3%)0.704s151.08x
💻 LocalNext.js (Turbopack)1.366s (+2.8%)2.006s (~)0.640s151.13x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.318s (-25.0% 🟢)3.899s (-15.0% 🟢)1.581s81.00x
▲ VercelNext.js (Turbopack)2.378s (+1.3%)3.969s (-1.2%)1.591s81.03x
▲ VercelExpress2.454s (-3.8%)3.990s (-2.0%)1.536s81.06x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.334s (-0.6%)2.592s (+3.3%)1.258s121.00x
🐘 PostgresExpress1.407s (+3.6%)2.393s (-4.6%)0.986s131.05x
🐘 PostgresNext.js (Turbopack)1.592s (-2.8%)2.294s (-8.6% 🟢)0.702s141.19x
💻 LocalNext.js (Turbopack)1.600s (~)2.006s (~)0.406s151.20x
💻 LocalNitro1.711s (+5.0% 🔺)2.006s (~)0.295s151.28x
💻 LocalExpress2.065s (+9.0% 🔺)2.471s (+14.8% 🔺)0.406s131.55x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.392s (-17.6% 🟢)5.282s (-12.8% 🟢)1.890s71.00x
▲ VercelNitro3.657s (-3.0%)5.390s (~)1.732s61.08x
▲ VercelNext.js (Turbopack)3.834s (+9.4% 🔺)5.777s (+10.0% 🔺)1.943s61.13x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.653s (+1.9%)4.014s (+3.3%)2.361s81.00x
🐘 PostgresNitro1.727s (+6.3% 🔺)4.012s (-3.1%)2.285s81.04x
🐘 PostgresNext.js (Turbopack)2.772s (-27.6% 🟢)3.760s (-15.4% 🟢)0.988s81.68x
💻 LocalNext.js (Turbopack)4.577s (~)5.178s (~)0.602s62.77x
💻 LocalNitro4.749s (+18.1% 🔺)5.179s (+13.0% 🔺)0.430s62.87x
💻 LocalExpress5.519s (+5.4% 🔺)5.845s (~)0.326s63.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express5.467s (+19.5% 🔺)7.579s (+15.5% 🔺)2.112s41.00x
▲ VercelNext.js (Turbopack)6.098s (+61.0% 🔺)7.907s (+46.2% 🔺)1.808s41.12x
▲ VercelNitro6.220s (+46.5% 🔺)8.628s (+50.6% 🔺)2.408s41.14x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.195s (-2.2%)2.007s (~)0.812s151.00x
🐘 PostgresExpress1.208s (~)2.007s (~)0.799s151.01x
🐘 PostgresNext.js (Turbopack)1.304s (+1.4%)2.008s (~)0.704s151.09x
💻 LocalNext.js (Turbopack)1.384s (~)2.006s (~)0.622s151.16x
💻 LocalNitro1.547s (+2.4%)2.006s (~)0.460s151.29x
💻 LocalExpress1.578s (-2.2%)2.007s (~)0.429s151.32x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.405s (+4.3%)3.820s (-3.2%)1.415s81.00x
▲ VercelNitro2.423s (-62.6% 🟢)3.700s (-53.9% 🟢)1.278s91.01x
▲ VercelExpress2.461s (+8.2% 🔺)4.085s (+6.0% 🔺)1.624s81.02x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.350s (-3.3%)2.509s (+1.6%)1.160s121.00x
🐘 PostgresNitro1.364s (+0.5%)2.317s (-10.6% 🟢)0.953s131.01x
🐘 PostgresNext.js (Turbopack)1.545s (+0.5%)2.221s (~)0.676s141.14x
💻 LocalNitro1.887s (+5.4% 🔺)2.315s (+11.7% 🔺)0.428s131.40x
💻 LocalNext.js (Turbopack)2.020s (+4.6%)2.591s (+16.6% 🔺)0.571s121.50x
💻 LocalExpress2.186s (-15.1% 🟢)2.591s (-16.6% 🟢)0.405s121.62x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.686s (-28.3% 🟢)3.995s (-26.8% 🟢)1.308s81.00x
▲ VercelNext.js (Turbopack)3.121s (-22.2% 🟢)5.152s (-10.3% 🟢)2.031s61.16x
▲ VercelExpress3.368s (+1.1%)4.862s (-9.0% 🟢)1.494s71.25x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.642s (-5.0%)4.299s (+10.6% 🔺)2.656s71.00x
🐘 PostgresExpress1.693s (-3.4%)4.012s (-3.0%)2.319s81.03x
🐘 PostgresNext.js (Turbopack)2.857s (-25.6% 🟢)4.013s (-9.7% 🟢)1.156s81.74x
💻 LocalNext.js (Turbopack)5.016s (-5.2% 🟢)5.515s (-8.3% 🟢)0.499s63.05x
💻 LocalExpress5.795s (-8.6% 🟢)6.216s (-11.4% 🟢)0.420s53.53x
💻 LocalNitro6.023s (+26.5% 🔺)6.819s (+27.5% 🔺)0.796s53.67x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro4.371s (-33.7% 🟢)6.186s (-25.9% 🟢)1.815s51.00x
▲ VercelNext.js (Turbopack)5.040s (+2.3%)7.308s (+12.5% 🔺)2.268s51.15x
▲ VercelExpress5.213s (~)7.552s (+8.4% 🔺)2.338s41.19x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.583s (-9.5% 🟢)1.023s (-1.8%)0.440s591.00x
🐘 PostgresExpress0.587s (-0.8%)1.023s (+1.7%)0.436s591.01x
💻 LocalNitro0.601s (+3.1%)1.005s (~)0.404s601.03x
💻 LocalExpress0.663s (+0.6%)1.022s (-1.7%)0.359s591.14x
🐘 PostgresNext.js (Turbopack)0.817s (-3.8%)1.006s (-1.7%)0.189s601.40x
💻 LocalNext.js (Turbopack)0.878s (-0.8%)1.039s (-1.7%)0.161s581.50x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.186s (-26.9% 🟢)7.879s (-22.0% 🟢)1.693s81.00x
▲ VercelExpress6.507s (-1.1%)8.264s (-4.2%)1.757s81.05x
▲ VercelNext.js (Turbopack)6.927s (-6.6% 🟢)8.857s (-5.2% 🟢)1.930s71.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.372s (-5.1% 🟢)2.052s (+2.2%)0.680s441.00x
🐘 PostgresExpress1.430s (~)2.053s (+1.1%)0.622s441.04x
💻 LocalNitro1.508s (+2.1%)2.006s (~)0.498s451.10x
💻 LocalExpress1.588s (~)2.007s (~)0.419s451.16x
🐘 PostgresNext.js (Turbopack)1.941s (-4.7%)2.151s (-16.1% 🟢)0.210s421.41x
💻 LocalNext.js (Turbopack)2.145s (+0.8%)3.009s (~)0.864s301.56x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro15.095s (-19.6% 🟢)17.268s (-16.8% 🟢)2.174s61.00x
▲ VercelNext.js (Turbopack)15.916s (-20.1% 🟢)18.292s (-18.3% 🟢)2.376s51.05x
▲ VercelExpress16.686s (-17.1% 🟢)18.647s (-14.7% 🟢)1.961s51.11x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express2.727s (-1.9%)3.086s (-1.6%)0.359s391.00x
🐘 PostgresNitro2.976s (+5.5% 🔺)3.397s (+8.3% 🔺)0.422s361.09x
💻 LocalNitro3.313s (+4.6%)4.043s (+3.3%)0.730s301.21x
💻 LocalExpress3.405s (+1.9%)4.011s (~)0.606s301.25x
🐘 PostgresNext.js (Turbopack)3.831s (-4.8%)4.110s (-6.7% 🟢)0.279s301.40x
💻 LocalNext.js (Turbopack)4.575s (+0.8%)5.053s (~)0.478s241.68x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro30.084s (-17.0% 🟢)32.889s (-13.9% 🟢)2.806s41.00x
▲ VercelExpress30.093s (-22.2% 🟢)32.724s (-19.0% 🟢)2.631s41.00x
▲ VercelNext.js (Turbopack)33.218s (-26.0% 🟢)36.130s (-22.6% 🟢)2.912s41.10x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.244s (-6.4% 🟢)1.006s (~)0.762s601.00x
🐘 PostgresExpress0.250s (-4.2%)1.006s (~)0.756s601.02x
🐘 PostgresNext.js (Turbopack)0.311s (+0.8%)1.006s (~)0.696s601.27x
💻 LocalNitro0.454s (+5.2% 🔺)1.005s (~)0.551s601.86x
💻 LocalExpress0.462s (+8.0% 🔺)1.005s (~)0.543s601.89x
💻 LocalNext.js (Turbopack)0.564s (-12.7% 🟢)1.005s (-5.1% 🟢)0.441s602.31x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.833s (-36.5% 🟢)3.794s (-24.6% 🟢)1.962s161.00x
▲ VercelNext.js (Turbopack)2.203s (-28.3% 🟢)4.190s (-16.4% 🟢)1.986s151.20x
▲ VercelExpress2.247s (-37.1% 🟢)4.134s (-26.0% 🟢)1.887s151.23x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.400s (-12.6% 🟢)1.006s (-6.7% 🟢)0.606s901.00x
🐘 PostgresExpress0.423s (+2.8%)1.041s (+3.4%)0.618s871.06x
🐘 PostgresNext.js (Turbopack)0.618s (-8.8% 🟢)1.240s (-2.8%)0.622s731.55x
💻 LocalNitro2.184s (+8.6% 🔺)2.767s (+13.4% 🔺)0.584s335.46x
💻 LocalExpress2.245s (+2.5%)2.913s (+2.1%)0.668s315.62x
💻 LocalNext.js (Turbopack)2.497s (-2.4%)3.224s (-1.1%)0.728s286.25x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.219s (-37.6% 🟢)4.988s (-30.9% 🟢)1.769s191.00x
▲ VercelNitro3.388s (-2.8%)5.242s (+1.4%)1.854s181.05x
▲ VercelNext.js (Turbopack)3.690s (-3.0%)5.812s (+1.3%)2.122s161.15x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.798s (-5.3% 🟢)1.326s (-9.9% 🟢)0.528s911.00x
🐘 PostgresExpress0.824s (-2.8%)1.352s (-10.3% 🟢)0.528s901.03x
🐘 PostgresNext.js (Turbopack)2.866s (-7.2% 🟢)3.681s (-3.8%)0.816s333.59x
💻 LocalNitro9.345s (+7.1% 🔺)10.032s (+8.4% 🔺)0.687s1211.71x
💻 LocalExpress9.995s (+1.3%)10.696s (+4.0%)0.701s1212.52x
💻 LocalNext.js (Turbopack)11.013s (+5.0%)11.850s (+4.0%)0.837s1113.80x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.218s (-7.9% 🟢)8.141s (-5.7% 🟢)1.922s151.00x
▲ VercelExpress6.430s (-5.9% 🟢)8.691s (+0.8%)2.261s141.03x
▲ VercelNext.js (Turbopack)7.483s (+4.0%)10.018s (+11.7% 🔺)2.535s121.20x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.160s (~)2.005s (~)0.010s (+2.0%)2.018s (~)0.858s101.00x
💻 LocalExpress1.170s (~)2.005s (~)0.012s (+1.6%)2.020s (~)0.850s101.01x
🐘 PostgresExpress1.174s (~)1.998s (~)0.001s (+27.3% 🔺)2.010s (~)0.837s101.01x
🐘 PostgresNitro1.178s (-1.7%)1.997s (~)0.001s (~)2.010s (~)0.832s101.02x
🐘 PostgresNext.js (Turbopack)1.226s (-1.4%)2.002s (~)0.001s (-16.7% 🟢)2.011s (~)0.784s101.06x
💻 LocalNext.js (Turbopack)1.228s (-1.7%)2.003s (~)0.011s (-1.9%)2.018s (~)0.790s101.06x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.527s (-5.8% 🟢)3.723s (-0.6%)1.524s (+82.0% 🔺)5.771s (+13.5% 🔺)3.244s101.00x
▲ VercelNitro2.557s (~)3.645s (-1.8%)1.154s (+55.9% 🔺)5.296s (+6.7% 🔺)2.738s101.01x
▲ VercelExpress2.620s (+10.9% 🔺)3.621s (+2.6%)1.247s (+77.3% 🔺)5.373s (+12.2% 🔺)2.754s101.04x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.578s (+0.7%)2.010s (~)0.013s (+14.6% 🔺)2.025s (~)0.448s301.00x
🐘 PostgresExpress1.603s (~)2.005s (~)0.005s (+2.7%)2.027s (~)0.424s301.02x
🐘 PostgresNitro1.608s (-1.9%)2.007s (~)0.005s (+0.6%)2.028s (~)0.420s301.02x
💻 LocalExpress1.611s (~)2.011s (~)0.013s (+6.2% 🔺)2.026s (~)0.416s301.02x
💻 LocalNext.js (Turbopack)1.735s (-0.7%)2.008s (~)0.011s (-17.3% 🟢)2.023s (~)0.288s301.10x
🐘 PostgresNext.js (Turbopack)1.761s (-1.7%)2.011s (~)0.005s (-3.6%)2.026s (~)0.265s301.12x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express6.370s (-7.7% 🟢)7.860s (-5.9% 🟢)0.277s (-19.6% 🟢)8.601s (-6.8% 🟢)2.231s71.00x
▲ VercelNext.js (Turbopack)6.386s (-7.0% 🟢)8.159s (-4.9%)0.282s (-9.9% 🟢)8.937s (-4.7%)2.551s71.00x
▲ VercelNitro6.476s (-3.8%)7.838s (-2.6%)0.234s (+6.5% 🔺)8.506s (-3.4%)2.030s81.02x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.782s (-3.8%)1.047s (-1.6%)0.000s (+194.7% 🔺)1.064s (-1.5%)0.282s571.00x
🐘 PostgresExpress0.802s (+0.6%)1.050s (~)0.000s (NaN%)1.082s (+2.0%)0.280s561.03x
🐘 PostgresNext.js (Turbopack)0.975s (-5.1% 🟢)1.418s (-12.5% 🟢)0.000s (-100.0% 🟢)1.426s (-12.5% 🟢)0.451s431.25x
💻 LocalExpress1.466s (+3.3%)2.013s (~)0.000s (-28.6% 🟢)2.015s (~)0.549s301.88x
💻 LocalNitro1.535s (+13.6% 🔺)2.015s (~)0.000s (~)2.017s (~)0.482s301.96x
💻 LocalNext.js (Turbopack)1.539s (+1.7%)2.013s (~)0.000s (-9.1% 🟢)2.017s (~)0.478s301.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)3.032s (-19.5% 🟢)4.491s (-15.8% 🟢)0.000s (-100.0% 🟢)4.989s (-15.2% 🟢)1.957s131.00x
▲ VercelNitro3.082s (-25.0% 🟢)4.281s (-25.5% 🟢)0.000s (+Infinity% 🔺)4.733s (-24.2% 🟢)1.651s131.02x
▲ VercelExpress3.181s (-13.9% 🟢)4.530s (-7.6% 🟢)0.000s (+Infinity% 🔺)5.012s (-9.8% 🟢)1.831s121.05x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.593s (-3.6%)2.137s (-1.8%)0.000s (+Infinity% 🔺)2.152s (-1.6%)0.559s281.00x
🐘 PostgresNitro1.736s (+2.5%)2.253s (+3.6%)0.000s (-48.1% 🟢)2.272s (+3.6%)0.536s271.09x
🐘 PostgresNext.js (Turbopack)2.135s (-5.3% 🟢)2.653s (-2.8%)0.000s (NaN%)2.662s (-2.8%)0.526s231.34x
💻 LocalNext.js (Turbopack)3.046s (+7.4% 🔺)3.468s (+1.5%)0.000s (-11.1% 🟢)3.476s (+1.7%)0.430s181.91x
💻 LocalNitro3.322s (+7.8% 🔺)3.893s (~)0.001s (+28.6% 🔺)3.906s (~)0.583s162.09x
💻 LocalExpress3.347s (+0.9%)4.028s (~)0.000s (-53.3% 🟢)4.030s (~)0.683s152.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro5.059s (+2.8%)6.517s (+5.7% 🔺)0.000s (NaN%)7.047s (+3.6%)1.988s91.00x
▲ VercelExpress5.187s (-14.5% 🟢)6.629s (-12.7% 🟢)0.006s (+655.6% 🔺)7.277s (-11.1% 🟢)2.090s91.03x
▲ VercelNext.js (Turbopack)5.652s (-20.0% 🟢)7.189s (-12.6% 🟢)0.000s (-100.0% 🟢)7.744s (-11.6% 🟢)2.091s81.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNitro11/21
🐘 PostgresNitro11/21
▲ VercelNitro11/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres16/21
Nitro🐘 Postgres16/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​@​astrojs/​node@​10.1.41001008297100
Addednpm/​@​astrojs/​vercel@​10.0.81001008397100
Addednpm/​astro@​6.4.6881008898100

