fix: path-to-regexp override in package.json - #487

Merged
adriandlam merged 1 commit into
mainfrom
fix/path-to-regexp-override
Dec 2, 2025
Merged

fix: path-to-regexp override in package.json#487
adriandlam merged 1 commit into
mainfrom
fix/path-to-regexp-override

Conversation

@adriandlam

@adriandlamadriandlam commented Dec 2, 2025

Copy link
Copy Markdown
Contributor

No description provided.

@vercel

vercelBot commented Dec 2, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentPreviewCommentsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-nextjs-workflow-webpackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-express-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-hono-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nitro-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nuxt-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-sveltekit-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-vite-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workflow-docsReadyReadyPreviewCommentDec 2, 2025 5:37pm

@changeset-bot

changeset-botBot commented Dec 2, 2025

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 35fa111

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions

github-actionsBot commented Dec 2, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.043s (-2.3%)1.019s (~)0.976s1.00x
💻 LocalNitro0.044s (+1.8%)1.007s (~)0.963s1.04x
💻 LocalExpress0.046s (+5.8% 🔺)1.008s (~)0.962s1.07x
🐘 PostgresNext.js (Turbopack)0.294s (-32.1% 🟢)1.021s (~)0.727s6.89x
🐘 PostgresNitro0.300s (+3.0%)1.038s (+2.6%)0.738s7.03x
🐘 PostgresExpress0.341s (-17.0% 🟢)1.013s (-3.7%)0.672s8.01x
▲ VercelNitro0.462s (-11.3% 🟢)1.504s (+7.4% 🔺)1.042s10.84x
▲ VercelExpress0.522s (-9.1% 🟢)2.085s (+30.6% 🔺)1.562s12.26x
▲ VercelNext.js (Turbopack)0.554s (-2.0%)1.448s (+4.1%)0.894s13.01x

workflow with 1 step

WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.102s (~)1.012s (~)0.910s1.00x
💻 LocalNitro0.112s (+2.0%)1.006s (~)0.893s1.10x
💻 LocalExpress0.118s (+5.5% 🔺)1.007s (~)0.889s1.15x
🐘 PostgresNext.js (Turbopack)0.817s (+10.3% 🔺)1.015s (~)0.198s8.01x
🐘 PostgresExpress1.202s (+16.3% 🔺)2.011s (+33.1% 🔺)0.809s11.79x
🐘 PostgresNitro1.379s (+18.3% 🔺)1.910s (-5.0% 🟢)0.531s13.52x
▲ VercelExpress1.459s (-6.7% 🟢)2.505s (-4.0%)1.046s14.30x
▲ VercelNext.js (Turbopack)1.534s (-1.7%)2.450s (+0.8%)0.916s15.04x
▲ VercelNitro1.691s (+9.9% 🔺)2.657s (+9.1% 🔺)0.966s16.58x

workflow with 10 sequential steps

WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.655s (+2.7%)1.010s (~)0.355s1.00x
💻 LocalNitro0.794s (+2.8%)1.005s (~)0.211s1.21x
💻 LocalExpress0.795s (+5.4% 🔺)1.006s (~)0.211s1.21x
🐘 PostgresNext.js (Turbopack)4.848s (-5.0%)5.421s (-10.0% 🟢)0.573s7.40x
🐘 PostgresNitro5.349s (-48.3% 🟢)6.015s (-45.4% 🟢)0.666s8.16x
🐘 PostgresExpress10.280s (+98.3% 🔺)11.025s (+83.2% 🔺)0.745s15.69x
▲ VercelNext.js (Turbopack)10.438s (-6.0% 🟢)11.414s (-2.0%)0.977s15.93x
▲ VercelExpress11.140s (+4.3%)12.057s (+5.8% 🔺)0.917s17.00x
▲ VercelNitro11.921s (+10.2% 🔺)12.907s (+12.9% 🔺)0.986s18.20x

workflow with 10 parallel steps

WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Nitro0.395s (+0.8%)1.006s (~)0.611s1.00x
💻 LocalNext.js (Turbopack)0.401s (+1.8%)1.010s (~)0.609s1.01x
💻 LocalExpress0.430s (+8.6% 🔺)1.006s (~)0.577s1.09x
🐘 PostgresNext.js (Turbopack)1.197s (-6.3% 🟢)2.014s (+9.2% 🔺)0.817s3.03x
🐘 PostgresNitro1.455s (-12.0% 🟢)2.010s (~)0.555s3.68x
🐘 PostgresExpress1.687s (+31.9% 🔺)2.017s (~)0.331s4.27x
▲ VercelNitro2.709s (-4.6%)3.578s (+3.3%)0.869s6.86x
▲ VercelExpress2.855s (+4.0%)3.894s (+6.4% 🔺)1.039s7.23x
▲ VercelNext.js (Turbopack)2.858s (-5.1% 🟢)3.551s (-3.2%)0.693s7.24x

Stream Benchmarks

Stream benchmarks include Time to First Byte (TTFB) metrics.

workflow with stream

WorldFrameworkWorkflow TimeTTFBWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.151s (+2.0%)1.003s (~)1.014s (~)0.863s1.00x
💻 LocalExpress0.181s (+3.2%)0.992s (~)1.009s (~)0.828s1.20x
💻 LocalNitro0.184s (+5.2% 🔺)0.992s (~)1.009s (~)0.824s1.22x
🐘 PostgresNext.js (Turbopack)0.746s (-34.4% 🟢)0.953s (-50.1% 🟢)1.015s (-49.7% 🟢)0.269s4.94x
🐘 PostgresNitro1.181s (-13.7% 🟢)1.863s (+9.5% 🔺)2.012s (~)0.831s7.83x
🐘 PostgresExpress2.329s (+68.0% 🔺)2.712s (+64.2% 🔺)3.014s (+49.7% 🔺)0.685s15.45x
▲ VercelNext.js (Turbopack)2.542s (+4.6%)3.112s (+4.1%)3.504s (+4.9%)0.961s16.86x
▲ VercelNitro2.678s (+7.4% 🔺)3.195s (+13.5% 🔺)3.643s (+14.1% 🔺)0.964s17.76x
▲ VercelExpress2.712s (+15.4% 🔺)3.027s (+20.6% 🔺)3.880s (+33.2% 🔺)1.169s17.98x

Summary: Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)4/5
🐘 PostgresNext.js (Turbopack)5/5
▲ VercelNitro2/5

Summary: Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express💻 Local5/5
Next.js (Turbopack)💻 Local5/5
Nitro💻 Local5/5
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world
  • 🐘 Postgres: PostgreSQL database world
  • ▲ Vercel: Vercel production world

@socket-security

socket-securityBot commented Dec 2, 2025

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

ActionSeverityAlert (click "▶" to expand/collapse)
BlockHigh
High CVE: npm path-to-regexp outputs backtracking regular expressions

CVE:GHSA-9wv6-86v2-598j path-to-regexp outputs backtracking regular expressions (HIGH)

Affected versions: >= 0.2.0 < 1.9.0; < 0.1.10; >= 7.0.0 < 8.0.0; >= 2.0.0 < 3.3.0; >= 4.0.0 < 6.3.0

Patched version: 6.3.0

From:pnpm-lock.yaml → npm/@astrojs/vercel@9.0.2 → npm/path-to-regexp@6.1.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/path-to-regexp@6.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@adriandlam
adriandlam merged commit 9582331 into mainDec 2, 2025
56 of 59 checks passed
@adriandlam
adriandlam deleted the fix/path-to-regexp-override branch December 2, 2025 17:38
adriandlam added a commit that referenced this pull request Dec 2, 2025
@adriandlam
fix: path-to-regexp override in package.json (#487)
0c6312d
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@VaguelySeriousVaguelySeriousVaguelySerious approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@adriandlam@VaguelySerious
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix: path-to-regexp override in package.json - #487
Merged
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Dec 2, 2025
Merged
fix: path-to-regexp override in package.json#487
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Conversation
@adriandlam
@adriandlamadriandlam
commented
Dec 2, 2025

Copy link


Copy Markdown

Contributor
 No description provided. 
@vercel
vercelBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentPreviewCommentsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-nextjs-workflow-webpackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-express-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-hono-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nitro-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nuxt-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-sveltekit-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-vite-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workflow-docsReadyReadyPreviewCommentDec 2, 2025 5:37pm
@changeset-bot
changeset-botBot
commented
Dec 2, 2025

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: 35fa111
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@github-actions
github-actionsBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Benchmark Results
📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.
workflow with no steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.043s (-2.3%)1.019s (~)0.976s1.00x
💻 LocalNitro0.044s (+1.8%)1.007s (~)0.963s1.04x
💻 LocalExpress0.046s (+5.8% 🔺)1.008s (~)0.962s1.07x
🐘 PostgresNext.js (Turbopack)0.294s (-32.1% 🟢)1.021s (~)0.727s6.89x
🐘 PostgresNitro0.300s (+3.0%)1.038s (+2.6%)0.738s7.03x
🐘 PostgresExpress0.341s (-17.0% 🟢)1.013s (-3.7%)0.672s8.01x
▲ VercelNitro0.462s (-11.3% 🟢)1.504s (+7.4% 🔺)1.042s10.84x
▲ VercelExpress0.522s (-9.1% 🟢)2.085s (+30.6% 🔺)1.562s12.26x
▲ VercelNext.js (Turbopack)0.554s (-2.0%)1.448s (+4.1%)0.894s13.01x
workflow with 1 step
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.102s (~)1.012s (~)0.910s1.00x
💻 LocalNitro0.112s (+2.0%)1.006s (~)0.893s1.10x
💻 LocalExpress0.118s (+5.5% 🔺)1.007s (~)0.889s1.15x
🐘 PostgresNext.js (Turbopack)0.817s (+10.3% 🔺)1.015s (~)0.198s8.01x
🐘 PostgresExpress1.202s (+16.3% 🔺)2.011s (+33.1% 🔺)0.809s11.79x
🐘 PostgresNitro1.379s (+18.3% 🔺)1.910s (-5.0% 🟢)0.531s13.52x
▲ VercelExpress1.459s (-6.7% 🟢)2.505s (-4.0%)1.046s14.30x
▲ VercelNext.js (Turbopack)1.534s (-1.7%)2.450s (+0.8%)0.916s15.04x
▲ VercelNitro1.691s (+9.9% 🔺)2.657s (+9.1% 🔺)0.966s16.58x
workflow with 10 sequential steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.655s (+2.7%)1.010s (~)0.355s1.00x
💻 LocalNitro0.794s (+2.8%)1.005s (~)0.211s1.21x
💻 LocalExpress0.795s (+5.4% 🔺)1.006s (~)0.211s1.21x
🐘 PostgresNext.js (Turbopack)4.848s (-5.0%)5.421s (-10.0% 🟢)0.573s7.40x
🐘 PostgresNitro5.349s (-48.3% 🟢)6.015s (-45.4% 🟢)0.666s8.16x
🐘 PostgresExpress10.280s (+98.3% 🔺)11.025s (+83.2% 🔺)0.745s15.69x
▲ VercelNext.js (Turbopack)10.438s (-6.0% 🟢)11.414s (-2.0%)0.977s15.93x
▲ VercelExpress11.140s (+4.3%)12.057s (+5.8% 🔺)0.917s17.00x
▲ VercelNitro11.921s (+10.2% 🔺)12.907s (+12.9% 🔺)0.986s18.20x
workflow with 10 parallel steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Nitro0.395s (+0.8%)1.006s (~)0.611s1.00x
💻 LocalNext.js (Turbopack)0.401s (+1.8%)1.010s (~)0.609s1.01x
💻 LocalExpress0.430s (+8.6% 🔺)1.006s (~)0.577s1.09x
🐘 PostgresNext.js (Turbopack)1.197s (-6.3% 🟢)2.014s (+9.2% 🔺)0.817s3.03x
🐘 PostgresNitro1.455s (-12.0% 🟢)2.010s (~)0.555s3.68x
🐘 PostgresExpress1.687s (+31.9% 🔺)2.017s (~)0.331s4.27x
▲ VercelNitro2.709s (-4.6%)3.578s (+3.3%)0.869s6.86x
▲ VercelExpress2.855s (+4.0%)3.894s (+6.4% 🔺)1.039s7.23x
▲ VercelNext.js (Turbopack)2.858s (-5.1% 🟢)3.551s (-3.2%)0.693s7.24x
Stream Benchmarks
Stream benchmarks include Time to First Byte (TTFB) metrics.
workflow with stream
WorldFrameworkWorkflow TimeTTFBWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.151s (+2.0%)1.003s (~)1.014s (~)0.863s1.00x
💻 LocalExpress0.181s (+3.2%)0.992s (~)1.009s (~)0.828s1.20x
💻 LocalNitro0.184s (+5.2% 🔺)0.992s (~)1.009s (~)0.824s1.22x
🐘 PostgresNext.js (Turbopack)0.746s (-34.4% 🟢)0.953s (-50.1% 🟢)1.015s (-49.7% 🟢)0.269s4.94x
🐘 PostgresNitro1.181s (-13.7% 🟢)1.863s (+9.5% 🔺)2.012s (~)0.831s7.83x
🐘 PostgresExpress2.329s (+68.0% 🔺)2.712s (+64.2% 🔺)3.014s (+49.7% 🔺)0.685s15.45x
▲ VercelNext.js (Turbopack)2.542s (+4.6%)3.112s (+4.1%)3.504s (+4.9%)0.961s16.86x
▲ VercelNitro2.678s (+7.4% 🔺)3.195s (+13.5% 🔺)3.643s (+14.1% 🔺)0.964s17.76x
▲ VercelExpress2.712s (+15.4% 🔺)3.027s (+20.6% 🔺)3.880s (+33.2% 🔺)1.169s17.98x
Summary: Fastest Framework by World
Winner determined by most benchmark wins
World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)4/5
🐘 PostgresNext.js (Turbopack)5/5
▲ VercelNitro2/5
Summary: Fastest World by Framework
Winner determined by most benchmark wins
Framework🥇 Fastest WorldWins
Express💻 Local5/5
Next.js (Turbopack)💻 Local5/5
Nitro💻 Local5/5
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark
Worlds:
  • 💻 Local: In-memory filesystem world
  • 🐘 Postgres: PostgreSQL database world
  • ▲ Vercel: Vercel production world
@socket-security
socket-securityBot
commented
Dec 2, 2025