View full report

@pranaygp
pranaygp merged commit b92dfbb into mainJun 16, 2026
121 checks passed
@pranaygp
pranaygp deleted the pgp/issue-fix branch June 16, 2026 21:18
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
github-actionsBot added a commit that referenced this pull request Jun 16, 2026
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2461. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 16, 2026
…2461)
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
pranaygp added a commit that referenced this pull request Jun 16, 2026
* origin/main:
fix(core): make deploymentId 'latest' a no-op in non-Vercel worlds (#2397)
fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457)
Small detail panel cleanup (#2459)
Fix lazy Next workflow HMR (#2438)
Prevent peer dependency-only major bumps (#2437)
fix(changesets): only major-bump peer dependents when out of range (#2439)
Version Packages (beta) (#2428)
otel: explicit traceparent injection + linked-trace mode for bounded per-invocation traces (#2363)
[next] Clarify `serverExternalPackages` warning (#2417)
Add .swc gitignore handling to builder (#2427)
Version Packages (beta) (#2390)
[ci] Increase dev.test.ts cleanup hook timeout (#2416)
[world-vercel] Switch event endpoints to v4 wire format (#2055)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@karthikscale3
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 - #2457

Merged
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix
Jun 16, 2026
Merged

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299#2457
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

Resolves VULN-11836CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, High): Host header SSRF in prerendered error page fetch in astro.

The advisory's only patched version is astro 6.4.6 (< 6.4.6 is vulnerable) — there is no 5.x backport, so the fix requires moving to the 6.x line.

Changes

  • workbench/astro (the flagged app, resolved to astro@5.16.3):
    • astro^5.15.6^6.4.6
    • @astrojs/node9.5.010.1.4 (astro 6 peer compat)
    • @astrojs/vercel^9.0.0^10.0.8 (astro 6 peer compat)
  • packages/astro (@workflow/astro): astro devDependency 5.18.06.4.6 (typecheck-only, not shipped) — clears the last vulnerable astro from the lockfile.

After the bump the lockfile contains only astro@6.4.6 — both astro@5.16.3 and astro@5.18.0 are gone.

Notes

  • Pinned 6.4.6 rather than the latest 6.4.7 because the repo's minimumReleaseAge (48h) guard blocks 6.4.7 (published <48h ago); 6.4.6 is the advisory's patched version.
  • astro 6 requires Node >=22.12.0; CI runs node 22.x/24.x, so this is satisfied.

Verification

  • @workflow/astro integration typechecks (tsc) against astro 6.4.6.
  • workbench/astro builds cleanly under both the @astrojs/node (local/CI) and @astrojs/vercel (deploy) adapter paths.

🤖 Generated with Claude Code

Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CopilotAI review requested due to automatic review settings June 16, 2026 19:19
@pranaygp
pranaygp requested a review from a team as a code ownerJune 16, 2026 19:19
@vercel

vercelBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: e6702f6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/astroPatch
workflowPatch
@workflow/world-testingPatch
@workflow/corePatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

All tests passed

Summary

PassedFailedSkippedTotal
✅ ▲ Vercel Production144202191661
✅ 💻 Local Development189502192114
✅ 📦 Local Production189502192114
✅ 🐘 Local Postgres188102332114
✅ 🪟 Windows15100151
✅ 📋 Other87901781057
Total8143010689211

Details by Category

✅ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro125026
✅ example125026
✅ express125026
✅ fastify125026
✅ hono125026
✅ nextjs-turbopack14902
✅ nextjs-webpack14902
✅ nitro125026
✅ nuxt125026
✅ sveltekit14407
✅ vite125026
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable125026
✅ express-stable125026
✅ fastify-stable125026
✅ hono-stable125026
✅ nextjs-turbopack-canary131020
✅ nextjs-turbopack-stable-lazy-discovery-disabled15001
✅ nextjs-turbopack-stable-lazy-discovery-enabled15001
✅ nextjs-webpack-canary131020
✅ nextjs-webpack-stable-lazy-discovery-disabled15001
✅ nextjs-webpack-stable-lazy-discovery-enabled15001
✅ nitro-stable125026
✅ nuxt-stable125026
✅ sveltekit-stable14407
✅ vite-stable125026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15100
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable126025
✅ e2e-local-dev-tanstack-start-126025
✅ e2e-local-postgres-nest-stable125026
✅ e2e-local-postgres-tanstack-start-125026
✅ e2e-local-prod-nest-stable126025
✅ e2e-local-prod-tanstack-start-126025
✅ e2e-vercel-prod-tanstack-start125026

📋 View full workflow run

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.045s (-6.4% 🟢)1.006s (~)0.960s101.00x
💻 LocalNitro0.047s (+12.2% 🔺)1.008s (~)0.961s101.04x
🐘 PostgresNitro0.062s (-4.5%)1.013s (~)0.951s101.37x
💻 LocalNext.js (Turbopack)0.063s (+2.8%)1.007s (~)0.944s101.38x
🐘 PostgresExpress0.063s (+3.1%)1.012s (~)0.949s101.39x
🐘 PostgresNext.js (Turbopack)0.068s (-6.3% 🟢)1.012s (~)0.944s101.51x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express0.321s (-71.0% 🟢)2.398s (-33.0% 🟢)2.077s101.00x
▲ VercelNext.js (Turbopack)0.325s (-83.6% 🟢)2.160s (-47.4% 🟢)1.836s101.01x
▲ VercelNitro0.355s (-40.9% 🟢)2.479s (-6.8% 🟢)2.125s101.10x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.094s (~)2.007s (~)0.913s101.00x
💻 LocalExpress1.107s (+0.7%)2.006s (~)0.899s101.01x
🐘 PostgresExpress1.108s (-0.6%)2.010s (~)0.902s101.01x
🐘 PostgresNitro1.114s (~)2.011s (~)0.897s101.02x
🐘 PostgresNext.js (Turbopack)1.139s (-1.6%)2.010s (~)0.871s101.04x
💻 LocalNext.js (Turbopack)1.143s (~)2.007s (~)0.864s101.04x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.843s (-34.7% 🟢)3.753s (-17.4% 🟢)1.911s101.00x
▲ VercelExpress1.853s (-30.9% 🟢)3.656s (-26.9% 🟢)1.804s101.01x
▲ VercelNext.js (Turbopack)1.862s (-30.6% 🟢)3.901s (-13.8% 🟢)2.039s101.01x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express10.539s (~)11.023s (~)0.484s31.00x
💻 LocalNitro10.551s (~)11.023s (~)0.472s31.00x
🐘 PostgresExpress10.560s (~)11.018s (~)0.458s31.00x
🐘 PostgresNitro10.573s (~)11.019s (~)0.446s31.00x
💻 LocalNext.js (Turbopack)10.809s (~)11.024s (~)0.214s31.03x
🐘 PostgresNext.js (Turbopack)10.889s (~)11.352s (+3.0%)0.462s31.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro14.280s (-21.4% 🟢)16.322s (-17.9% 🟢)2.043s21.00x
▲ VercelExpress14.736s (-9.4% 🟢)16.736s (-10.2% 🟢)1.999s21.03x
▲ VercelNext.js (Turbopack)14.834s (-30.7% 🟢)16.703s (-28.2% 🟢)1.869s21.04x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express13.791s (~)14.017s (~)0.226s51.00x
💻 LocalExpress13.820s (~)14.028s (~)0.208s51.00x
🐘 PostgresNitro13.823s (~)14.021s (~)0.198s51.00x
💻 LocalNitro13.849s (~)14.028s (~)0.179s51.00x
💻 LocalNext.js (Turbopack)14.360s (~)15.030s (~)0.670s41.04x
🐘 PostgresNext.js (Turbopack)14.490s (~)15.017s (~)0.527s41.05x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)23.277s (-24.4% 🟢)25.483s (-22.4% 🟢)2.206s31.00x
▲ VercelExpress23.554s (-32.5% 🟢)25.626s (-30.6% 🟢)2.072s31.01x
▲ VercelNitro23.646s (-28.3% 🟢)25.447s (-27.0% 🟢)1.801s31.02x