Copy link


Copy Markdown

Caution
Review the following alerts detected in dependencies.
According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
BlockHigh
High CVE: npm path-to-regexp outputs backtracking regular expressions
CVE:GHSA-9wv6-86v2-598j path-to-regexp outputs backtracking regular expressions (HIGH)
Affected versions: >= 0.2.0 < 1.9.0; < 0.1.10; >= 7.0.0 < 8.0.0; >= 2.0.0 < 3.3.0; >= 4.0.0 < 6.3.0
Patched version: 6.3.0
From:pnpm-lock.yaml → npm/@astrojs/vercel@9.0.2 → npm/path-to-regexp@6.1.0
ℹ Read more on: This package | This alert | What is a CVE?
Next steps: Take a moment to review the security alert
above. Review the linked package source code to understand the potential
risk. Ensure the package is not malicious before proceeding. If you're
unsure how to proceed, reach out to your security team or ask the Socket
team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/path-to-regexp@6.1.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@adriandlam
adriandlam
merged commit 9582331
into
mainDec 2, 2025

56 of 59 checks passed

@adriandlam
adriandlam
deleted the

fix/path-to-regexp-override

branch
December 2, 2025 17:38
adriandlam added a commit
that referenced
this pull request
Dec 2, 2025
@adriandlam
fix: path-to-regexp override in package.json (#487)
0c6312d
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@VaguelySeriousVaguelySeriousVaguelySerious approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@adriandlam@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: path-to-regexp override in package.json - #487
Merged
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Dec 2, 2025
Merged
fix: path-to-regexp override in package.json#487
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Conversation
@adriandlam
@adriandlamadriandlam
commented
Dec 2, 2025

Copy link


Copy Markdown

Contributor
 No description provided. 
@vercel
vercelBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentPreviewCommentsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-nextjs-workflow-webpackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-express-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-hono-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nitro-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nuxt-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-sveltekit-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-vite-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workflow-docsReadyReadyPreviewCommentDec 2, 2025 5:37pm
@changeset-bot
changeset-botBot
commented
Dec 2, 2025

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: 35fa111
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@github-actions
github-actionsBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Benchmark Results
📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.
workflow with no steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.043s (-2.3%)1.019s (~)0.976s1.00x
💻 LocalNitro0.044s (+1.8%)1.007s (~)0.963s1.04x
💻 LocalExpress0.046s (+5.8% 🔺)1.008s (~)0.962s1.07x
🐘 PostgresNext.js (Turbopack)0.294s (-32.1% 🟢)1.021s (~)0.727s6.89x
🐘 PostgresNitro0.300s (+3.0%)1.038s (+2.6%)0.738s7.03x
🐘 PostgresExpress0.341s (-17.0% 🟢)1.013s (-3.7%)0.672s8.01x
▲ VercelNitro0.462s (-11.3% 🟢)1.504s (+7.4% 🔺)1.042s10.84x
▲ VercelExpress0.522s (-9.1% 🟢)2.085s (+30.6% 🔺)1.562s12.26x
▲ VercelNext.js (Turbopack)0.554s (-2.0%)1.448s (+4.1%)0.894s13.01x
workflow with 1 step
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.102s (~)1.012s (~)0.910s1.00x
💻 LocalNitro0.112s (+2.0%)1.006s (~)0.893s1.10x
💻 LocalExpress0.118s (+5.5% 🔺)1.007s (~)0.889s1.15x
🐘 PostgresNext.js (Turbopack)0.817s (+10.3% 🔺)1.015s (~)0.198s8.01x
🐘 PostgresExpress1.202s (+16.3% 🔺)2.011s (+33.1% 🔺)0.809s11.79x
🐘 PostgresNitro1.379s (+18.3% 🔺)1.910s (-5.0% 🟢)0.531s13.52x
▲ VercelExpress1.459s (-6.7% 🟢)2.505s (-4.0%)1.046s14.30x
▲ VercelNext.js (Turbopack)1.534s (-1.7%)2.450s (+0.8%)0.916s15.04x
▲ VercelNitro1.691s (+9.9% 🔺)2.657s (+9.1% 🔺)0.966s16.58x
workflow with 10 sequential steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.655s (+2.7%)1.010s (~)0.355s1.00x
💻 LocalNitro0.794s (+2.8%)1.005s (~)0.211s1.21x
💻 LocalExpress0.795s (+5.4% 🔺)1.006s (~)0.211s1.21x
🐘 PostgresNext.js (Turbopack)4.848s (-5.0%)5.421s (-10.0% 🟢)0.573s7.40x
🐘 PostgresNitro5.349s (-48.3% 🟢)6.015s (-45.4% 🟢)0.666s8.16x
🐘 PostgresExpress10.280s (+98.3% 🔺)11.025s (+83.2% 🔺)0.745s15.69x
▲ VercelNext.js (Turbopack)10.438s (-6.0% 🟢)11.414s (-2.0%)0.977s15.93x
▲ VercelExpress11.140s (+4.3%)12.057s (+5.8% 🔺)0.917s17.00x
▲ VercelNitro11.921s (+10.2% 🔺)12.907s (+12.9% 🔺)0.986s18.20x
workflow with 10 parallel steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Nitro0.395s (+0.8%)1.006s (~)0.611s1.00x
💻 LocalNext.js (Turbopack)0.401s (+1.8%)1.010s (~)0.609s1.01x
💻 LocalExpress0.430s (+8.6% 🔺)1.006s (~)0.577s1.09x
🐘 PostgresNext.js (Turbopack)1.197s (-6.3% 🟢)2.014s (+9.2% 🔺)0.817s3.03x
🐘 PostgresNitro1.455s (-12.0% 🟢)2.010s (~)0.555s3.68x
🐘 PostgresExpress1.687s (+31.9% 🔺)2.017s (~)0.331s4.27x
▲ VercelNitro2.709s (-4.6%)3.578s (+3.3%)0.869s6.86x
▲ VercelExpress2.855s (+4.0%)3.894s (+6.4% 🔺)1.039s7.23x
▲ VercelNext.js (Turbopack)2.858s (-5.1% 🟢)3.551s (-3.2%)0.693s7.24x
Stream Benchmarks
Stream benchmarks include Time to First Byte (TTFB) metrics.
workflow with stream
WorldFrameworkWorkflow TimeTTFBWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.151s (+2.0%)1.003s (~)1.014s (~)0.863s1.00x
💻 LocalExpress0.181s (+3.2%)0.992s (~)1.009s (~)0.828s1.20x
💻 LocalNitro0.184s (+5.2% 🔺)0.992s (~)1.009s (~)0.824s1.22x
🐘 PostgresNext.js (Turbopack)0.746s (-34.4% 🟢)0.953s (-50.1% 🟢)1.015s (-49.7% 🟢)0.269s4.94x
🐘 PostgresNitro1.181s (-13.7% 🟢)1.863s (+9.5% 🔺)2.012s (~)0.831s7.83x
🐘 PostgresExpress2.329s (+68.0% 🔺)2.712s (+64.2% 🔺)3.014s (+49.7% 🔺)0.685s15.45x
▲ VercelNext.js (Turbopack)2.542s (+4.6%)3.112s (+4.1%)3.504s (+4.9%)0.961s16.86x
▲ VercelNitro2.678s (+7.4% 🔺)3.195s (+13.5% 🔺)3.643s (+14.1% 🔺)0.964s17.76x
▲ VercelExpress2.712s (+15.4% 🔺)3.027s (+20.6% 🔺)3.880s (+33.2% 🔺)1.169s17.98x
Summary: Fastest Framework by World
Winner determined by most benchmark wins
World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)4/5
🐘 PostgresNext.js (Turbopack)5/5
▲ VercelNitro2/5
Summary: Fastest World by Framework
Winner determined by most benchmark wins
Framework🥇 Fastest WorldWins
Express💻 Local5/5
Next.js (Turbopack)💻 Local5/5
Nitro💻 Local5/5
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark
Worlds:
  • 💻 Local: In-memory filesystem world
  • 🐘 Postgres: PostgreSQL database world
  • ▲ Vercel: Vercel production world
@socket-security
socket-securityBot
commented
Dec 2, 2025