🔍 Observability: Next.js (Turbopack) | Express | Nitro

workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.466s (-1.7%)13.016s (~)0.549s71.00x
💻 LocalNitro12.523s (~)13.025s (~)0.502s71.00x
💻 LocalExpress12.597s (~)13.027s (~)0.431s71.01x
🐘 PostgresExpress12.831s (+1.9%)13.303s (+2.2%)0.472s71.03x
💻 LocalNext.js (Turbopack)13.682s (~)14.027s (~)0.345s71.10x
🐘 PostgresNext.js (Turbopack)13.752s (-1.6%)14.019s (-1.0%)0.268s71.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express33.719s (-3.0%)36.136s (-2.6%)2.417s31.00x
▲ VercelNext.js (Turbopack)34.038s (-3.1%)36.769s (-2.0%)2.731s31.01x
▲ VercelNitro37.427s (-1.3%)40.332s (+2.1%)2.905s31.11x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.212s (+0.5%)2.008s (~)0.796s151.00x
💻 LocalExpress1.212s (+1.7%)2.007s (~)0.795s151.00x
🐘 PostgresNitro1.213s (~)2.008s (~)0.794s151.00x
💻 LocalNitro1.248s (+7.3% 🔺)2.006s (~)0.758s151.03x
🐘 PostgresNext.js (Turbopack)1.303s (-4.0%)2.007s (-3.3%)0.704s151.08x
💻 LocalNext.js (Turbopack)1.366s (+2.8%)2.006s (~)0.640s151.13x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.318s (-25.0% 🟢)3.899s (-15.0% 🟢)1.581s81.00x
▲ VercelNext.js (Turbopack)2.378s (+1.3%)3.969s (-1.2%)1.591s81.03x
▲ VercelExpress2.454s (-3.8%)3.990s (-2.0%)1.536s81.06x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.334s (-0.6%)2.592s (+3.3%)1.258s121.00x
🐘 PostgresExpress1.407s (+3.6%)2.393s (-4.6%)0.986s131.05x
🐘 PostgresNext.js (Turbopack)1.592s (-2.8%)2.294s (-8.6% 🟢)0.702s141.19x
💻 LocalNext.js (Turbopack)1.600s (~)2.006s (~)0.406s151.20x
💻 LocalNitro1.711s (+5.0% 🔺)2.006s (~)0.295s151.28x
💻 LocalExpress2.065s (+9.0% 🔺)2.471s (+14.8% 🔺)0.406s131.55x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.392s (-17.6% 🟢)5.282s (-12.8% 🟢)1.890s71.00x
▲ VercelNitro3.657s (-3.0%)5.390s (~)1.732s61.08x
▲ VercelNext.js (Turbopack)3.834s (+9.4% 🔺)5.777s (+10.0% 🔺)1.943s61.13x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.653s (+1.9%)4.014s (+3.3%)2.361s81.00x
🐘 PostgresNitro1.727s (+6.3% 🔺)4.012s (-3.1%)2.285s81.04x
🐘 PostgresNext.js (Turbopack)2.772s (-27.6% 🟢)3.760s (-15.4% 🟢)0.988s81.68x
💻 LocalNext.js (Turbopack)4.577s (~)5.178s (~)0.602s62.77x
💻 LocalNitro4.749s (+18.1% 🔺)5.179s (+13.0% 🔺)0.430s62.87x
💻 LocalExpress5.519s (+5.4% 🔺)5.845s (~)0.326s63.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express5.467s (+19.5% 🔺)7.579s (+15.5% 🔺)2.112s41.00x
▲ VercelNext.js (Turbopack)6.098s (+61.0% 🔺)7.907s (+46.2% 🔺)1.808s41.12x
▲ VercelNitro6.220s (+46.5% 🔺)8.628s (+50.6% 🔺)2.408s41.14x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.195s (-2.2%)2.007s (~)0.812s151.00x
🐘 PostgresExpress1.208s (~)2.007s (~)0.799s151.01x
🐘 PostgresNext.js (Turbopack)1.304s (+1.4%)2.008s (~)0.704s151.09x
💻 LocalNext.js (Turbopack)1.384s (~)2.006s (~)0.622s151.16x
💻 LocalNitro1.547s (+2.4%)2.006s (~)0.460s151.29x
💻 LocalExpress1.578s (-2.2%)2.007s (~)0.429s151.32x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.405s (+4.3%)3.820s (-3.2%)1.415s81.00x
▲ VercelNitro2.423s (-62.6% 🟢)3.700s (-53.9% 🟢)1.278s91.01x
▲ VercelExpress2.461s (+8.2% 🔺)4.085s (+6.0% 🔺)1.624s81.02x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.350s (-3.3%)2.509s (+1.6%)1.160s121.00x
🐘 PostgresNitro1.364s (+0.5%)2.317s (-10.6% 🟢)0.953s131.01x
🐘 PostgresNext.js (Turbopack)1.545s (+0.5%)2.221s (~)0.676s141.14x
💻 LocalNitro1.887s (+5.4% 🔺)2.315s (+11.7% 🔺)0.428s131.40x
💻 LocalNext.js (Turbopack)2.020s (+4.6%)2.591s (+16.6% 🔺)0.571s121.50x
💻 LocalExpress2.186s (-15.1% 🟢)2.591s (-16.6% 🟢)0.405s121.62x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.686s (-28.3% 🟢)3.995s (-26.8% 🟢)1.308s81.00x
▲ VercelNext.js (Turbopack)3.121s (-22.2% 🟢)5.152s (-10.3% 🟢)2.031s61.16x
▲ VercelExpress3.368s (+1.1%)4.862s (-9.0% 🟢)1.494s71.25x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.642s (-5.0%)4.299s (+10.6% 🔺)2.656s71.00x
🐘 PostgresExpress1.693s (-3.4%)4.012s (-3.0%)2.319s81.03x
🐘 PostgresNext.js (Turbopack)2.857s (-25.6% 🟢)4.013s (-9.7% 🟢)1.156s81.74x
💻 LocalNext.js (Turbopack)5.016s (-5.2% 🟢)5.515s (-8.3% 🟢)0.499s63.05x
💻 LocalExpress5.795s (-8.6% 🟢)6.216s (-11.4% 🟢)0.420s53.53x
💻 LocalNitro6.023s (+26.5% 🔺)6.819s (+27.5% 🔺)0.796s53.67x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro4.371s (-33.7% 🟢)6.186s (-25.9% 🟢)1.815s51.00x
▲ VercelNext.js (Turbopack)5.040s (+2.3%)7.308s (+12.5% 🔺)2.268s51.15x
▲ VercelExpress5.213s (~)7.552s (+8.4% 🔺)2.338s41.19x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.583s (-9.5% 🟢)1.023s (-1.8%)0.440s591.00x
🐘 PostgresExpress0.587s (-0.8%)1.023s (+1.7%)0.436s591.01x
💻 LocalNitro0.601s (+3.1%)1.005s (~)0.404s601.03x
💻 LocalExpress0.663s (+0.6%)1.022s (-1.7%)0.359s591.14x
🐘 PostgresNext.js (Turbopack)0.817s (-3.8%)1.006s (-1.7%)0.189s601.40x
💻 LocalNext.js (Turbopack)0.878s (-0.8%)1.039s (-1.7%)0.161s581.50x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.186s (-26.9% 🟢)7.879s (-22.0% 🟢)1.693s81.00x
▲ VercelExpress6.507s (-1.1%)8.264s (-4.2%)1.757s81.05x
▲ VercelNext.js (Turbopack)6.927s (-6.6% 🟢)8.857s (-5.2% 🟢)1.930s71.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.372s (-5.1% 🟢)2.052s (+2.2%)0.680s441.00x
🐘 PostgresExpress1.430s (~)2.053s (+1.1%)0.622s441.04x
💻 LocalNitro1.508s (+2.1%)2.006s (~)0.498s451.10x
💻 LocalExpress1.588s (~)2.007s (~)0.419s451.16x
🐘 PostgresNext.js (Turbopack)1.941s (-4.7%)2.151s (-16.1% 🟢)0.210s421.41x
💻 LocalNext.js (Turbopack)2.145s (+0.8%)3.009s (~)0.864s301.56x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro15.095s (-19.6% 🟢)17.268s (-16.8% 🟢)2.174s61.00x
▲ VercelNext.js (Turbopack)15.916s (-20.1% 🟢)18.292s (-18.3% 🟢)2.376s51.05x
▲ VercelExpress16.686s (-17.1% 🟢)18.647s (-14.7% 🟢)1.961s51.11x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express2.727s (-1.9%)3.086s (-1.6%)0.359s391.00x
🐘 PostgresNitro2.976s (+5.5% 🔺)3.397s (+8.3% 🔺)0.422s361.09x
💻 LocalNitro3.313s (+4.6%)4.043s (+3.3%)0.730s301.21x
💻 LocalExpress3.405s (+1.9%)4.011s (~)0.606s301.25x
🐘 PostgresNext.js (Turbopack)3.831s (-4.8%)4.110s (-6.7% 🟢)0.279s301.40x
💻 LocalNext.js (Turbopack)4.575s (+0.8%)5.053s (~)0.478s241.68x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro30.084s (-17.0% 🟢)32.889s (-13.9% 🟢)2.806s41.00x
▲ VercelExpress30.093s (-22.2% 🟢)32.724s (-19.0% 🟢)2.631s41.00x
▲ VercelNext.js (Turbopack)33.218s (-26.0% 🟢)36.130s (-22.6% 🟢)2.912s41.10x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.244s (-6.4% 🟢)1.006s (~)0.762s601.00x
🐘 PostgresExpress0.250s (-4.2%)1.006s (~)0.756s601.02x
🐘 PostgresNext.js (Turbopack)0.311s (+0.8%)1.006s (~)0.696s601.27x
💻 LocalNitro0.454s (+5.2% 🔺)1.005s (~)0.551s601.86x
💻 LocalExpress0.462s (+8.0% 🔺)1.005s (~)0.543s601.89x
💻 LocalNext.js (Turbopack)0.564s (-12.7% 🟢)1.005s (-5.1% 🟢)0.441s602.31x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.833s (-36.5% 🟢)3.794s (-24.6% 🟢)1.962s161.00x
▲ VercelNext.js (Turbopack)2.203s (-28.3% 🟢)4.190s (-16.4% 🟢)1.986s151.20x
▲ VercelExpress2.247s (-37.1% 🟢)4.134s (-26.0% 🟢)1.887s151.23x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.400s (-12.6% 🟢)1.006s (-6.7% 🟢)0.606s901.00x
🐘 PostgresExpress0.423s (+2.8%)1.041s (+3.4%)0.618s871.06x
🐘 PostgresNext.js (Turbopack)0.618s (-8.8% 🟢)1.240s (-2.8%)0.622s731.55x
💻 LocalNitro2.184s (+8.6% 🔺)2.767s (+13.4% 🔺)0.584s335.46x
💻 LocalExpress2.245s (+2.5%)2.913s (+2.1%)0.668s315.62x
💻 LocalNext.js (Turbopack)2.497s (-2.4%)3.224s (-1.1%)0.728s286.25x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.219s (-37.6% 🟢)4.988s (-30.9% 🟢)1.769s191.00x
▲ VercelNitro3.388s (-2.8%)5.242s (+1.4%)1.854s181.05x
▲ VercelNext.js (Turbopack)3.690s (-3.0%)5.812s (+1.3%)2.122s161.15x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.798s (-5.3% 🟢)1.326s (-9.9% 🟢)0.528s911.00x
🐘 PostgresExpress0.824s (-2.8%)1.352s (-10.3% 🟢)0.528s901.03x
🐘 PostgresNext.js (Turbopack)2.866s (-7.2% 🟢)3.681s (-3.8%)0.816s333.59x
💻 LocalNitro9.345s (+7.1% 🔺)10.032s (+8.4% 🔺)0.687s1211.71x
💻 LocalExpress9.995s (+1.3%)10.696s (+4.0%)0.701s1212.52x
💻 LocalNext.js (Turbopack)11.013s (+5.0%)11.850s (+4.0%)0.837s1113.80x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.218s (-7.9% 🟢)8.141s (-5.7% 🟢)1.922s151.00x
▲ VercelExpress6.430s (-5.9% 🟢)8.691s (+0.8%)2.261s141.03x
▲ VercelNext.js (Turbopack)7.483s (+4.0%)10.018s (+11.7% 🔺)2.535s121.20x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.160s (~)2.005s (~)0.010s (+2.0%)2.018s (~)0.858s101.00x
💻 LocalExpress1.170s (~)2.005s (~)0.012s (+1.6%)2.020s (~)0.850s101.01x
🐘 PostgresExpress1.174s (~)1.998s (~)0.001s (+27.3% 🔺)2.010s (~)0.837s101.01x
🐘 PostgresNitro1.178s (-1.7%)1.997s (~)0.001s (~)2.010s (~)0.832s101.02x
🐘 PostgresNext.js (Turbopack)1.226s (-1.4%)2.002s (~)0.001s (-16.7% 🟢)2.011s (~)0.784s101.06x
💻 LocalNext.js (Turbopack)1.228s (-1.7%)2.003s (~)0.011s (-1.9%)2.018s (~)0.790s101.06x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.527s (-5.8% 🟢)3.723s (-0.6%)1.524s (+82.0% 🔺)5.771s (+13.5% 🔺)3.244s101.00x
▲ VercelNitro2.557s (~)3.645s (-1.8%)1.154s (+55.9% 🔺)5.296s (+6.7% 🔺)2.738s101.01x
▲ VercelExpress2.620s (+10.9% 🔺)3.621s (+2.6%)1.247s (+77.3% 🔺)5.373s (+12.2% 🔺)2.754s101.04x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.578s (+0.7%)2.010s (~)0.013s (+14.6% 🔺)2.025s (~)0.448s301.00x
🐘 PostgresExpress1.603s (~)2.005s (~)0.005s (+2.7%)2.027s (~)0.424s301.02x
🐘 PostgresNitro1.608s (-1.9%)2.007s (~)0.005s (+0.6%)2.028s (~)0.420s301.02x
💻 LocalExpress1.611s (~)2.011s (~)0.013s (+6.2% 🔺)2.026s (~)0.416s301.02x
💻 LocalNext.js (Turbopack)1.735s (-0.7%)2.008s (~)0.011s (-17.3% 🟢)2.023s (~)0.288s301.10x
🐘 PostgresNext.js (Turbopack)1.761s (-1.7%)2.011s (~)0.005s (-3.6%)2.026s (~)0.265s301.12x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express6.370s (-7.7% 🟢)7.860s (-5.9% 🟢)0.277s (-19.6% 🟢)8.601s (-6.8% 🟢)2.231s71.00x
▲ VercelNext.js (Turbopack)6.386s (-7.0% 🟢)8.159s (-4.9%)0.282s (-9.9% 🟢)8.937s (-4.7%)2.551s71.00x
▲ VercelNitro6.476s (-3.8%)7.838s (-2.6%)0.234s (+6.5% 🔺)8.506s (-3.4%)2.030s81.02x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.782s (-3.8%)1.047s (-1.6%)0.000s (+194.7% 🔺)1.064s (-1.5%)0.282s571.00x
🐘 PostgresExpress0.802s (+0.6%)1.050s (~)0.000s (NaN%)1.082s (+2.0%)0.280s561.03x
🐘 PostgresNext.js (Turbopack)0.975s (-5.1% 🟢)1.418s (-12.5% 🟢)0.000s (-100.0% 🟢)1.426s (-12.5% 🟢)0.451s431.25x
💻 LocalExpress1.466s (+3.3%)2.013s (~)0.000s (-28.6% 🟢)2.015s (~)0.549s301.88x
💻 LocalNitro1.535s (+13.6% 🔺)2.015s (~)0.000s (~)2.017s (~)0.482s301.96x
💻 LocalNext.js (Turbopack)1.539s (+1.7%)2.013s (~)0.000s (-9.1% 🟢)2.017s (~)0.478s301.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)3.032s (-19.5% 🟢)4.491s (-15.8% 🟢)0.000s (-100.0% 🟢)4.989s (-15.2% 🟢)1.957s131.00x
▲ VercelNitro3.082s (-25.0% 🟢)4.281s (-25.5% 🟢)0.000s (+Infinity% 🔺)4.733s (-24.2% 🟢)1.651s131.02x
▲ VercelExpress3.181s (-13.9% 🟢)4.530s (-7.6% 🟢)0.000s (+Infinity% 🔺)5.012s (-9.8% 🟢)1.831s121.05x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.593s (-3.6%)2.137s (-1.8%)0.000s (+Infinity% 🔺)2.152s (-1.6%)0.559s281.00x
🐘 PostgresNitro1.736s (+2.5%)2.253s (+3.6%)0.000s (-48.1% 🟢)2.272s (+3.6%)0.536s271.09x
🐘 PostgresNext.js (Turbopack)2.135s (-5.3% 🟢)2.653s (-2.8%)0.000s (NaN%)2.662s (-2.8%)0.526s231.34x
💻 LocalNext.js (Turbopack)3.046s (+7.4% 🔺)3.468s (+1.5%)0.000s (-11.1% 🟢)3.476s (+1.7%)0.430s181.91x
💻 LocalNitro3.322s (+7.8% 🔺)3.893s (~)0.001s (+28.6% 🔺)3.906s (~)0.583s162.09x
💻 LocalExpress3.347s (+0.9%)4.028s (~)0.000s (-53.3% 🟢)4.030s (~)0.683s152.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro5.059s (+2.8%)6.517s (+5.7% 🔺)0.000s (NaN%)7.047s (+3.6%)1.988s91.00x
▲ VercelExpress5.187s (-14.5% 🟢)6.629s (-12.7% 🟢)0.006s (+655.6% 🔺)7.277s (-11.1% 🟢)2.090s91.03x
▲ VercelNext.js (Turbopack)5.652s (-20.0% 🟢)7.189s (-12.6% 🟢)0.000s (-100.0% 🟢)7.744s (-11.6% 🟢)2.091s81.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNitro11/21
🐘 PostgresNitro11/21
▲ VercelNitro11/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres16/21
Nitro🐘 Postgres16/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​@​astrojs/​node@​10.1.41001008297100
Addednpm/​@​astrojs/​vercel@​10.0.81001008397100
Addednpm/​astro@​6.4.6881008898100

View full report

@pranaygp
pranaygp merged commit b92dfbb into mainJun 16, 2026
121 checks passed
@pranaygp
pranaygp deleted the pgp/issue-fix branch June 16, 2026 21:18
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
github-actionsBot added a commit that referenced this pull request Jun 16, 2026
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2461. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 16, 2026
…2461)
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
pranaygp added a commit that referenced this pull request Jun 16, 2026
* origin/main:
fix(core): make deploymentId 'latest' a no-op in non-Vercel worlds (#2397)
fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457)
Small detail panel cleanup (#2459)
Fix lazy Next workflow HMR (#2438)
Prevent peer dependency-only major bumps (#2437)
fix(changesets): only major-bump peer dependents when out of range (#2439)
Version Packages (beta) (#2428)
otel: explicit traceparent injection + linked-trace mode for bounded per-invocation traces (#2363)
[next] Clarify `serverExternalPackages` warning (#2417)
Add .swc gitignore handling to builder (#2427)
Version Packages (beta) (#2390)
[ci] Increase dev.test.ts cleanup hook timeout (#2416)
[world-vercel] Switch event endpoints to v4 wire format (#2055)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@karthikscale3
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 - #2457

Merged
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix
Jun 16, 2026
Merged

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299#2457
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

Resolves VULN-11836CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, High): Host header SSRF in prerendered error page fetch in astro.

The advisory's only patched version is astro 6.4.6 (< 6.4.6 is vulnerable) — there is no 5.x backport, so the fix requires moving to the 6.x line.

Changes

  • workbench/astro (the flagged app, resolved to astro@5.16.3):
    • astro^5.15.6^6.4.6
    • @astrojs/node9.5.010.1.4 (astro 6 peer compat)
    • @astrojs/vercel^9.0.0^10.0.8 (astro 6 peer compat)
  • packages/astro (@workflow/astro): astro devDependency 5.18.06.4.6 (typecheck-only, not shipped) — clears the last vulnerable astro from the lockfile.

After the bump the lockfile contains only astro@6.4.6 — both astro@5.16.3 and astro@5.18.0 are gone.

Notes

  • Pinned 6.4.6 rather than the latest 6.4.7 because the repo's minimumReleaseAge (48h) guard blocks 6.4.7 (published <48h ago); 6.4.6 is the advisory's patched version.
  • astro 6 requires Node >=22.12.0; CI runs node 22.x/24.x, so this is satisfied.

Verification

  • @workflow/astro integration typechecks (tsc) against astro 6.4.6.
  • workbench/astro builds cleanly under both the @astrojs/node (local/CI) and @astrojs/vercel (deploy) adapter paths.