Copy link


Copy Markdown

Caution
Review the following alerts detected in dependencies.
According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
BlockHigh
High CVE: npm path-to-regexp outputs backtracking regular expressions
CVE:GHSA-9wv6-86v2-598j path-to-regexp outputs backtracking regular expressions (HIGH)
Affected versions: >= 0.2.0 < 1.9.0; < 0.1.10; >= 7.0.0 < 8.0.0; >= 2.0.0 < 3.3.0; >= 4.0.0 < 6.3.0
Patched version: 6.3.0
From:pnpm-lock.yaml → npm/@astrojs/vercel@9.0.2 → npm/path-to-regexp@6.1.0
ℹ Read more on: This package | This alert | What is a CVE?
Next steps: Take a moment to review the security alert
above. Review the linked package source code to understand the potential
risk. Ensure the package is not malicious before proceeding. If you're
unsure how to proceed, reach out to your security team or ask the Socket
team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/path-to-regexp@6.1.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@adriandlam
adriandlam
merged commit 9582331
into
mainDec 2, 2025

56 of 59 checks passed

@adriandlam
adriandlam
deleted the

fix/path-to-regexp-override

branch
December 2, 2025 17:38
adriandlam added a commit
that referenced
this pull request
Dec 2, 2025
@adriandlam
fix: path-to-regexp override in package.json (#487)
0c6312d
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@VaguelySeriousVaguelySeriousVaguelySerious approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@adriandlam@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: path-to-regexp override in package.json - #487
Merged
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Dec 2, 2025
Merged
fix: path-to-regexp override in package.json#487
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Conversation
@adriandlam
@adriandlamadriandlam
commented
Dec 2, 2025

Copy link


Copy Markdown

Contributor
 No description provided. 
@vercel
vercelBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentPreviewCommentsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-nextjs-workflow-webpackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-express-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-hono-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nitro-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nuxt-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-sveltekit-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-vite-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workflow-docsReadyReadyPreviewCommentDec 2, 2025 5:37pm
@changeset-bot
changeset-botBot
commented
Dec 2, 2025

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: 35fa111
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@github-actions
github-actionsBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Benchmark Results
📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.
workflow with no steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.043s (-2.3%)1.019s (~)0.976s1.00x
💻 LocalNitro0.044s (+1.8%)1.007s (~)0.963s1.04x
💻 LocalExpress0.046s (+5.8% 🔺)1.008s (~)0.962s1.07x
🐘 PostgresNext.js (Turbopack)0.294s (-32.1% 🟢)1.021s (~)0.727s6.89x
🐘 PostgresNitro0.300s (+3.0%)1.038s (+2.6%)0.738s7.03x
🐘 PostgresExpress0.341s (-17.0% 🟢)1.013s (-3.7%)0.672s8.01x
▲ VercelNitro0.462s (-11.3% 🟢)1.504s (+7.4% 🔺)1.042s10.84x
▲ VercelExpress0.522s (-9.1% 🟢)2.085s (+30.6% 🔺)1.562s12.26x
▲ VercelNext.js (Turbopack)0.554s (-2.0%)1.448s (+4.1%)0.894s13.01x
workflow with 1 step
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.102s (~)1.012s (~)0.910s1.00x
💻 LocalNitro0.112s (+2.0%)1.006s (~)0.893s1.10x
💻 LocalExpress0.118s (+5.5% 🔺)1.007s (~)0.889s1.15x
🐘 PostgresNext.js (Turbopack)0.817s (+10.3% 🔺)1.015s (~)0.198s8.01x
🐘 PostgresExpress1.202s (+16.3% 🔺)2.011s (+33.1% 🔺)0.809s11.79x
🐘 PostgresNitro1.379s (+18.3% 🔺)1.910s (-5.0% 🟢)0.531s13.52x
▲ VercelExpress1.459s (-6.7% 🟢)2.505s (-4.0%)1.046s14.30x
▲ VercelNext.js (Turbopack)1.534s (-1.7%)2.450s (+0.8%)0.916s15.04x
▲ VercelNitro1.691s (+9.9% 🔺)2.657s (+9.1% 🔺)0.966s16.58x
workflow with 10 sequential steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.655s (+2.7%)1.010s (~)0.355s1.00x
💻 LocalNitro0.794s (+2.8%)1.005s (~)0.211s1.21x
💻 LocalExpress0.795s (+5.4% 🔺)1.006s (~)0.211s1.21x
🐘 PostgresNext.js (Turbopack)4.848s (-5.0%)5.421s (-10.0% 🟢)0.573s7.40x
🐘 PostgresNitro5.349s (-48.3% 🟢)6.015s (-45.4% 🟢)0.666s8.16x
🐘 PostgresExpress10.280s (+98.3% 🔺)11.025s (+83.2% 🔺)0.745s15.69x
▲ VercelNext.js (Turbopack)10.438s (-6.0% 🟢)11.414s (-2.0%)0.977s15.93x
▲ VercelExpress11.140s (+4.3%)12.057s (+5.8% 🔺)0.917s17.00x
▲ VercelNitro11.921s (+10.2% 🔺)12.907s (+12.9% 🔺)0.986s18.20x
workflow with 10 parallel steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Nitro0.395s (+0.8%)1.006s (~)0.611s1.00x
💻 LocalNext.js (Turbopack)0.401s (+1.8%)1.010s (~)0.609s1.01x
💻 LocalExpress0.430s (+8.6% 🔺)1.006s (~)0.577s1.09x
🐘 PostgresNext.js (Turbopack)1.197s (-6.3% 🟢)2.014s (+9.2% 🔺)0.817s3.03x
🐘 PostgresNitro1.455s (-12.0% 🟢)2.010s (~)0.555s3.68x
🐘 PostgresExpress1.687s (+31.9% 🔺)2.017s (~)0.331s4.27x
▲ VercelNitro2.709s (-4.6%)3.578s (+3.3%)0.869s6.86x
▲ VercelExpress2.855s (+4.0%)3.894s (+6.4% 🔺)1.039s7.23x
▲ VercelNext.js (Turbopack)2.858s (-5.1% 🟢)3.551s (-3.2%)0.693s7.24x
Stream Benchmarks
Stream benchmarks include Time to First Byte (TTFB) metrics.
workflow with stream
WorldFrameworkWorkflow TimeTTFBWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.151s (+2.0%)1.003s (~)1.014s (~)0.863s1.00x
💻 LocalExpress0.181s (+3.2%)0.992s (~)1.009s (~)0.828s1.20x
💻 LocalNitro0.184s (+5.2% 🔺)0.992s (~)1.009s (~)0.824s1.22x
🐘 PostgresNext.js (Turbopack)0.746s (-34.4% 🟢)0.953s (-50.1% 🟢)1.015s (-49.7% 🟢)0.269s4.94x
🐘 PostgresNitro1.181s (-13.7% 🟢)1.863s (+9.5% 🔺)2.012s (~)0.831s7.83x
🐘 PostgresExpress2.329s (+68.0% 🔺)2.712s (+64.2% 🔺)3.014s (+49.7% 🔺)0.685s15.45x
▲ VercelNext.js (Turbopack)2.542s (+4.6%)3.112s (+4.1%)3.504s (+4.9%)0.961s16.86x
▲ VercelNitro2.678s (+7.4% 🔺)3.195s (+13.5% 🔺)3.643s (+14.1% 🔺)0.964s17.76x
▲ VercelExpress2.712s (+15.4% 🔺)3.027s (+20.6% 🔺)3.880s (+33.2% 🔺)1.169s17.98x
Summary: Fastest Framework by World
Winner determined by most benchmark wins
World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)4/5
🐘 PostgresNext.js (Turbopack)5/5
▲ VercelNitro2/5
Summary: Fastest World by Framework
Winner determined by most benchmark wins
Framework🥇 Fastest WorldWins
Express💻 Local5/5
Next.js (Turbopack)💻 Local5/5
Nitro💻 Local5/5
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark
Worlds:
  • 💻 Local: In-memory filesystem world
  • 🐘 Postgres: PostgreSQL database world
  • ▲ Vercel: Vercel production world
@socket-security
socket-securityBot
commented
Dec 2, 2025

Copy link


Copy Markdown

Caution
Review the following alerts detected in dependencies.
According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
BlockHigh
High CVE: npm path-to-regexp outputs backtracking regular expressions
CVE:GHSA-9wv6-86v2-598j path-to-regexp outputs backtracking regular expressions (HIGH)
Affected versions: >= 0.2.0 < 1.9.0; < 0.1.10; >= 7.0.0 < 8.0.0; >= 2.0.0 < 3.3.0; >= 4.0.0 < 6.3.0
Patched version: 6.3.0
From:pnpm-lock.yaml → npm/@astrojs/vercel@9.0.2 → npm/path-to-regexp@6.1.0
ℹ Read more on: This package | This alert | What is a CVE?
Next steps: Take a moment to review the security alert
above. Review the linked package source code to understand the potential
risk. Ensure the package is not malicious before proceeding. If you're
unsure how to proceed, reach out to your security team or ask the Socket
team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/path-to-regexp@6.1.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@adriandlam
adriandlam
merged commit 9582331
into
mainDec 2, 2025

56 of 59 checks passed

@adriandlam
adriandlam
deleted the

fix/path-to-regexp-override

branch
December 2, 2025 17:38
adriandlam added a commit
that referenced
this pull request
Dec 2, 2025
@adriandlam
fix: path-to-regexp override in package.json (#487)
0c6312d
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@VaguelySeriousVaguelySeriousVaguelySerious approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@adriandlam@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix: path-to-regexp override in package.json - #487
Merged
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Dec 2, 2025
Merged
fix: path-to-regexp override in package.json#487
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Conversation
@adriandlam
@adriandlamadriandlam
commented
Dec 2, 2025

Copy link


Copy Markdown

Contributor
 No description provided. 
@vercel
vercelBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentPreviewCommentsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-nextjs-workflow-webpackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-express-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-hono-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nitro-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nuxt-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-sveltekit-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-vite-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workflow-docsReadyReadyPreviewCommentDec 2, 2025 5:37pm
@changeset-bot
changeset-botBot
commented
Dec 2, 2025