🤖 Generated with Claude Code

Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CopilotAI review requested due to automatic review settings June 16, 2026 19:19
@pranaygp
pranaygp requested a review from a team as a code ownerJune 16, 2026 19:19
@vercel

vercelBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: e6702f6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/astroPatch
workflowPatch
@workflow/world-testingPatch
@workflow/corePatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

All tests passed

Summary

PassedFailedSkippedTotal
✅ ▲ Vercel Production144202191661
✅ 💻 Local Development189502192114
✅ 📦 Local Production189502192114
✅ 🐘 Local Postgres188102332114
✅ 🪟 Windows15100151
✅ 📋 Other87901781057
Total8143010689211

Details by Category

✅ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro125026
✅ example125026
✅ express125026
✅ fastify125026
✅ hono125026
✅ nextjs-turbopack14902
✅ nextjs-webpack14902
✅ nitro125026
✅ nuxt125026
✅ sveltekit14407
✅ vite125026
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable125026
✅ express-stable125026
✅ fastify-stable125026
✅ hono-stable125026
✅ nextjs-turbopack-canary131020
✅ nextjs-turbopack-stable-lazy-discovery-disabled15001
✅ nextjs-turbopack-stable-lazy-discovery-enabled15001
✅ nextjs-webpack-canary131020
✅ nextjs-webpack-stable-lazy-discovery-disabled15001
✅ nextjs-webpack-stable-lazy-discovery-enabled15001
✅ nitro-stable125026
✅ nuxt-stable125026
✅ sveltekit-stable14407
✅ vite-stable125026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15100
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable126025
✅ e2e-local-dev-tanstack-start-126025
✅ e2e-local-postgres-nest-stable125026
✅ e2e-local-postgres-tanstack-start-125026
✅ e2e-local-prod-nest-stable126025
✅ e2e-local-prod-tanstack-start-126025
✅ e2e-vercel-prod-tanstack-start125026

📋 View full workflow run

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.045s (-6.4% 🟢)1.006s (~)0.960s101.00x
💻 LocalNitro0.047s (+12.2% 🔺)1.008s (~)0.961s101.04x
🐘 PostgresNitro0.062s (-4.5%)1.013s (~)0.951s101.37x
💻 LocalNext.js (Turbopack)0.063s (+2.8%)1.007s (~)0.944s101.38x
🐘 PostgresExpress0.063s (+3.1%)1.012s (~)0.949s101.39x
🐘 PostgresNext.js (Turbopack)0.068s (-6.3% 🟢)1.012s (~)0.944s101.51x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express0.321s (-71.0% 🟢)2.398s (-33.0% 🟢)2.077s101.00x
▲ VercelNext.js (Turbopack)0.325s (-83.6% 🟢)2.160s (-47.4% 🟢)1.836s101.01x
▲ VercelNitro0.355s (-40.9% 🟢)2.479s (-6.8% 🟢)2.125s101.10x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.094s (~)2.007s (~)0.913s101.00x
💻 LocalExpress1.107s (+0.7%)2.006s (~)0.899s101.01x
🐘 PostgresExpress1.108s (-0.6%)2.010s (~)0.902s101.01x
🐘 PostgresNitro1.114s (~)2.011s (~)0.897s101.02x
🐘 PostgresNext.js (Turbopack)1.139s (-1.6%)2.010s (~)0.871s101.04x
💻 LocalNext.js (Turbopack)1.143s (~)2.007s (~)0.864s101.04x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.843s (-34.7% 🟢)3.753s (-17.4% 🟢)1.911s101.00x
▲ VercelExpress1.853s (-30.9% 🟢)3.656s (-26.9% 🟢)1.804s101.01x
▲ VercelNext.js (Turbopack)1.862s (-30.6% 🟢)3.901s (-13.8% 🟢)2.039s101.01x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express10.539s (~)11.023s (~)0.484s31.00x
💻 LocalNitro10.551s (~)11.023s (~)0.472s31.00x
🐘 PostgresExpress10.560s (~)11.018s (~)0.458s31.00x
🐘 PostgresNitro10.573s (~)11.019s (~)0.446s31.00x
💻 LocalNext.js (Turbopack)10.809s (~)11.024s (~)0.214s31.03x
🐘 PostgresNext.js (Turbopack)10.889s (~)11.352s (+3.0%)0.462s31.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro14.280s (-21.4% 🟢)16.322s (-17.9% 🟢)2.043s21.00x
▲ VercelExpress14.736s (-9.4% 🟢)16.736s (-10.2% 🟢)1.999s21.03x
▲ VercelNext.js (Turbopack)14.834s (-30.7% 🟢)16.703s (-28.2% 🟢)1.869s21.04x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express13.791s (~)14.017s (~)0.226s51.00x
💻 LocalExpress13.820s (~)14.028s (~)0.208s51.00x
🐘 PostgresNitro13.823s (~)14.021s (~)0.198s51.00x
💻 LocalNitro13.849s (~)14.028s (~)0.179s51.00x
💻 LocalNext.js (Turbopack)14.360s (~)15.030s (~)0.670s41.04x
🐘 PostgresNext.js (Turbopack)14.490s (~)15.017s (~)0.527s41.05x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)23.277s (-24.4% 🟢)25.483s (-22.4% 🟢)2.206s31.00x
▲ VercelExpress23.554s (-32.5% 🟢)25.626s (-30.6% 🟢)2.072s31.01x
▲ VercelNitro23.646s (-28.3% 🟢)25.447s (-27.0% 🟢)1.801s31.02x

🔍 Observability: Next.js (Turbopack) | Express | Nitro

workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.466s (-1.7%)13.016s (~)0.549s71.00x
💻 LocalNitro12.523s (~)13.025s (~)0.502s71.00x
💻 LocalExpress12.597s (~)13.027s (~)0.431s71.01x
🐘 PostgresExpress12.831s (+1.9%)13.303s (+2.2%)0.472s71.03x
💻 LocalNext.js (Turbopack)13.682s (~)14.027s (~)0.345s71.10x
🐘 PostgresNext.js (Turbopack)13.752s (-1.6%)14.019s (-1.0%)0.268s71.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express33.719s (-3.0%)36.136s (-2.6%)2.417s31.00x
▲ VercelNext.js (Turbopack)34.038s (-3.1%)36.769s (-2.0%)2.731s31.01x
▲ VercelNitro37.427s (-1.3%)40.332s (+2.1%)2.905s31.11x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.212s (+0.5%)2.008s (~)0.796s151.00x
💻 LocalExpress1.212s (+1.7%)2.007s (~)0.795s151.00x
🐘 PostgresNitro1.213s (~)2.008s (~)0.794s151.00x
💻 LocalNitro1.248s (+7.3% 🔺)2.006s (~)0.758s151.03x
🐘 PostgresNext.js (Turbopack)1.303s (-4.0%)2.007s (-3.3%)0.704s151.08x
💻 LocalNext.js (Turbopack)1.366s (+2.8%)2.006s (~)0.640s151.13x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.318s (-25.0% 🟢)3.899s (-15.0% 🟢)1.581s81.00x
▲ VercelNext.js (Turbopack)2.378s (+1.3%)3.969s (-1.2%)1.591s81.03x
▲ VercelExpress2.454s (-3.8%)3.990s (-2.0%)1.536s81.06x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.334s (-0.6%)2.592s (+3.3%)1.258s121.00x
🐘 PostgresExpress1.407s (+3.6%)2.393s (-4.6%)0.986s131.05x
🐘 PostgresNext.js (Turbopack)1.592s (-2.8%)2.294s (-8.6% 🟢)0.702s141.19x
💻 LocalNext.js (Turbopack)1.600s (~)2.006s (~)0.406s151.20x
💻 LocalNitro1.711s (+5.0% 🔺)2.006s (~)0.295s151.28x
💻 LocalExpress2.065s (+9.0% 🔺)2.471s (+14.8% 🔺)0.406s131.55x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.392s (-17.6% 🟢)5.282s (-12.8% 🟢)1.890s71.00x
▲ VercelNitro3.657s (-3.0%)5.390s (~)1.732s61.08x
▲ VercelNext.js (Turbopack)3.834s (+9.4% 🔺)5.777s (+10.0% 🔺)1.943s61.13x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.653s (+1.9%)4.014s (+3.3%)2.361s81.00x
🐘 PostgresNitro1.727s (+6.3% 🔺)4.012s (-3.1%)2.285s81.04x
🐘 PostgresNext.js (Turbopack)2.772s (-27.6% 🟢)3.760s (-15.4% 🟢)0.988s81.68x
💻 LocalNext.js (Turbopack)4.577s (~)5.178s (~)0.602s62.77x
💻 LocalNitro4.749s (+18.1% 🔺)5.179s (+13.0% 🔺)0.430s62.87x
💻 LocalExpress5.519s (+5.4% 🔺)5.845s (~)0.326s63.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express5.467s (+19.5% 🔺)7.579s (+15.5% 🔺)2.112s41.00x
▲ VercelNext.js (Turbopack)6.098s (+61.0% 🔺)7.907s (+46.2% 🔺)1.808s41.12x
▲ VercelNitro6.220s (+46.5% 🔺)8.628s (+50.6% 🔺)2.408s41.14x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.195s (-2.2%)2.007s (~)0.812s151.00x
🐘 PostgresExpress1.208s (~)2.007s (~)0.799s151.01x
🐘 PostgresNext.js (Turbopack)1.304s (+1.4%)2.008s (~)0.704s151.09x
💻 LocalNext.js (Turbopack)1.384s (~)2.006s (~)0.622s151.16x
💻 LocalNitro1.547s (+2.4%)2.006s (~)0.460s151.29x
💻 LocalExpress1.578s (-2.2%)2.007s (~)0.429s151.32x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.405s (+4.3%)3.820s (-3.2%)1.415s81.00x
▲ VercelNitro2.423s (-62.6% 🟢)3.700s (-53.9% 🟢)1.278s91.01x
▲ VercelExpress2.461s (+8.2% 🔺)4.085s (+6.0% 🔺)1.624s81.02x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.350s (-3.3%)2.509s (+1.6%)1.160s121.00x
🐘 PostgresNitro1.364s (+0.5%)2.317s (-10.6% 🟢)0.953s131.01x
🐘 PostgresNext.js (Turbopack)1.545s (+0.5%)2.221s (~)0.676s141.14x
💻 LocalNitro1.887s (+5.4% 🔺)2.315s (+11.7% 🔺)0.428s131.40x
💻 LocalNext.js (Turbopack)2.020s (+4.6%)2.591s (+16.6% 🔺)0.571s121.50x
💻 LocalExpress2.186s (-15.1% 🟢)2.591s (-16.6% 🟢)0.405s121.62x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.686s (-28.3% 🟢)3.995s (-26.8% 🟢)1.308s81.00x
▲ VercelNext.js (Turbopack)3.121s (-22.2% 🟢)5.152s (-10.3% 🟢)2.031s61.16x
▲ VercelExpress3.368s (+1.1%)4.862s (-9.0% 🟢)1.494s71.25x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.642s (-5.0%)4.299s (+10.6% 🔺)2.656s71.00x
🐘 PostgresExpress1.693s (-3.4%)4.012s (-3.0%)2.319s81.03x
🐘 PostgresNext.js (Turbopack)2.857s (-25.6% 🟢)4.013s (-9.7% 🟢)1.156s81.74x
💻 LocalNext.js (Turbopack)5.016s (-5.2% 🟢)5.515s (-8.3% 🟢)0.499s63.05x
💻 LocalExpress5.795s (-8.6% 🟢)6.216s (-11.4% 🟢)0.420s53.53x
💻 LocalNitro6.023s (+26.5% 🔺)6.819s (+27.5% 🔺)0.796s53.67x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro4.371s (-33.7% 🟢)6.186s (-25.9% 🟢)1.815s51.00x
▲ VercelNext.js (Turbopack)5.040s (+2.3%)7.308s (+12.5% 🔺)2.268s51.15x
▲ VercelExpress5.213s (~)7.552s (+8.4% 🔺)2.338s41.19x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.583s (-9.5% 🟢)1.023s (-1.8%)0.440s591.00x
🐘 PostgresExpress0.587s (-0.8%)1.023s (+1.7%)0.436s591.01x
💻 LocalNitro0.601s (+3.1%)1.005s (~)0.404s601.03x
💻 LocalExpress0.663s (+0.6%)1.022s (-1.7%)0.359s591.14x
🐘 PostgresNext.js (Turbopack)0.817s (-3.8%)1.006s (-1.7%)0.189s601.40x
💻 LocalNext.js (Turbopack)0.878s (-0.8%)1.039s (-1.7%)0.161s581.50x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.186s (-26.9% 🟢)7.879s (-22.0% 🟢)1.693s81.00x
▲ VercelExpress6.507s (-1.1%)8.264s (-4.2%)1.757s81.05x
▲ VercelNext.js (Turbopack)6.927s (-6.6% 🟢)8.857s (-5.2% 🟢)1.930s71.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.372s (-5.1% 🟢)2.052s (+2.2%)0.680s441.00x
🐘 PostgresExpress1.430s (~)2.053s (+1.1%)0.622s441.04x
💻 LocalNitro1.508s (+2.1%)2.006s (~)0.498s451.10x
💻 LocalExpress1.588s (~)2.007s (~)0.419s451.16x
🐘 PostgresNext.js (Turbopack)1.941s (-4.7%)2.151s (-16.1% 🟢)0.210s421.41x
💻 LocalNext.js (Turbopack)2.145s (+0.8%)3.009s (~)0.864s301.56x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro15.095s (-19.6% 🟢)17.268s (-16.8% 🟢)2.174s61.00x
▲ VercelNext.js (Turbopack)15.916s (-20.1% 🟢)18.292s (-18.3% 🟢)2.376s51.05x
▲ VercelExpress16.686s (-17.1% 🟢)18.647s (-14.7% 🟢)1.961s51.11x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express2.727s (-1.9%)3.086s (-1.6%)0.359s391.00x
🐘 PostgresNitro2.976s (+5.5% 🔺)3.397s (+8.3% 🔺)0.422s361.09x
💻 LocalNitro3.313s (+4.6%)4.043s (+3.3%)0.730s301.21x
💻 LocalExpress3.405s (+1.9%)4.011s (~)0.606s301.25x
🐘 PostgresNext.js (Turbopack)3.831s (-4.8%)4.110s (-6.7% 🟢)0.279s301.40x
💻 LocalNext.js (Turbopack)4.575s (+0.8%)5.053s (~)0.478s241.68x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro30.084s (-17.0% 🟢)32.889s (-13.9% 🟢)2.806s41.00x
▲ VercelExpress30.093s (-22.2% 🟢)32.724s (-19.0% 🟢)2.631s41.00x
▲ VercelNext.js (Turbopack)33.218s (-26.0% 🟢)36.130s (-22.6% 🟢)2.912s41.10x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.244s (-6.4% 🟢)1.006s (~)0.762s601.00x
🐘 PostgresExpress0.250s (-4.2%)1.006s (~)0.756s601.02x
🐘 PostgresNext.js (Turbopack)0.311s (+0.8%)1.006s (~)0.696s601.27x
💻 LocalNitro0.454s (+5.2% 🔺)1.005s (~)0.551s601.86x
💻 LocalExpress0.462s (+8.0% 🔺)1.005s (~)0.543s601.89x
💻 LocalNext.js (Turbopack)0.564s (-12.7% 🟢)1.005s (-5.1% 🟢)0.441s602.31x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.833s (-36.5% 🟢)3.794s (-24.6% 🟢)1.962s161.00x
▲ VercelNext.js (Turbopack)2.203s (-28.3% 🟢)4.190s (-16.4% 🟢)1.986s151.20x
▲ VercelExpress2.247s (-37.1% 🟢)4.134s (-26.0% 🟢)1.887s151.23x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.400s (-12.6% 🟢)1.006s (-6.7% 🟢)0.606s901.00x
🐘 PostgresExpress0.423s (+2.8%)1.041s (+3.4%)0.618s871.06x
🐘 PostgresNext.js (Turbopack)0.618s (-8.8% 🟢)1.240s (-2.8%)0.622s731.55x
💻 LocalNitro2.184s (+8.6% 🔺)2.767s (+13.4% 🔺)0.584s335.46x
💻 LocalExpress2.245s (+2.5%)2.913s (+2.1%)0.668s315.62x
💻 LocalNext.js (Turbopack)2.497s (-2.4%)3.224s (-1.1%)0.728s286.25x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.219s (-37.6% 🟢)4.988s (-30.9% 🟢)1.769s191.00x
▲ VercelNitro3.388s (-2.8%)5.242s (+1.4%)1.854s181.05x
▲ VercelNext.js (Turbopack)3.690s (-3.0%)5.812s (+1.3%)2.122s161.15x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.798s (-5.3% 🟢)1.326s (-9.9% 🟢)0.528s911.00x
🐘 PostgresExpress0.824s (-2.8%)1.352s (-10.3% 🟢)0.528s901.03x
🐘 PostgresNext.js (Turbopack)2.866s (-7.2% 🟢)3.681s (-3.8%)0.816s333.59x
💻 LocalNitro9.345s (+7.1% 🔺)10.032s (+8.4% 🔺)0.687s1211.71x
💻 LocalExpress9.995s (+1.3%)10.696s (+4.0%)0.701s1212.52x
💻 LocalNext.js (Turbopack)11.013s (+5.0%)11.850s (+4.0%)0.837s1113.80x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.218s (-7.9% 🟢)8.141s (-5.7% 🟢)1.922s151.00x
▲ VercelExpress6.430s (-5.9% 🟢)8.691s (+0.8%)2.261s141.03x
▲ VercelNext.js (Turbopack)7.483s (+4.0%)10.018s (+11.7% 🔺)2.535s121.20x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.160s (~)2.005s (~)0.010s (+2.0%)2.018s (~)0.858s101.00x
💻 LocalExpress1.170s (~)2.005s (~)0.012s (+1.6%)2.020s (~)0.850s101.01x
🐘 PostgresExpress1.174s (~)1.998s (~)0.001s (+27.3% 🔺)2.010s (~)0.837s101.01x
🐘 PostgresNitro1.178s (-1.7%)1.997s (~)0.001s (~)2.010s (~)0.832s101.02x
🐘 PostgresNext.js (Turbopack)1.226s (-1.4%)2.002s (~)0.001s (-16.7% 🟢)2.011s (~)0.784s101.06x
💻 LocalNext.js (Turbopack)1.228s (-1.7%)2.003s (~)0.011s (-1.9%)2.018s (~)0.790s101.06x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.527s (-5.8% 🟢)3.723s (-0.6%)1.524s (+82.0% 🔺)5.771s (+13.5% 🔺)3.244s101.00x
▲ VercelNitro2.557s (~)3.645s (-1.8%)1.154s (+55.9% 🔺)5.296s (+6.7% 🔺)2.738s101.01x
▲ VercelExpress2.620s (+10.9% 🔺)3.621s (+2.6%)1.247s (+77.3% 🔺)5.373s (+12.2% 🔺)2.754s101.04x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.578s (+0.7%)2.010s (~)0.013s (+14.6% 🔺)2.025s (~)0.448s301.00x
🐘 PostgresExpress1.603s (~)2.005s (~)0.005s (+2.7%)2.027s (~)0.424s301.02x
🐘 PostgresNitro1.608s (-1.9%)2.007s (~)0.005s (+0.6%)2.028s (~)0.420s301.02x
💻 LocalExpress1.611s (~)2.011s (~)0.013s (+6.2% 🔺)2.026s (~)0.416s301.02x
💻 LocalNext.js (Turbopack)1.735s (-0.7%)2.008s (~)0.011s (-17.3% 🟢)2.023s (~)0.288s301.10x
🐘 PostgresNext.js (Turbopack)1.761s (-1.7%)2.011s (~)0.005s (-3.6%)2.026s (~)0.265s301.12x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express6.370s (-7.7% 🟢)7.860s (-5.9% 🟢)0.277s (-19.6% 🟢)8.601s (-6.8% 🟢)2.231s71.00x
▲ VercelNext.js (Turbopack)6.386s (-7.0% 🟢)8.159s (-4.9%)0.282s (-9.9% 🟢)8.937s (-4.7%)2.551s71.00x
▲ VercelNitro6.476s (-3.8%)7.838s (-2.6%)0.234s (+6.5% 🔺)8.506s (-3.4%)2.030s81.02x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.782s (-3.8%)1.047s (-1.6%)0.000s (+194.7% 🔺)1.064s (-1.5%)0.282s571.00x
🐘 PostgresExpress0.802s (+0.6%)1.050s (~)0.000s (NaN%)1.082s (+2.0%)0.280s561.03x
🐘 PostgresNext.js (Turbopack)0.975s (-5.1% 🟢)1.418s (-12.5% 🟢)0.000s (-100.0% 🟢)1.426s (-12.5% 🟢)0.451s431.25x
💻 LocalExpress1.466s (+3.3%)2.013s (~)0.000s (-28.6% 🟢)2.015s (~)0.549s301.88x
💻 LocalNitro1.535s (+13.6% 🔺)2.015s (~)0.000s (~)2.017s (~)0.482s301.96x
💻 LocalNext.js (Turbopack)1.539s (+1.7%)2.013s (~)0.000s (-9.1% 🟢)2.017s (~)0.478s301.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)3.032s (-19.5% 🟢)4.491s (-15.8% 🟢)0.000s (-100.0% 🟢)4.989s (-15.2% 🟢)1.957s131.00x
▲ VercelNitro3.082s (-25.0% 🟢)4.281s (-25.5% 🟢)0.000s (+Infinity% 🔺)4.733s (-24.2% 🟢)1.651s131.02x
▲ VercelExpress3.181s (-13.9% 🟢)4.530s (-7.6% 🟢)0.000s (+Infinity% 🔺)5.012s (-9.8% 🟢)1.831s121.05x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.593s (-3.6%)2.137s (-1.8%)0.000s (+Infinity% 🔺)2.152s (-1.6%)0.559s281.00x
🐘 PostgresNitro1.736s (+2.5%)2.253s (+3.6%)0.000s (-48.1% 🟢)2.272s (+3.6%)0.536s271.09x
🐘 PostgresNext.js (Turbopack)2.135s (-5.3% 🟢)2.653s (-2.8%)0.000s (NaN%)2.662s (-2.8%)0.526s231.34x
💻 LocalNext.js (Turbopack)3.046s (+7.4% 🔺)3.468s (+1.5%)0.000s (-11.1% 🟢)3.476s (+1.7%)0.430s181.91x
💻 LocalNitro3.322s (+7.8% 🔺)3.893s (~)0.001s (+28.6% 🔺)3.906s (~)0.583s162.09x
💻 LocalExpress3.347s (+0.9%)4.028s (~)0.000s (-53.3% 🟢)4.030s (~)0.683s152.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro5.059s (+2.8%)6.517s (+5.7% 🔺)0.000s (NaN%)7.047s (+3.6%)1.988s91.00x
▲ VercelExpress5.187s (-14.5% 🟢)6.629s (-12.7% 🟢)0.006s (+655.6% 🔺)7.277s (-11.1% 🟢)2.090s91.03x
▲ VercelNext.js (Turbopack)5.652s (-20.0% 🟢)7.189s (-12.6% 🟢)0.000s (-100.0% 🟢)7.744s (-11.6% 🟢)2.091s81.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNitro11/21
🐘 PostgresNitro11/21
▲ VercelNitro11/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres16/21
Nitro🐘 Postgres16/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​@​astrojs/​node@​10.1.41001008297100
Addednpm/​@​astrojs/​vercel@​10.0.81001008397100
Addednpm/​astro@​6.4.6881008898100