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: 35fa111
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@github-actions
github-actionsBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Benchmark Results
📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.
workflow with no steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.043s (-2.3%)1.019s (~)0.976s1.00x
💻 LocalNitro0.044s (+1.8%)1.007s (~)0.963s1.04x
💻 LocalExpress0.046s (+5.8% 🔺)1.008s (~)0.962s1.07x
🐘 PostgresNext.js (Turbopack)0.294s (-32.1% 🟢)1.021s (~)0.727s6.89x
🐘 PostgresNitro0.300s (+3.0%)1.038s (+2.6%)0.738s7.03x
🐘 PostgresExpress0.341s (-17.0% 🟢)1.013s (-3.7%)0.672s8.01x
▲ VercelNitro0.462s (-11.3% 🟢)1.504s (+7.4% 🔺)1.042s10.84x
▲ VercelExpress0.522s (-9.1% 🟢)2.085s (+30.6% 🔺)1.562s12.26x
▲ VercelNext.js (Turbopack)0.554s (-2.0%)1.448s (+4.1%)0.894s13.01x
workflow with 1 step
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.102s (~)1.012s (~)0.910s1.00x
💻 LocalNitro0.112s (+2.0%)1.006s (~)0.893s1.10x
💻 LocalExpress0.118s (+5.5% 🔺)1.007s (~)0.889s1.15x
🐘 PostgresNext.js (Turbopack)0.817s (+10.3% 🔺)1.015s (~)0.198s8.01x
🐘 PostgresExpress1.202s (+16.3% 🔺)2.011s (+33.1% 🔺)0.809s11.79x
🐘 PostgresNitro1.379s (+18.3% 🔺)1.910s (-5.0% 🟢)0.531s13.52x
▲ VercelExpress1.459s (-6.7% 🟢)2.505s (-4.0%)1.046s14.30x
▲ VercelNext.js (Turbopack)1.534s (-1.7%)2.450s (+0.8%)0.916s15.04x
▲ VercelNitro1.691s (+9.9% 🔺)2.657s (+9.1% 🔺)0.966s16.58x
workflow with 10 sequential steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.655s (+2.7%)1.010s (~)0.355s1.00x
💻 LocalNitro0.794s (+2.8%)1.005s (~)0.211s1.21x
💻 LocalExpress0.795s (+5.4% 🔺)1.006s (~)0.211s1.21x
🐘 PostgresNext.js (Turbopack)4.848s (-5.0%)5.421s (-10.0% 🟢)0.573s7.40x
🐘 PostgresNitro5.349s (-48.3% 🟢)6.015s (-45.4% 🟢)0.666s8.16x
🐘 PostgresExpress10.280s (+98.3% 🔺)11.025s (+83.2% 🔺)0.745s15.69x
▲ VercelNext.js (Turbopack)10.438s (-6.0% 🟢)11.414s (-2.0%)0.977s15.93x
▲ VercelExpress11.140s (+4.3%)12.057s (+5.8% 🔺)0.917s17.00x
▲ VercelNitro11.921s (+10.2% 🔺)12.907s (+12.9% 🔺)0.986s18.20x
workflow with 10 parallel steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Nitro0.395s (+0.8%)1.006s (~)0.611s1.00x
💻 LocalNext.js (Turbopack)0.401s (+1.8%)1.010s (~)0.609s1.01x
💻 LocalExpress0.430s (+8.6% 🔺)1.006s (~)0.577s1.09x
🐘 PostgresNext.js (Turbopack)1.197s (-6.3% 🟢)2.014s (+9.2% 🔺)0.817s3.03x
🐘 PostgresNitro1.455s (-12.0% 🟢)2.010s (~)0.555s3.68x
🐘 PostgresExpress1.687s (+31.9% 🔺)2.017s (~)0.331s4.27x
▲ VercelNitro2.709s (-4.6%)3.578s (+3.3%)0.869s6.86x
▲ VercelExpress2.855s (+4.0%)3.894s (+6.4% 🔺)1.039s7.23x
▲ VercelNext.js (Turbopack)2.858s (-5.1% 🟢)3.551s (-3.2%)0.693s7.24x
Stream Benchmarks
Stream benchmarks include Time to First Byte (TTFB) metrics.
workflow with stream
WorldFrameworkWorkflow TimeTTFBWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.151s (+2.0%)1.003s (~)1.014s (~)0.863s1.00x
💻 LocalExpress0.181s (+3.2%)0.992s (~)1.009s (~)0.828s1.20x
💻 LocalNitro0.184s (+5.2% 🔺)0.992s (~)1.009s (~)0.824s1.22x
🐘 PostgresNext.js (Turbopack)0.746s (-34.4% 🟢)0.953s (-50.1% 🟢)1.015s (-49.7% 🟢)0.269s4.94x
🐘 PostgresNitro1.181s (-13.7% 🟢)1.863s (+9.5% 🔺)2.012s (~)0.831s7.83x
🐘 PostgresExpress2.329s (+68.0% 🔺)2.712s (+64.2% 🔺)3.014s (+49.7% 🔺)0.685s15.45x
▲ VercelNext.js (Turbopack)2.542s (+4.6%)3.112s (+4.1%)3.504s (+4.9%)0.961s16.86x
▲ VercelNitro2.678s (+7.4% 🔺)3.195s (+13.5% 🔺)3.643s (+14.1% 🔺)0.964s17.76x
▲ VercelExpress2.712s (+15.4% 🔺)3.027s (+20.6% 🔺)3.880s (+33.2% 🔺)1.169s17.98x
Summary: Fastest Framework by World
Winner determined by most benchmark wins
World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)4/5
🐘 PostgresNext.js (Turbopack)5/5
▲ VercelNitro2/5
Summary: Fastest World by Framework
Winner determined by most benchmark wins
Framework🥇 Fastest WorldWins
Express💻 Local5/5
Next.js (Turbopack)💻 Local5/5
Nitro💻 Local5/5
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark
Worlds:
  • 💻 Local: In-memory filesystem world
  • 🐘 Postgres: PostgreSQL database world
  • ▲ Vercel: Vercel production world
@socket-security
socket-securityBot
commented
Dec 2, 2025

Copy link


Copy Markdown

Caution
Review the following alerts detected in dependencies.
According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
BlockHigh
High CVE: npm path-to-regexp outputs backtracking regular expressions
CVE:GHSA-9wv6-86v2-598j path-to-regexp outputs backtracking regular expressions (HIGH)
Affected versions: >= 0.2.0 < 1.9.0; < 0.1.10; >= 7.0.0 < 8.0.0; >= 2.0.0 < 3.3.0; >= 4.0.0 < 6.3.0
Patched version: 6.3.0
From:pnpm-lock.yaml → npm/@astrojs/vercel@9.0.2 → npm/path-to-regexp@6.1.0
ℹ Read more on: This package | This alert | What is a CVE?
Next steps: Take a moment to review the security alert
above. Review the linked package source code to understand the potential
risk. Ensure the package is not malicious before proceeding. If you're
unsure how to proceed, reach out to your security team or ask the Socket
team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/path-to-regexp@6.1.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@adriandlam
adriandlam
merged commit 9582331
into
mainDec 2, 2025

56 of 59 checks passed

@adriandlam
adriandlam
deleted the

fix/path-to-regexp-override

branch
December 2, 2025 17:38
adriandlam added a commit
that referenced
this pull request
Dec 2, 2025
@adriandlam
fix: path-to-regexp override in package.json (#487)
0c6312d
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@VaguelySeriousVaguelySeriousVaguelySerious approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@adriandlam@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: path-to-regexp override in package.json - #487
Merged
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Dec 2, 2025
Merged
fix: path-to-regexp override in package.json#487
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Conversation
@adriandlam
@adriandlamadriandlam
commented
Dec 2, 2025

Copy link


Copy Markdown

Contributor
 No description provided. 
@vercel
vercelBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentPreviewCommentsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-nextjs-workflow-webpackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-express-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-hono-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nitro-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nuxt-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-sveltekit-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-vite-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workflow-docsReadyReadyPreviewCommentDec 2, 2025 5:37pm
@changeset-bot
changeset-botBot
commented
Dec 2, 2025

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: 35fa111
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@github-actions
github-actionsBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Benchmark Results
📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.
workflow with no steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.043s (-2.3%)1.019s (~)0.976s1.00x
💻 LocalNitro0.044s (+1.8%)1.007s (~)0.963s1.04x
💻 LocalExpress0.046s (+5.8% 🔺)1.008s (~)0.962s1.07x
🐘 PostgresNext.js (Turbopack)0.294s (-32.1% 🟢)1.021s (~)0.727s6.89x
🐘 PostgresNitro0.300s (+3.0%)1.038s (+2.6%)0.738s7.03x
🐘 PostgresExpress0.341s (-17.0% 🟢)1.013s (-3.7%)0.672s8.01x
▲ VercelNitro0.462s (-11.3% 🟢)1.504s (+7.4% 🔺)1.042s10.84x
▲ VercelExpress0.522s (-9.1% 🟢)2.085s (+30.6% 🔺)1.562s12.26x
▲ VercelNext.js (Turbopack)0.554s (-2.0%)1.448s (+4.1%)0.894s13.01x
workflow with 1 step
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.102s (~)1.012s (~)0.910s1.00x
💻 LocalNitro0.112s (+2.0%)1.006s (~)0.893s1.10x
💻 LocalExpress0.118s (+5.5% 🔺)1.007s (~)0.889s1.15x
🐘 PostgresNext.js (Turbopack)0.817s (+10.3% 🔺)1.015s (~)0.198s8.01x
🐘 PostgresExpress1.202s (+16.3% 🔺)2.011s (+33.1% 🔺)0.809s11.79x
🐘 PostgresNitro1.379s (+18.3% 🔺)1.910s (-5.0% 🟢)0.531s13.52x
▲ VercelExpress1.459s (-6.7% 🟢)2.505s (-4.0%)1.046s14.30x
▲ VercelNext.js (Turbopack)1.534s (-1.7%)2.450s (+0.8%)0.916s15.04x
▲ VercelNitro1.691s (+9.9% 🔺)2.657s (+9.1% 🔺)0.966s16.58x
workflow with 10 sequential steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.655s (+2.7%)1.010s (~)0.355s1.00x
💻 LocalNitro0.794s (+2.8%)1.005s (~)0.211s1.21x
💻 LocalExpress0.795s (+5.4% 🔺)1.006s (~)0.211s1.21x
🐘 PostgresNext.js (Turbopack)4.848s (-5.0%)5.421s (-10.0% 🟢)0.573s7.40x
🐘 PostgresNitro5.349s (-48.3% 🟢)6.015s (-45.4% 🟢)0.666s8.16x
🐘 PostgresExpress10.280s (+98.3% 🔺)11.025s (+83.2% 🔺)0.745s15.69x
▲ VercelNext.js (Turbopack)10.438s (-6.0% 🟢)11.414s (-2.0%)0.977s15.93x
▲ VercelExpress11.140s (+4.3%)12.057s (+5.8% 🔺)0.917s17.00x
▲ VercelNitro11.921s (+10.2% 🔺)12.907s (+12.9% 🔺)0.986s18.20x
workflow with 10 parallel steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Nitro0.395s (+0.8%)1.006s (~)0.611s1.00x
💻 LocalNext.js (Turbopack)0.401s (+1.8%)1.010s (~)0.609s1.01x
💻 LocalExpress0.430s (+8.6% 🔺)1.006s (~)0.577s1.09x
🐘 PostgresNext.js (Turbopack)1.197s (-6.3% 🟢)2.014s (+9.2% 🔺)0.817s3.03x
🐘 PostgresNitro1.455s (-12.0% 🟢)2.010s (~)0.555s3.68x
🐘 PostgresExpress1.687s (+31.9% 🔺)2.017s (~)0.331s4.27x
▲ VercelNitro2.709s (-4.6%)3.578s (+3.3%)0.869s6.86x
▲ VercelExpress2.855s (+4.0%)3.894s (+6.4% 🔺)1.039s7.23x
▲ VercelNext.js (Turbopack)2.858s (-5.1% 🟢)3.551s (-3.2%)0.693s7.24x
Stream Benchmarks
Stream benchmarks include Time to First Byte (TTFB) metrics.
workflow with stream
WorldFrameworkWorkflow TimeTTFBWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.151s (+2.0%)1.003s (~)1.014s (~)0.863s1.00x
💻 LocalExpress0.181s (+3.2%)0.992s (~)1.009s (~)0.828s1.20x
💻 LocalNitro0.184s (+5.2% 🔺)0.992s (~)1.009s (~)0.824s1.22x
🐘 PostgresNext.js (Turbopack)0.746s (-34.4% 🟢)0.953s (-50.1% 🟢)1.015s (-49.7% 🟢)0.269s4.94x
🐘 PostgresNitro1.181s (-13.7% 🟢)1.863s (+9.5% 🔺)2.012s (~)0.831s7.83x
🐘 PostgresExpress2.329s (+68.0% 🔺)2.712s (+64.2% 🔺)3.014s (+49.7% 🔺)0.685s15.45x
▲ VercelNext.js (Turbopack)2.542s (+4.6%)3.112s (+4.1%)3.504s (+4.9%)0.961s16.86x
▲ VercelNitro2.678s (+7.4% 🔺)3.195s (+13.5% 🔺)3.643s (+14.1% 🔺)0.964s17.76x
▲ VercelExpress2.712s (+15.4% 🔺)3.027s (+20.6% 🔺)3.880s (+33.2% 🔺)1.169s17.98x
Summary: Fastest Framework by World
Winner determined by most benchmark wins
World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)4/5
🐘 PostgresNext.js (Turbopack)5/5
▲ VercelNitro2/5
Summary: Fastest World by Framework
Winner determined by most benchmark wins
Framework🥇 Fastest WorldWins
Express💻 Local5/5
Next.js (Turbopack)💻 Local5/5
Nitro💻 Local5/5
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark
Worlds:
  • 💻 Local: In-memory filesystem world
  • 🐘 Postgres: PostgreSQL database world
  • ▲ Vercel: Vercel production world
@socket-security
socket-securityBot
commented
Dec 2, 2025

Copy link


Copy Markdown

Caution
Review the following alerts detected in dependencies.
According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
BlockHigh
High CVE: npm path-to-regexp outputs backtracking regular expressions
CVE:GHSA-9wv6-86v2-598j path-to-regexp outputs backtracking regular expressions (HIGH)
Affected versions: >= 0.2.0 < 1.9.0; < 0.1.10; >= 7.0.0 < 8.0.0; >= 2.0.0 < 3.3.0; >= 4.0.0 < 6.3.0
Patched version: 6.3.0
From:pnpm-lock.yaml → npm/@astrojs/vercel@9.0.2 → npm/path-to-regexp@6.1.0
ℹ Read more on: This package | This alert | What is a CVE?
Next steps: Take a moment to review the security alert
above. Review the linked package source code to understand the potential
risk. Ensure the package is not malicious before proceeding. If you're
unsure how to proceed, reach out to your security team or ask the Socket
team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/path-to-regexp@6.1.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@adriandlam
adriandlam
merged commit 9582331
into
mainDec 2, 2025

56 of 59 checks passed

@adriandlam
adriandlam
deleted the

fix/path-to-regexp-override

branch
December 2, 2025 17:38
adriandlam added a commit
that referenced
this pull request
Dec 2, 2025
@adriandlam
fix: path-to-regexp override in package.json (#487)
0c6312d
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@VaguelySeriousVaguelySeriousVaguelySerious approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@adriandlam@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: path-to-regexp override in package.json - #487
Merged
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Dec 2, 2025
Merged
fix: path-to-regexp override in package.json#487
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Conversation
@adriandlam
@adriandlamadriandlam
commented
Dec 2, 2025