View full report

@pranaygp
pranaygp merged commit b92dfbb into mainJun 16, 2026
121 checks passed
@pranaygp
pranaygp deleted the pgp/issue-fix branch June 16, 2026 21:18
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
github-actionsBot added a commit that referenced this pull request Jun 16, 2026
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2461. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 16, 2026
…2461)
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
pranaygp added a commit that referenced this pull request Jun 16, 2026
* origin/main:
fix(core): make deploymentId 'latest' a no-op in non-Vercel worlds (#2397)
fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457)
Small detail panel cleanup (#2459)
Fix lazy Next workflow HMR (#2438)
Prevent peer dependency-only major bumps (#2437)
fix(changesets): only major-bump peer dependents when out of range (#2439)
Version Packages (beta) (#2428)
otel: explicit traceparent injection + linked-trace mode for bounded per-invocation traces (#2363)
[next] Clarify `serverExternalPackages` warning (#2417)
Add .swc gitignore handling to builder (#2427)
Version Packages (beta) (#2390)
[ci] Increase dev.test.ts cleanup hook timeout (#2416)
[world-vercel] Switch event endpoints to v4 wire format (#2055)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@karthikscale3
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 - #2457

Merged
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix
Jun 16, 2026
Merged

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299#2457
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

Resolves VULN-11836CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, High): Host header SSRF in prerendered error page fetch in astro.

The advisory's only patched version is astro 6.4.6 (< 6.4.6 is vulnerable) — there is no 5.x backport, so the fix requires moving to the 6.x line.

Changes

  • workbench/astro (the flagged app, resolved to astro@5.16.3):
    • astro^5.15.6^6.4.6
    • @astrojs/node9.5.010.1.4 (astro 6 peer compat)
    • @astrojs/vercel^9.0.0^10.0.8 (astro 6 peer compat)
  • packages/astro (@workflow/astro): astro devDependency 5.18.06.4.6 (typecheck-only, not shipped) — clears the last vulnerable astro from the lockfile.

After the bump the lockfile contains only astro@6.4.6 — both astro@5.16.3 and astro@5.18.0 are gone.

Notes

  • Pinned 6.4.6 rather than the latest 6.4.7 because the repo's minimumReleaseAge (48h) guard blocks 6.4.7 (published <48h ago); 6.4.6 is the advisory's patched version.
  • astro 6 requires Node >=22.12.0; CI runs node 22.x/24.x, so this is satisfied.

Verification

  • @workflow/astro integration typechecks (tsc) against astro 6.4.6.
  • workbench/astro builds cleanly under both the @astrojs/node (local/CI) and @astrojs/vercel (deploy) adapter paths.

🤖 Generated with Claude Code

Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CopilotAI review requested due to automatic review settings June 16, 2026 19:19
@pranaygp
pranaygp requested a review from a team as a code ownerJune 16, 2026 19:19
@vercel

vercelBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: e6702f6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/astroPatch
workflowPatch
@workflow/world-testingPatch
@workflow/corePatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

All tests passed

Summary

PassedFailedSkippedTotal
✅ ▲ Vercel Production144202191661
✅ 💻 Local Development189502192114
✅ 📦 Local Production189502192114
✅ 🐘 Local Postgres188102332114
✅ 🪟 Windows15100151
✅ 📋 Other87901781057
Total8143010689211

Details by Category

✅ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro125026
✅ example125026
✅ express125026
✅ fastify125026
✅ hono125026
✅ nextjs-turbopack14902
✅ nextjs-webpack14902
✅ nitro125026
✅ nuxt125026
✅ sveltekit14407
✅ vite125026
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable125026
✅ express-stable125026
✅ fastify-stable125026
✅ hono-stable125026
✅ nextjs-turbopack-canary131020
✅ nextjs-turbopack-stable-lazy-discovery-disabled15001
✅ nextjs-turbopack-stable-lazy-discovery-enabled15001
✅ nextjs-webpack-canary131020
✅ nextjs-webpack-stable-lazy-discovery-disabled15001
✅ nextjs-webpack-stable-lazy-discovery-enabled15001
✅ nitro-stable125026
✅ nuxt-stable125026
✅ sveltekit-stable14407
✅ vite-stable125026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15100
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable126025
✅ e2e-local-dev-tanstack-start-126025
✅ e2e-local-postgres-nest-stable125026
✅ e2e-local-postgres-tanstack-start-125026
✅ e2e-local-prod-nest-stable126025
✅ e2e-local-prod-tanstack-start-126025
✅ e2e-vercel-prod-tanstack-start125026

📋 View full workflow run

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.045s (-6.4% 🟢)1.006s (~)0.960s101.00x
💻 LocalNitro0.047s (+12.2% 🔺)1.008s (~)0.961s101.04x
🐘 PostgresNitro0.062s (-4.5%)1.013s (~)0.951s101.37x
💻 LocalNext.js (Turbopack)0.063s (+2.8%)1.007s (~)0.944s101.38x
🐘 PostgresExpress0.063s (+3.1%)1.012s (~)0.949s101.39x
🐘 PostgresNext.js (Turbopack)0.068s (-6.3% 🟢)1.012s (~)0.944s101.51x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express0.321s (-71.0% 🟢)2.398s (-33.0% 🟢)2.077s101.00x
▲ VercelNext.js (Turbopack)0.325s (-83.6% 🟢)2.160s (-47.4% 🟢)1.836s101.01x
▲ VercelNitro0.355s (-40.9% 🟢)2.479s (-6.8% 🟢)2.125s101.10x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.094s (~)2.007s (~)0.913s101.00x
💻 LocalExpress1.107s (+0.7%)2.006s (~)0.899s101.01x
🐘 PostgresExpress1.108s (-0.6%)2.010s (~)0.902s101.01x
🐘 PostgresNitro1.114s (~)2.011s (~)0.897s101.02x
🐘 PostgresNext.js (Turbopack)1.139s (-1.6%)2.010s (~)0.871s101.04x
💻 LocalNext.js (Turbopack)1.143s (~)2.007s (~)0.864s101.04x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.843s (-34.7% 🟢)3.753s (-17.4% 🟢)1.911s101.00x
▲ VercelExpress1.853s (-30.9% 🟢)3.656s (-26.9% 🟢)1.804s101.01x
▲ VercelNext.js (Turbopack)1.862s (-30.6% 🟢)3.901s (-13.8% 🟢)2.039s101.01x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express10.539s (~)11.023s (~)0.484s31.00x
💻 LocalNitro10.551s (~)11.023s (~)0.472s31.00x
🐘 PostgresExpress10.560s (~)11.018s (~)0.458s31.00x
🐘 PostgresNitro10.573s (~)11.019s (~)0.446s31.00x
💻 LocalNext.js (Turbopack)10.809s (~)11.024s (~)0.214s31.03x
🐘 PostgresNext.js (Turbopack)10.889s (~)11.352s (+3.0%)0.462s31.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro14.280s (-21.4% 🟢)16.322s (-17.9% 🟢)2.043s21.00x
▲ VercelExpress14.736s (-9.4% 🟢)16.736s (-10.2% 🟢)1.999s21.03x
▲ VercelNext.js (Turbopack)14.834s (-30.7% 🟢)16.703s (-28.2% 🟢)1.869s21.04x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express13.791s (~)14.017s (~)0.226s51.00x
💻 LocalExpress13.820s (~)14.028s (~)0.208s51.00x
🐘 PostgresNitro13.823s (~)14.021s (~)0.198s51.00x
💻 LocalNitro13.849s (~)14.028s (~)0.179s51.00x
💻 LocalNext.js (Turbopack)14.360s (~)15.030s (~)0.670s41.04x
🐘 PostgresNext.js (Turbopack)14.490s (~)15.017s (~)0.527s41.05x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)23.277s (-24.4% 🟢)25.483s (-22.4% 🟢)2.206s31.00x
▲ VercelExpress23.554s (-32.5% 🟢)25.626s (-30.6% 🟢)2.072s31.01x
▲ VercelNitro23.646s (-28.3% 🟢)25.447s (-27.0% 🟢)1.801s31.02x

🔍 Observability: Next.js (Turbopack) | Express | Nitro

workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.466s (-1.7%)13.016s (~)0.549s71.00x
💻 LocalNitro12.523s (~)13.025s (~)0.502s71.00x
💻 LocalExpress12.597s (~)13.027s (~)0.431s71.01x
🐘 PostgresExpress12.831s (+1.9%)13.303s (+2.2%)0.472s71.03x
💻 LocalNext.js (Turbopack)13.682s (~)14.027s (~)0.345s71.10x
🐘 PostgresNext.js (Turbopack)13.752s (-1.6%)14.019s (-1.0%)0.268s71.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express33.719s (-3.0%)36.136s (-2.6%)2.417s31.00x
▲ VercelNext.js (Turbopack)34.038s (-3.1%)36.769s (-2.0%)2.731s31.01x
▲ VercelNitro37.427s (-1.3%)40.332s (+2.1%)2.905s31.11x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.212s (+0.5%)2.008s (~)0.796s151.00x
💻 LocalExpress1.212s (+1.7%)2.007s (~)0.795s151.00x
🐘 PostgresNitro1.213s (~)2.008s (~)0.794s151.00x
💻 LocalNitro1.248s (+7.3% 🔺)2.006s (~)0.758s151.03x
🐘 PostgresNext.js (Turbopack)1.303s (-4.0%)2.007s (-3.3%)0.704s151.08x
💻 LocalNext.js (Turbopack)1.366s (+2.8%)2.006s (~)0.640s151.13x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.318s (-25.0% 🟢)3.899s (-15.0% 🟢)1.581s81.00x
▲ VercelNext.js (Turbopack)2.378s (+1.3%)3.969s (-1.2%)1.591s81.03x
▲ VercelExpress2.454s (-3.8%)3.990s (-2.0%)1.536s81.06x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.334s (-0.6%)2.592s (+3.3%)1.258s121.00x
🐘 PostgresExpress1.407s (+3.6%)2.393s (-4.6%)0.986s131.05x
🐘 PostgresNext.js (Turbopack)1.592s (-2.8%)2.294s (-8.6% 🟢)0.702s141.19x
💻 LocalNext.js (Turbopack)1.600s (~)2.006s (~)0.406s151.20x
💻 LocalNitro1.711s (+5.0% 🔺)2.006s (~)0.295s151.28x
💻 LocalExpress2.065s (+9.0% 🔺)2.471s (+14.8% 🔺)0.406s131.55x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.392s (-17.6% 🟢)5.282s (-12.8% 🟢)1.890s71.00x
▲ VercelNitro3.657s (-3.0%)5.390s (~)1.732s61.08x
▲ VercelNext.js (Turbopack)3.834s (+9.4% 🔺)5.777s (+10.0% 🔺)1.943s61.13x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.653s (+1.9%)4.014s (+3.3%)2.361s81.00x
🐘 PostgresNitro1.727s (+6.3% 🔺)4.012s (-3.1%)2.285s81.04x
🐘 PostgresNext.js (Turbopack)2.772s (-27.6% 🟢)3.760s (-15.4% 🟢)0.988s81.68x
💻 LocalNext.js (Turbopack)4.577s (~)5.178s (~)0.602s62.77x
💻 LocalNitro4.749s (+18.1% 🔺)5.179s (+13.0% 🔺)0.430s62.87x
💻 LocalExpress5.519s (+5.4% 🔺)5.845s (~)0.326s63.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express5.467s (+19.5% 🔺)7.579s (+15.5% 🔺)2.112s41.00x
▲ VercelNext.js (Turbopack)6.098s (+61.0% 🔺)7.907s (+46.2% 🔺)1.808s41.12x
▲ VercelNitro6.220s (+46.5% 🔺)8.628s (+50.6% 🔺)2.408s41.14x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.195s (-2.2%)2.007s (~)0.812s151.00x
🐘 PostgresExpress1.208s (~)2.007s (~)0.799s151.01x
🐘 PostgresNext.js (Turbopack)1.304s (+1.4%)2.008s (~)0.704s151.09x
💻 LocalNext.js (Turbopack)1.384s (~)2.006s (~)0.622s151.16x
💻 LocalNitro1.547s (+2.4%)2.006s (~)0.460s151.29x
💻 LocalExpress1.578s (-2.2%)2.007s (~)0.429s151.32x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.405s (+4.3%)3.820s (-3.2%)1.415s81.00x
▲ VercelNitro2.423s (-62.6% 🟢)3.700s (-53.9% 🟢)1.278s91.01x
▲ VercelExpress2.461s (+8.2% 🔺)4.085s (+6.0% 🔺)1.624s81.02x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.350s (-3.3%)2.509s (+1.6%)1.160s121.00x
🐘 PostgresNitro1.364s (+0.5%)2.317s (-10.6% 🟢)0.953s131.01x
🐘 PostgresNext.js (Turbopack)1.545s (+0.5%)2.221s (~)0.676s141.14x
💻 LocalNitro1.887s (+5.4% 🔺)2.315s (+11.7% 🔺)0.428s131.40x
💻 LocalNext.js (Turbopack)2.020s (+4.6%)2.591s (+16.6% 🔺)0.571s121.50x
💻 LocalExpress2.186s (-15.1% 🟢)2.591s (-16.6% 🟢)0.405s121.62x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.686s (-28.3% 🟢)3.995s (-26.8% 🟢)1.308s81.00x
▲ VercelNext.js (Turbopack)3.121s (-22.2% 🟢)5.152s (-10.3% 🟢)2.031s61.16x
▲ VercelExpress3.368s (+1.1%)4.862s (-9.0% 🟢)1.494s71.25x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.642s (-5.0%)4.299s (+10.6% 🔺)2.656s71.00x
🐘 PostgresExpress1.693s (-3.4%)4.012s (-3.0%)2.319s81.03x
🐘 PostgresNext.js (Turbopack)2.857s (-25.6% 🟢)4.013s (-9.7% 🟢)1.156s81.74x
💻 LocalNext.js (Turbopack)5.016s (-5.2% 🟢)5.515s (-8.3% 🟢)0.499s63.05x
💻 LocalExpress5.795s (-8.6% 🟢)6.216s (-11.4% 🟢)0.420s53.53x
💻 LocalNitro6.023s (+26.5% 🔺)6.819s (+27.5% 🔺)0.796s53.67x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro4.371s (-33.7% 🟢)6.186s (-25.9% 🟢)1.815s51.00x
▲ VercelNext.js (Turbopack)5.040s (+2.3%)7.308s (+12.5% 🔺)2.268s51.15x
▲ VercelExpress5.213s (~)7.552s (+8.4% 🔺)2.338s41.19x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.583s (-9.5% 🟢)1.023s (-1.8%)0.440s591.00x
🐘 PostgresExpress0.587s (-0.8%)1.023s (+1.7%)0.436s591.01x
💻 LocalNitro0.601s (+3.1%)1.005s (~)0.404s601.03x
💻 LocalExpress0.663s (+0.6%)1.022s (-1.7%)0.359s591.14x
🐘 PostgresNext.js (Turbopack)0.817s (-3.8%)1.006s (-1.7%)0.189s601.40x
💻 LocalNext.js (Turbopack)0.878s (-0.8%)1.039s (-1.7%)0.161s581.50x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.186s (-26.9% 🟢)7.879s (-22.0% 🟢)1.693s81.00x
▲ VercelExpress6.507s (-1.1%)8.264s (-4.2%)1.757s81.05x
▲ VercelNext.js (Turbopack)6.927s (-6.6% 🟢)8.857s (-5.2% 🟢)1.930s71.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.372s (-5.1% 🟢)2.052s (+2.2%)0.680s441.00x
🐘 PostgresExpress1.430s (~)2.053s (+1.1%)0.622s441.04x
💻 LocalNitro1.508s (+2.1%)2.006s (~)0.498s451.10x
💻 LocalExpress1.588s (~)2.007s (~)0.419s451.16x
🐘 PostgresNext.js (Turbopack)1.941s (-4.7%)2.151s (-16.1% 🟢)0.210s421.41x
💻 LocalNext.js (Turbopack)2.145s (+0.8%)3.009s (~)0.864s301.56x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro15.095s (-19.6% 🟢)17.268s (-16.8% 🟢)2.174s61.00x
▲ VercelNext.js (Turbopack)15.916s (-20.1% 🟢)18.292s (-18.3% 🟢)2.376s51.05x
▲ VercelExpress16.686s (-17.1% 🟢)18.647s (-14.7% 🟢)1.961s51.11x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express2.727s (-1.9%)3.086s (-1.6%)0.359s391.00x
🐘 PostgresNitro2.976s (+5.5% 🔺)3.397s (+8.3% 🔺)0.422s361.09x
💻 LocalNitro3.313s (+4.6%)4.043s (+3.3%)0.730s301.21x
💻 LocalExpress3.405s (+1.9%)4.011s (~)0.606s301.25x
🐘 PostgresNext.js (Turbopack)3.831s (-4.8%)4.110s (-6.7% 🟢)0.279s301.40x
💻 LocalNext.js (Turbopack)4.575s (+0.8%)5.053s (~)0.478s241.68x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro30.084s (-17.0% 🟢)32.889s (-13.9% 🟢)2.806s41.00x
▲ VercelExpress30.093s (-22.2% 🟢)32.724s (-19.0% 🟢)2.631s41.00x
▲ VercelNext.js (Turbopack)33.218s (-26.0% 🟢)36.130s (-22.6% 🟢)2.912s41.10x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.244s (-6.4% 🟢)1.006s (~)0.762s601.00x
🐘 PostgresExpress0.250s (-4.2%)1.006s (~)0.756s601.02x
🐘 PostgresNext.js (Turbopack)0.311s (+0.8%)1.006s (~)0.696s601.27x
💻 LocalNitro0.454s (+5.2% 🔺)1.005s (~)0.551s601.86x
💻 LocalExpress0.462s (+8.0% 🔺)1.005s (~)0.543s601.89x
💻 LocalNext.js (Turbopack)0.564s (-12.7% 🟢)1.005s (-5.1% 🟢)0.441s602.31x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.833s (-36.5% 🟢)3.794s (-24.6% 🟢)1.962s161.00x
▲ VercelNext.js (Turbopack)2.203s (-28.3% 🟢)4.190s (-16.4% 🟢)1.986s151.20x
▲ VercelExpress2.247s (-37.1% 🟢)4.134s (-26.0% 🟢)1.887s151.23x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.400s (-12.6% 🟢)1.006s (-6.7% 🟢)0.606s901.00x
🐘 PostgresExpress0.423s (+2.8%)1.041s (+3.4%)0.618s871.06x
🐘 PostgresNext.js (Turbopack)0.618s (-8.8% 🟢)1.240s (-2.8%)0.622s731.55x
💻 LocalNitro2.184s (+8.6% 🔺)2.767s (+13.4% 🔺)0.584s335.46x
💻 LocalExpress2.245s (+2.5%)2.913s (+2.1%)0.668s315.62x
💻 LocalNext.js (Turbopack)2.497s (-2.4%)3.224s (-1.1%)0.728s286.25x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.219s (-37.6% 🟢)4.988s (-30.9% 🟢)1.769s191.00x
▲ VercelNitro3.388s (-2.8%)5.242s (+1.4%)1.854s181.05x
▲ VercelNext.js (Turbopack)3.690s (-3.0%)5.812s (+1.3%)2.122s161.15x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.798s (-5.3% 🟢)1.326s (-9.9% 🟢)0.528s911.00x
🐘 PostgresExpress0.824s (-2.8%)1.352s (-10.3% 🟢)0.528s901.03x
🐘 PostgresNext.js (Turbopack)2.866s (-7.2% 🟢)3.681s (-3.8%)0.816s333.59x
💻 LocalNitro9.345s (+7.1% 🔺)10.032s (+8.4% 🔺)0.687s1211.71x
💻 LocalExpress9.995s (+1.3%)10.696s (+4.0%)0.701s1212.52x
💻 LocalNext.js (Turbopack)11.013s (+5.0%)11.850s (+4.0%)0.837s1113.80x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.218s (-7.9% 🟢)8.141s (-5.7% 🟢)1.922s151.00x
▲ VercelExpress6.430s (-5.9% 🟢)8.691s (+0.8%)2.261s141.03x
▲ VercelNext.js (Turbopack)7.483s (+4.0%)10.018s (+11.7% 🔺)2.535s121.20x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.160s (~)2.005s (~)0.010s (+2.0%)2.018s (~)0.858s101.00x
💻 LocalExpress1.170s (~)2.005s (~)0.012s (+1.6%)2.020s (~)0.850s101.01x
🐘 PostgresExpress1.174s (~)1.998s (~)0.001s (+27.3% 🔺)2.010s (~)0.837s101.01x
🐘 PostgresNitro1.178s (-1.7%)1.997s (~)0.001s (~)2.010s (~)0.832s101.02x
🐘 PostgresNext.js (Turbopack)1.226s (-1.4%)2.002s (~)0.001s (-16.7% 🟢)2.011s (~)0.784s101.06x
💻 LocalNext.js (Turbopack)1.228s (-1.7%)2.003s (~)0.011s (-1.9%)2.018s (~)0.790s101.06x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.527s (-5.8% 🟢)3.723s (-0.6%)1.524s (+82.0% 🔺)5.771s (+13.5% 🔺)3.244s101.00x
▲ VercelNitro2.557s (~)3.645s (-1.8%)1.154s (+55.9% 🔺)5.296s (+6.7% 🔺)2.738s101.01x
▲ VercelExpress2.620s (+10.9% 🔺)3.621s (+2.6%)1.247s (+77.3% 🔺)5.373s (+12.2% 🔺)2.754s101.04x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.578s (+0.7%)2.010s (~)0.013s (+14.6% 🔺)2.025s (~)0.448s301.00x
🐘 PostgresExpress1.603s (~)2.005s (~)0.005s (+2.7%)2.027s (~)0.424s301.02x
🐘 PostgresNitro1.608s (-1.9%)2.007s (~)0.005s (+0.6%)2.028s (~)0.420s301.02x
💻 LocalExpress1.611s (~)2.011s (~)0.013s (+6.2% 🔺)2.026s (~)0.416s301.02x
💻 LocalNext.js (Turbopack)1.735s (-0.7%)2.008s (~)0.011s (-17.3% 🟢)2.023s (~)0.288s301.10x
🐘 PostgresNext.js (Turbopack)1.761s (-1.7%)2.011s (~)0.005s (-3.6%)2.026s (~)0.265s301.12x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express6.370s (-7.7% 🟢)7.860s (-5.9% 🟢)0.277s (-19.6% 🟢)8.601s (-6.8% 🟢)2.231s71.00x
▲ VercelNext.js (Turbopack)6.386s (-7.0% 🟢)8.159s (-4.9%)0.282s (-9.9% 🟢)8.937s (-4.7%)2.551s71.00x
▲ VercelNitro6.476s (-3.8%)7.838s (-2.6%)0.234s (+6.5% 🔺)8.506s (-3.4%)2.030s81.02x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.782s (-3.8%)1.047s (-1.6%)0.000s (+194.7% 🔺)1.064s (-1.5%)0.282s571.00x
🐘 PostgresExpress0.802s (+0.6%)1.050s (~)0.000s (NaN%)1.082s (+2.0%)0.280s561.03x
🐘 PostgresNext.js (Turbopack)0.975s (-5.1% 🟢)1.418s (-12.5% 🟢)0.000s (-100.0% 🟢)1.426s (-12.5% 🟢)0.451s431.25x
💻 LocalExpress1.466s (+3.3%)2.013s (~)0.000s (-28.6% 🟢)2.015s (~)0.549s301.88x
💻 LocalNitro1.535s (+13.6% 🔺)2.015s (~)0.000s (~)2.017s (~)0.482s301.96x
💻 LocalNext.js (Turbopack)1.539s (+1.7%)2.013s (~)0.000s (-9.1% 🟢)2.017s (~)0.478s301.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)3.032s (-19.5% 🟢)4.491s (-15.8% 🟢)0.000s (-100.0% 🟢)4.989s (-15.2% 🟢)1.957s131.00x
▲ VercelNitro3.082s (-25.0% 🟢)4.281s (-25.5% 🟢)0.000s (+Infinity% 🔺)4.733s (-24.2% 🟢)1.651s131.02x
▲ VercelExpress3.181s (-13.9% 🟢)4.530s (-7.6% 🟢)0.000s (+Infinity% 🔺)5.012s (-9.8% 🟢)1.831s121.05x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.593s (-3.6%)2.137s (-1.8%)0.000s (+Infinity% 🔺)2.152s (-1.6%)0.559s281.00x
🐘 PostgresNitro1.736s (+2.5%)2.253s (+3.6%)0.000s (-48.1% 🟢)2.272s (+3.6%)0.536s271.09x
🐘 PostgresNext.js (Turbopack)2.135s (-5.3% 🟢)2.653s (-2.8%)0.000s (NaN%)2.662s (-2.8%)0.526s231.34x
💻 LocalNext.js (Turbopack)3.046s (+7.4% 🔺)3.468s (+1.5%)0.000s (-11.1% 🟢)3.476s (+1.7%)0.430s181.91x
💻 LocalNitro3.322s (+7.8% 🔺)3.893s (~)0.001s (+28.6% 🔺)3.906s (~)0.583s162.09x
💻 LocalExpress3.347s (+0.9%)4.028s (~)0.000s (-53.3% 🟢)4.030s (~)0.683s152.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro5.059s (+2.8%)6.517s (+5.7% 🔺)0.000s (NaN%)7.047s (+3.6%)1.988s91.00x
▲ VercelExpress5.187s (-14.5% 🟢)6.629s (-12.7% 🟢)0.006s (+655.6% 🔺)7.277s (-11.1% 🟢)2.090s91.03x
▲ VercelNext.js (Turbopack)5.652s (-20.0% 🟢)7.189s (-12.6% 🟢)0.000s (-100.0% 🟢)7.744s (-11.6% 🟢)2.091s81.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNitro11/21
🐘 PostgresNitro11/21
▲ VercelNitro11/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres16/21
Nitro🐘 Postgres16/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​@​astrojs/​node@​10.1.41001008297100
Addednpm/​@​astrojs/​vercel@​10.0.81001008397100
Addednpm/​astro@​6.4.6881008898100

View full report

@pranaygp
pranaygp merged commit b92dfbb into mainJun 16, 2026
121 checks passed
@pranaygp
pranaygp deleted the pgp/issue-fix branch June 16, 2026 21:18
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
github-actionsBot added a commit that referenced this pull request Jun 16, 2026
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2461. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 16, 2026
…2461)
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
pranaygp added a commit that referenced this pull request Jun 16, 2026
* origin/main:
fix(core): make deploymentId 'latest' a no-op in non-Vercel worlds (#2397)
fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457)
Small detail panel cleanup (#2459)
Fix lazy Next workflow HMR (#2438)
Prevent peer dependency-only major bumps (#2437)
fix(changesets): only major-bump peer dependents when out of range (#2439)
Version Packages (beta) (#2428)
otel: explicit traceparent injection + linked-trace mode for bounded per-invocation traces (#2363)
[next] Clarify `serverExternalPackages` warning (#2417)
Add .swc gitignore handling to builder (#2427)
Version Packages (beta) (#2390)
[ci] Increase dev.test.ts cleanup hook timeout (#2416)
[world-vercel] Switch event endpoints to v4 wire format (#2055)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@karthikscale3
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 - #2457

Merged
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix
Jun 16, 2026
Merged

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299#2457
pranaygp merged 1 commit into
mainfrom
pgp/issue-fix

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

Resolves VULN-11836CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, High): Host header SSRF in prerendered error page fetch in astro.

The advisory's only patched version is astro 6.4.6 (< 6.4.6 is vulnerable) — there is no 5.x backport, so the fix requires moving to the 6.x line.

Changes

  • workbench/astro (the flagged app, resolved to astro@5.16.3):
    • astro^5.15.6^6.4.6
    • @astrojs/node9.5.010.1.4 (astro 6 peer compat)
    • @astrojs/vercel^9.0.0^10.0.8 (astro 6 peer compat)
  • packages/astro (@workflow/astro): astro devDependency 5.18.06.4.6 (typecheck-only, not shipped) — clears the last vulnerable astro from the lockfile.

After the bump the lockfile contains only astro@6.4.6 — both astro@5.16.3 and astro@5.18.0 are gone.

Notes

  • Pinned 6.4.6 rather than the latest 6.4.7 because the repo's minimumReleaseAge (48h) guard blocks 6.4.7 (published <48h ago); 6.4.6 is the advisory's patched version.
  • astro 6 requires Node >=22.12.0; CI runs node 22.x/24.x, so this is satisfied.

Verification

  • @workflow/astro integration typechecks (tsc) against astro 6.4.6.
  • workbench/astro builds cleanly under both the @astrojs/node (local/CI) and @astrojs/vercel (deploy) adapter paths.

🤖 Generated with Claude Code

Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CopilotAI review requested due to automatic review settings June 16, 2026 19:19
@pranaygp
pranaygp requested a review from a team as a code ownerJune 16, 2026 19:19
@vercel

vercelBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: e6702f6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/astroPatch
workflowPatch
@workflow/world-testingPatch
@workflow/corePatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

All tests passed

Summary

PassedFailedSkippedTotal
✅ ▲ Vercel Production144202191661
✅ 💻 Local Development189502192114
✅ 📦 Local Production189502192114
✅ 🐘 Local Postgres188102332114
✅ 🪟 Windows15100151
✅ 📋 Other87901781057
Total8143010689211

Details by Category

✅ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro125026
✅ example125026
✅ express125026
✅ fastify125026
✅ hono125026
✅ nextjs-turbopack14902
✅ nextjs-webpack14902
✅ nitro125026
✅ nuxt125026
✅ sveltekit14407
✅ vite125026
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable126025
✅ express-stable126025
✅ fastify-stable126025
✅ hono-stable126025
✅ nextjs-turbopack-canary132019
✅ nextjs-turbopack-stable-lazy-discovery-disabled15100
✅ nextjs-turbopack-stable-lazy-discovery-enabled15100
✅ nextjs-webpack-canary132019
✅ nextjs-webpack-stable-lazy-discovery-disabled15100
✅ nextjs-webpack-stable-lazy-discovery-enabled15100
✅ nitro-stable126025
✅ nuxt-stable126025
✅ sveltekit-stable14506
✅ vite-stable126025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable125026
✅ express-stable125026
✅ fastify-stable125026
✅ hono-stable125026
✅ nextjs-turbopack-canary131020
✅ nextjs-turbopack-stable-lazy-discovery-disabled15001
✅ nextjs-turbopack-stable-lazy-discovery-enabled15001
✅ nextjs-webpack-canary131020
✅ nextjs-webpack-stable-lazy-discovery-disabled15001
✅ nextjs-webpack-stable-lazy-discovery-enabled15001
✅ nitro-stable125026
✅ nuxt-stable125026
✅ sveltekit-stable14407
✅ vite-stable125026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15100
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable126025
✅ e2e-local-dev-tanstack-start-126025
✅ e2e-local-postgres-nest-stable125026
✅ e2e-local-postgres-tanstack-start-125026
✅ e2e-local-prod-nest-stable126025
✅ e2e-local-prod-tanstack-start-126025
✅ e2e-vercel-prod-tanstack-start125026

📋 View full workflow run

@github-actions

github-actionsBot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.045s (-6.4% 🟢)1.006s (~)0.960s101.00x
💻 LocalNitro0.047s (+12.2% 🔺)1.008s (~)0.961s101.04x
🐘 PostgresNitro0.062s (-4.5%)1.013s (~)0.951s101.37x
💻 LocalNext.js (Turbopack)0.063s (+2.8%)1.007s (~)0.944s101.38x
🐘 PostgresExpress0.063s (+3.1%)1.012s (~)0.949s101.39x
🐘 PostgresNext.js (Turbopack)0.068s (-6.3% 🟢)1.012s (~)0.944s101.51x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express0.321s (-71.0% 🟢)2.398s (-33.0% 🟢)2.077s101.00x
▲ VercelNext.js (Turbopack)0.325s (-83.6% 🟢)2.160s (-47.4% 🟢)1.836s101.01x
▲ VercelNitro0.355s (-40.9% 🟢)2.479s (-6.8% 🟢)2.125s101.10x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.094s (~)2.007s (~)0.913s101.00x
💻 LocalExpress1.107s (+0.7%)2.006s (~)0.899s101.01x
🐘 PostgresExpress1.108s (-0.6%)2.010s (~)0.902s101.01x
🐘 PostgresNitro1.114s (~)2.011s (~)0.897s101.02x
🐘 PostgresNext.js (Turbopack)1.139s (-1.6%)2.010s (~)0.871s101.04x
💻 LocalNext.js (Turbopack)1.143s (~)2.007s (~)0.864s101.04x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.843s (-34.7% 🟢)3.753s (-17.4% 🟢)1.911s101.00x
▲ VercelExpress1.853s (-30.9% 🟢)3.656s (-26.9% 🟢)1.804s101.01x
▲ VercelNext.js (Turbopack)1.862s (-30.6% 🟢)3.901s (-13.8% 🟢)2.039s101.01x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express10.539s (~)11.023s (~)0.484s31.00x
💻 LocalNitro10.551s (~)11.023s (~)0.472s31.00x
🐘 PostgresExpress10.560s (~)11.018s (~)0.458s31.00x
🐘 PostgresNitro10.573s (~)11.019s (~)0.446s31.00x
💻 LocalNext.js (Turbopack)10.809s (~)11.024s (~)0.214s31.03x
🐘 PostgresNext.js (Turbopack)10.889s (~)11.352s (+3.0%)0.462s31.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro14.280s (-21.4% 🟢)16.322s (-17.9% 🟢)2.043s21.00x
▲ VercelExpress14.736s (-9.4% 🟢)16.736s (-10.2% 🟢)1.999s21.03x
▲ VercelNext.js (Turbopack)14.834s (-30.7% 🟢)16.703s (-28.2% 🟢)1.869s21.04x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express13.791s (~)14.017s (~)0.226s51.00x
💻 LocalExpress13.820s (~)14.028s (~)0.208s51.00x
🐘 PostgresNitro13.823s (~)14.021s (~)0.198s51.00x
💻 LocalNitro13.849s (~)14.028s (~)0.179s51.00x
💻 LocalNext.js (Turbopack)14.360s (~)15.030s (~)0.670s41.04x
🐘 PostgresNext.js (Turbopack)14.490s (~)15.017s (~)0.527s41.05x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)23.277s (-24.4% 🟢)25.483s (-22.4% 🟢)2.206s31.00x
▲ VercelExpress23.554s (-32.5% 🟢)25.626s (-30.6% 🟢)2.072s31.01x
▲ VercelNitro23.646s (-28.3% 🟢)25.447s (-27.0% 🟢)1.801s31.02x

🔍 Observability: Next.js (Turbopack) | Express | Nitro

workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.466s (-1.7%)13.016s (~)0.549s71.00x
💻 LocalNitro12.523s (~)13.025s (~)0.502s71.00x
💻 LocalExpress12.597s (~)13.027s (~)0.431s71.01x
🐘 PostgresExpress12.831s (+1.9%)13.303s (+2.2%)0.472s71.03x
💻 LocalNext.js (Turbopack)13.682s (~)14.027s (~)0.345s71.10x
🐘 PostgresNext.js (Turbopack)13.752s (-1.6%)14.019s (-1.0%)0.268s71.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express33.719s (-3.0%)36.136s (-2.6%)2.417s31.00x
▲ VercelNext.js (Turbopack)34.038s (-3.1%)36.769s (-2.0%)2.731s31.01x
▲ VercelNitro37.427s (-1.3%)40.332s (+2.1%)2.905s31.11x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.212s (+0.5%)2.008s (~)0.796s151.00x
💻 LocalExpress1.212s (+1.7%)2.007s (~)0.795s151.00x
🐘 PostgresNitro1.213s (~)2.008s (~)0.794s151.00x
💻 LocalNitro1.248s (+7.3% 🔺)2.006s (~)0.758s151.03x
🐘 PostgresNext.js (Turbopack)1.303s (-4.0%)2.007s (-3.3%)0.704s151.08x
💻 LocalNext.js (Turbopack)1.366s (+2.8%)2.006s (~)0.640s151.13x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.318s (-25.0% 🟢)3.899s (-15.0% 🟢)1.581s81.00x
▲ VercelNext.js (Turbopack)2.378s (+1.3%)3.969s (-1.2%)1.591s81.03x
▲ VercelExpress2.454s (-3.8%)3.990s (-2.0%)1.536s81.06x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.334s (-0.6%)2.592s (+3.3%)1.258s121.00x
🐘 PostgresExpress1.407s (+3.6%)2.393s (-4.6%)0.986s131.05x
🐘 PostgresNext.js (Turbopack)1.592s (-2.8%)2.294s (-8.6% 🟢)0.702s141.19x
💻 LocalNext.js (Turbopack)1.600s (~)2.006s (~)0.406s151.20x
💻 LocalNitro1.711s (+5.0% 🔺)2.006s (~)0.295s151.28x
💻 LocalExpress2.065s (+9.0% 🔺)2.471s (+14.8% 🔺)0.406s131.55x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.392s (-17.6% 🟢)5.282s (-12.8% 🟢)1.890s71.00x
▲ VercelNitro3.657s (-3.0%)5.390s (~)1.732s61.08x
▲ VercelNext.js (Turbopack)3.834s (+9.4% 🔺)5.777s (+10.0% 🔺)1.943s61.13x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.653s (+1.9%)4.014s (+3.3%)2.361s81.00x
🐘 PostgresNitro1.727s (+6.3% 🔺)4.012s (-3.1%)2.285s81.04x
🐘 PostgresNext.js (Turbopack)2.772s (-27.6% 🟢)3.760s (-15.4% 🟢)0.988s81.68x
💻 LocalNext.js (Turbopack)4.577s (~)5.178s (~)0.602s62.77x
💻 LocalNitro4.749s (+18.1% 🔺)5.179s (+13.0% 🔺)0.430s62.87x
💻 LocalExpress5.519s (+5.4% 🔺)5.845s (~)0.326s63.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express5.467s (+19.5% 🔺)7.579s (+15.5% 🔺)2.112s41.00x
▲ VercelNext.js (Turbopack)6.098s (+61.0% 🔺)7.907s (+46.2% 🔺)1.808s41.12x
▲ VercelNitro6.220s (+46.5% 🔺)8.628s (+50.6% 🔺)2.408s41.14x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.195s (-2.2%)2.007s (~)0.812s151.00x
🐘 PostgresExpress1.208s (~)2.007s (~)0.799s151.01x
🐘 PostgresNext.js (Turbopack)1.304s (+1.4%)2.008s (~)0.704s151.09x
💻 LocalNext.js (Turbopack)1.384s (~)2.006s (~)0.622s151.16x
💻 LocalNitro1.547s (+2.4%)2.006s (~)0.460s151.29x
💻 LocalExpress1.578s (-2.2%)2.007s (~)0.429s151.32x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.405s (+4.3%)3.820s (-3.2%)1.415s81.00x
▲ VercelNitro2.423s (-62.6% 🟢)3.700s (-53.9% 🟢)1.278s91.01x
▲ VercelExpress2.461s (+8.2% 🔺)4.085s (+6.0% 🔺)1.624s81.02x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.350s (-3.3%)2.509s (+1.6%)1.160s121.00x
🐘 PostgresNitro1.364s (+0.5%)2.317s (-10.6% 🟢)0.953s131.01x
🐘 PostgresNext.js (Turbopack)1.545s (+0.5%)2.221s (~)0.676s141.14x
💻 LocalNitro1.887s (+5.4% 🔺)2.315s (+11.7% 🔺)0.428s131.40x
💻 LocalNext.js (Turbopack)2.020s (+4.6%)2.591s (+16.6% 🔺)0.571s121.50x
💻 LocalExpress2.186s (-15.1% 🟢)2.591s (-16.6% 🟢)0.405s121.62x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.686s (-28.3% 🟢)3.995s (-26.8% 🟢)1.308s81.00x
▲ VercelNext.js (Turbopack)3.121s (-22.2% 🟢)5.152s (-10.3% 🟢)2.031s61.16x
▲ VercelExpress3.368s (+1.1%)4.862s (-9.0% 🟢)1.494s71.25x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.642s (-5.0%)4.299s (+10.6% 🔺)2.656s71.00x
🐘 PostgresExpress1.693s (-3.4%)4.012s (-3.0%)2.319s81.03x
🐘 PostgresNext.js (Turbopack)2.857s (-25.6% 🟢)4.013s (-9.7% 🟢)1.156s81.74x
💻 LocalNext.js (Turbopack)5.016s (-5.2% 🟢)5.515s (-8.3% 🟢)0.499s63.05x
💻 LocalExpress5.795s (-8.6% 🟢)6.216s (-11.4% 🟢)0.420s53.53x
💻 LocalNitro6.023s (+26.5% 🔺)6.819s (+27.5% 🔺)0.796s53.67x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro4.371s (-33.7% 🟢)6.186s (-25.9% 🟢)1.815s51.00x
▲ VercelNext.js (Turbopack)5.040s (+2.3%)7.308s (+12.5% 🔺)2.268s51.15x
▲ VercelExpress5.213s (~)7.552s (+8.4% 🔺)2.338s41.19x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.583s (-9.5% 🟢)1.023s (-1.8%)0.440s591.00x
🐘 PostgresExpress0.587s (-0.8%)1.023s (+1.7%)0.436s591.01x
💻 LocalNitro0.601s (+3.1%)1.005s (~)0.404s601.03x
💻 LocalExpress0.663s (+0.6%)1.022s (-1.7%)0.359s591.14x
🐘 PostgresNext.js (Turbopack)0.817s (-3.8%)1.006s (-1.7%)0.189s601.40x
💻 LocalNext.js (Turbopack)0.878s (-0.8%)1.039s (-1.7%)0.161s581.50x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.186s (-26.9% 🟢)7.879s (-22.0% 🟢)1.693s81.00x
▲ VercelExpress6.507s (-1.1%)8.264s (-4.2%)1.757s81.05x
▲ VercelNext.js (Turbopack)6.927s (-6.6% 🟢)8.857s (-5.2% 🟢)1.930s71.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.372s (-5.1% 🟢)2.052s (+2.2%)0.680s441.00x
🐘 PostgresExpress1.430s (~)2.053s (+1.1%)0.622s441.04x
💻 LocalNitro1.508s (+2.1%)2.006s (~)0.498s451.10x
💻 LocalExpress1.588s (~)2.007s (~)0.419s451.16x
🐘 PostgresNext.js (Turbopack)1.941s (-4.7%)2.151s (-16.1% 🟢)0.210s421.41x
💻 LocalNext.js (Turbopack)2.145s (+0.8%)3.009s (~)0.864s301.56x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro15.095s (-19.6% 🟢)17.268s (-16.8% 🟢)2.174s61.00x
▲ VercelNext.js (Turbopack)15.916s (-20.1% 🟢)18.292s (-18.3% 🟢)2.376s51.05x
▲ VercelExpress16.686s (-17.1% 🟢)18.647s (-14.7% 🟢)1.961s51.11x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express2.727s (-1.9%)3.086s (-1.6%)0.359s391.00x
🐘 PostgresNitro2.976s (+5.5% 🔺)3.397s (+8.3% 🔺)0.422s361.09x
💻 LocalNitro3.313s (+4.6%)4.043s (+3.3%)0.730s301.21x
💻 LocalExpress3.405s (+1.9%)4.011s (~)0.606s301.25x
🐘 PostgresNext.js (Turbopack)3.831s (-4.8%)4.110s (-6.7% 🟢)0.279s301.40x
💻 LocalNext.js (Turbopack)4.575s (+0.8%)5.053s (~)0.478s241.68x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro30.084s (-17.0% 🟢)32.889s (-13.9% 🟢)2.806s41.00x
▲ VercelExpress30.093s (-22.2% 🟢)32.724s (-19.0% 🟢)2.631s41.00x
▲ VercelNext.js (Turbopack)33.218s (-26.0% 🟢)36.130s (-22.6% 🟢)2.912s41.10x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.244s (-6.4% 🟢)1.006s (~)0.762s601.00x
🐘 PostgresExpress0.250s (-4.2%)1.006s (~)0.756s601.02x
🐘 PostgresNext.js (Turbopack)0.311s (+0.8%)1.006s (~)0.696s601.27x
💻 LocalNitro0.454s (+5.2% 🔺)1.005s (~)0.551s601.86x
💻 LocalExpress0.462s (+8.0% 🔺)1.005s (~)0.543s601.89x
💻 LocalNext.js (Turbopack)0.564s (-12.7% 🟢)1.005s (-5.1% 🟢)0.441s602.31x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro1.833s (-36.5% 🟢)3.794s (-24.6% 🟢)1.962s161.00x
▲ VercelNext.js (Turbopack)2.203s (-28.3% 🟢)4.190s (-16.4% 🟢)1.986s151.20x
▲ VercelExpress2.247s (-37.1% 🟢)4.134s (-26.0% 🟢)1.887s151.23x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.400s (-12.6% 🟢)1.006s (-6.7% 🟢)0.606s901.00x
🐘 PostgresExpress0.423s (+2.8%)1.041s (+3.4%)0.618s871.06x
🐘 PostgresNext.js (Turbopack)0.618s (-8.8% 🟢)1.240s (-2.8%)0.622s731.55x
💻 LocalNitro2.184s (+8.6% 🔺)2.767s (+13.4% 🔺)0.584s335.46x
💻 LocalExpress2.245s (+2.5%)2.913s (+2.1%)0.668s315.62x
💻 LocalNext.js (Turbopack)2.497s (-2.4%)3.224s (-1.1%)0.728s286.25x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express3.219s (-37.6% 🟢)4.988s (-30.9% 🟢)1.769s191.00x
▲ VercelNitro3.388s (-2.8%)5.242s (+1.4%)1.854s181.05x
▲ VercelNext.js (Turbopack)3.690s (-3.0%)5.812s (+1.3%)2.122s161.15x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.798s (-5.3% 🟢)1.326s (-9.9% 🟢)0.528s911.00x
🐘 PostgresExpress0.824s (-2.8%)1.352s (-10.3% 🟢)0.528s901.03x
🐘 PostgresNext.js (Turbopack)2.866s (-7.2% 🟢)3.681s (-3.8%)0.816s333.59x
💻 LocalNitro9.345s (+7.1% 🔺)10.032s (+8.4% 🔺)0.687s1211.71x
💻 LocalExpress9.995s (+1.3%)10.696s (+4.0%)0.701s1212.52x
💻 LocalNext.js (Turbopack)11.013s (+5.0%)11.850s (+4.0%)0.837s1113.80x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro6.218s (-7.9% 🟢)8.141s (-5.7% 🟢)1.922s151.00x
▲ VercelExpress6.430s (-5.9% 🟢)8.691s (+0.8%)2.261s141.03x
▲ VercelNext.js (Turbopack)7.483s (+4.0%)10.018s (+11.7% 🔺)2.535s121.20x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.160s (~)2.005s (~)0.010s (+2.0%)2.018s (~)0.858s101.00x
💻 LocalExpress1.170s (~)2.005s (~)0.012s (+1.6%)2.020s (~)0.850s101.01x
🐘 PostgresExpress1.174s (~)1.998s (~)0.001s (+27.3% 🔺)2.010s (~)0.837s101.01x
🐘 PostgresNitro1.178s (-1.7%)1.997s (~)0.001s (~)2.010s (~)0.832s101.02x
🐘 PostgresNext.js (Turbopack)1.226s (-1.4%)2.002s (~)0.001s (-16.7% 🟢)2.011s (~)0.784s101.06x
💻 LocalNext.js (Turbopack)1.228s (-1.7%)2.003s (~)0.011s (-1.9%)2.018s (~)0.790s101.06x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)2.527s (-5.8% 🟢)3.723s (-0.6%)1.524s (+82.0% 🔺)5.771s (+13.5% 🔺)3.244s101.00x
▲ VercelNitro2.557s (~)3.645s (-1.8%)1.154s (+55.9% 🔺)5.296s (+6.7% 🔺)2.738s101.01x
▲ VercelExpress2.620s (+10.9% 🔺)3.621s (+2.6%)1.247s (+77.3% 🔺)5.373s (+12.2% 🔺)2.754s101.04x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Nitro1.578s (+0.7%)2.010s (~)0.013s (+14.6% 🔺)2.025s (~)0.448s301.00x
🐘 PostgresExpress1.603s (~)2.005s (~)0.005s (+2.7%)2.027s (~)0.424s301.02x
🐘 PostgresNitro1.608s (-1.9%)2.007s (~)0.005s (+0.6%)2.028s (~)0.420s301.02x
💻 LocalExpress1.611s (~)2.011s (~)0.013s (+6.2% 🔺)2.026s (~)0.416s301.02x
💻 LocalNext.js (Turbopack)1.735s (-0.7%)2.008s (~)0.011s (-17.3% 🟢)2.023s (~)0.288s301.10x
🐘 PostgresNext.js (Turbopack)1.761s (-1.7%)2.011s (~)0.005s (-3.6%)2.026s (~)0.265s301.12x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express6.370s (-7.7% 🟢)7.860s (-5.9% 🟢)0.277s (-19.6% 🟢)8.601s (-6.8% 🟢)2.231s71.00x
▲ VercelNext.js (Turbopack)6.386s (-7.0% 🟢)8.159s (-4.9%)0.282s (-9.9% 🟢)8.937s (-4.7%)2.551s71.00x
▲ VercelNitro6.476s (-3.8%)7.838s (-2.6%)0.234s (+6.5% 🔺)8.506s (-3.4%)2.030s81.02x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.782s (-3.8%)1.047s (-1.6%)0.000s (+194.7% 🔺)1.064s (-1.5%)0.282s571.00x
🐘 PostgresExpress0.802s (+0.6%)1.050s (~)0.000s (NaN%)1.082s (+2.0%)0.280s561.03x
🐘 PostgresNext.js (Turbopack)0.975s (-5.1% 🟢)1.418s (-12.5% 🟢)0.000s (-100.0% 🟢)1.426s (-12.5% 🟢)0.451s431.25x
💻 LocalExpress1.466s (+3.3%)2.013s (~)0.000s (-28.6% 🟢)2.015s (~)0.549s301.88x
💻 LocalNitro1.535s (+13.6% 🔺)2.015s (~)0.000s (~)2.017s (~)0.482s301.96x
💻 LocalNext.js (Turbopack)1.539s (+1.7%)2.013s (~)0.000s (-9.1% 🟢)2.017s (~)0.478s301.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Next.js (Turbopack)3.032s (-19.5% 🟢)4.491s (-15.8% 🟢)0.000s (-100.0% 🟢)4.989s (-15.2% 🟢)1.957s131.00x
▲ VercelNitro3.082s (-25.0% 🟢)4.281s (-25.5% 🟢)0.000s (+Infinity% 🔺)4.733s (-24.2% 🟢)1.651s131.02x
▲ VercelExpress3.181s (-13.9% 🟢)4.530s (-7.6% 🟢)0.000s (+Infinity% 🔺)5.012s (-9.8% 🟢)1.831s121.05x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Express1.593s (-3.6%)2.137s (-1.8%)0.000s (+Infinity% 🔺)2.152s (-1.6%)0.559s281.00x
🐘 PostgresNitro1.736s (+2.5%)2.253s (+3.6%)0.000s (-48.1% 🟢)2.272s (+3.6%)0.536s271.09x
🐘 PostgresNext.js (Turbopack)2.135s (-5.3% 🟢)2.653s (-2.8%)0.000s (NaN%)2.662s (-2.8%)0.526s231.34x
💻 LocalNext.js (Turbopack)3.046s (+7.4% 🔺)3.468s (+1.5%)0.000s (-11.1% 🟢)3.476s (+1.7%)0.430s181.91x
💻 LocalNitro3.322s (+7.8% 🔺)3.893s (~)0.001s (+28.6% 🔺)3.906s (~)0.583s162.09x
💻 LocalExpress3.347s (+0.9%)4.028s (~)0.000s (-53.3% 🟢)4.030s (~)0.683s152.10x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro5.059s (+2.8%)6.517s (+5.7% 🔺)0.000s (NaN%)7.047s (+3.6%)1.988s91.00x
▲ VercelExpress5.187s (-14.5% 🟢)6.629s (-12.7% 🟢)0.006s (+655.6% 🔺)7.277s (-11.1% 🟢)2.090s91.03x
▲ VercelNext.js (Turbopack)5.652s (-20.0% 🟢)7.189s (-12.6% 🟢)0.000s (-100.0% 🟢)7.744s (-11.6% 🟢)2.091s81.12x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNitro11/21
🐘 PostgresNitro11/21
▲ VercelNitro11/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres16/21
Nitro🐘 Postgres16/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​@​astrojs/​node@​10.1.41001008297100
Addednpm/​@​astrojs/​vercel@​10.0.81001008397100
Addednpm/​astro@​6.4.6881008898100

View full report

@pranaygp
pranaygp merged commit b92dfbb into mainJun 16, 2026
121 checks passed
@pranaygp
pranaygp deleted the pgp/issue-fix branch June 16, 2026 21:18
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
github-actionsBot added a commit that referenced this pull request Jun 16, 2026
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2461. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 16, 2026
…2461)
Astro <6.4.6 is vulnerable to CVE-2026-54299 (GHSA-2pvr-wf23-7pc7, host
header SSRF in prerendered error page fetch). The fix only exists in the
6.x line — there is no 5.x backport — so this bumps:
- workbench/astro: astro ^6.4.6, @astrojs/node 10.1.4, @astrojs/vercel ^10.0.8
- packages/astro: astro devDependency 6.4.6 (typecheck only, not shipped)
Removes both vulnerable astro@5.16.3 and astro@5.18.0 from the lockfile.
Verified the example app builds under both the node and vercel adapters.
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 16, 2026
pranaygp added a commit that referenced this pull request Jun 16, 2026
* origin/main:
fix(core): make deploymentId 'latest' a no-op in non-Vercel worlds (#2397)
fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457)
Small detail panel cleanup (#2459)
Fix lazy Next workflow HMR (#2438)
Prevent peer dependency-only major bumps (#2437)
fix(changesets): only major-bump peer dependents when out of range (#2439)
Version Packages (beta) (#2428)
otel: explicit traceparent injection + linked-trace mode for bounded per-invocation traces (#2363)
[next] Clarify `serverExternalPackages` warning (#2417)
Add .swc gitignore handling to builder (#2427)
Version Packages (beta) (#2390)
[ci] Increase dev.test.ts cleanup hook timeout (#2416)
[world-vercel] Switch event endpoints to v4 wire format (#2055)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@karthikscale3