Copy link


Copy Markdown

Contributor
 No description provided. 
@vercel
vercelBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentPreviewCommentsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-nextjs-workflow-webpackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-express-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-hono-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nitro-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nuxt-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-sveltekit-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-vite-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workflow-docsReadyReadyPreviewCommentDec 2, 2025 5:37pm
@changeset-bot
changeset-botBot
commented
Dec 2, 2025

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: 35fa111
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@github-actions
github-actionsBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Benchmark Results
📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.
workflow with no steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.043s (-2.3%)1.019s (~)0.976s1.00x
💻 LocalNitro0.044s (+1.8%)1.007s (~)0.963s1.04x
💻 LocalExpress0.046s (+5.8% 🔺)1.008s (~)0.962s1.07x
🐘 PostgresNext.js (Turbopack)0.294s (-32.1% 🟢)1.021s (~)0.727s6.89x
🐘 PostgresNitro0.300s (+3.0%)1.038s (+2.6%)0.738s7.03x
🐘 PostgresExpress0.341s (-17.0% 🟢)1.013s (-3.7%)0.672s8.01x
▲ VercelNitro0.462s (-11.3% 🟢)1.504s (+7.4% 🔺)1.042s10.84x
▲ VercelExpress0.522s (-9.1% 🟢)2.085s (+30.6% 🔺)1.562s12.26x
▲ VercelNext.js (Turbopack)0.554s (-2.0%)1.448s (+4.1%)0.894s13.01x
workflow with 1 step
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.102s (~)1.012s (~)0.910s1.00x
💻 LocalNitro0.112s (+2.0%)1.006s (~)0.893s1.10x
💻 LocalExpress0.118s (+5.5% 🔺)1.007s (~)0.889s1.15x
🐘 PostgresNext.js (Turbopack)0.817s (+10.3% 🔺)1.015s (~)0.198s8.01x
🐘 PostgresExpress1.202s (+16.3% 🔺)2.011s (+33.1% 🔺)0.809s11.79x
🐘 PostgresNitro1.379s (+18.3% 🔺)1.910s (-5.0% 🟢)0.531s13.52x
▲ VercelExpress1.459s (-6.7% 🟢)2.505s (-4.0%)1.046s14.30x
▲ VercelNext.js (Turbopack)1.534s (-1.7%)2.450s (+0.8%)0.916s15.04x
▲ VercelNitro1.691s (+9.9% 🔺)2.657s (+9.1% 🔺)0.966s16.58x
workflow with 10 sequential steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.655s (+2.7%)1.010s (~)0.355s1.00x
💻 LocalNitro0.794s (+2.8%)1.005s (~)0.211s1.21x
💻 LocalExpress0.795s (+5.4% 🔺)1.006s (~)0.211s1.21x
🐘 PostgresNext.js (Turbopack)4.848s (-5.0%)5.421s (-10.0% 🟢)0.573s7.40x
🐘 PostgresNitro5.349s (-48.3% 🟢)6.015s (-45.4% 🟢)0.666s8.16x
🐘 PostgresExpress10.280s (+98.3% 🔺)11.025s (+83.2% 🔺)0.745s15.69x
▲ VercelNext.js (Turbopack)10.438s (-6.0% 🟢)11.414s (-2.0%)0.977s15.93x
▲ VercelExpress11.140s (+4.3%)12.057s (+5.8% 🔺)0.917s17.00x
▲ VercelNitro11.921s (+10.2% 🔺)12.907s (+12.9% 🔺)0.986s18.20x
workflow with 10 parallel steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Nitro0.395s (+0.8%)1.006s (~)0.611s1.00x
💻 LocalNext.js (Turbopack)0.401s (+1.8%)1.010s (~)0.609s1.01x
💻 LocalExpress0.430s (+8.6% 🔺)1.006s (~)0.577s1.09x
🐘 PostgresNext.js (Turbopack)1.197s (-6.3% 🟢)2.014s (+9.2% 🔺)0.817s3.03x
🐘 PostgresNitro1.455s (-12.0% 🟢)2.010s (~)0.555s3.68x
🐘 PostgresExpress1.687s (+31.9% 🔺)2.017s (~)0.331s4.27x
▲ VercelNitro2.709s (-4.6%)3.578s (+3.3%)0.869s6.86x
▲ VercelExpress2.855s (+4.0%)3.894s (+6.4% 🔺)1.039s7.23x
▲ VercelNext.js (Turbopack)2.858s (-5.1% 🟢)3.551s (-3.2%)0.693s7.24x
Stream Benchmarks
Stream benchmarks include Time to First Byte (TTFB) metrics.
workflow with stream
WorldFrameworkWorkflow TimeTTFBWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.151s (+2.0%)1.003s (~)1.014s (~)0.863s1.00x
💻 LocalExpress0.181s (+3.2%)0.992s (~)1.009s (~)0.828s1.20x
💻 LocalNitro0.184s (+5.2% 🔺)0.992s (~)1.009s (~)0.824s1.22x
🐘 PostgresNext.js (Turbopack)0.746s (-34.4% 🟢)0.953s (-50.1% 🟢)1.015s (-49.7% 🟢)0.269s4.94x
🐘 PostgresNitro1.181s (-13.7% 🟢)1.863s (+9.5% 🔺)2.012s (~)0.831s7.83x
🐘 PostgresExpress2.329s (+68.0% 🔺)2.712s (+64.2% 🔺)3.014s (+49.7% 🔺)0.685s15.45x
▲ VercelNext.js (Turbopack)2.542s (+4.6%)3.112s (+4.1%)3.504s (+4.9%)0.961s16.86x
▲ VercelNitro2.678s (+7.4% 🔺)3.195s (+13.5% 🔺)3.643s (+14.1% 🔺)0.964s17.76x
▲ VercelExpress2.712s (+15.4% 🔺)3.027s (+20.6% 🔺)3.880s (+33.2% 🔺)1.169s17.98x
Summary: Fastest Framework by World
Winner determined by most benchmark wins
World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)4/5
🐘 PostgresNext.js (Turbopack)5/5
▲ VercelNitro2/5
Summary: Fastest World by Framework
Winner determined by most benchmark wins
Framework🥇 Fastest WorldWins
Express💻 Local5/5
Next.js (Turbopack)💻 Local5/5
Nitro💻 Local5/5
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark
Worlds:
  • 💻 Local: In-memory filesystem world
  • 🐘 Postgres: PostgreSQL database world
  • ▲ Vercel: Vercel production world
@socket-security
socket-securityBot
commented
Dec 2, 2025

Copy link


Copy Markdown

Caution
Review the following alerts detected in dependencies.
According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
BlockHigh
High CVE: npm path-to-regexp outputs backtracking regular expressions
CVE:GHSA-9wv6-86v2-598j path-to-regexp outputs backtracking regular expressions (HIGH)
Affected versions: >= 0.2.0 < 1.9.0; < 0.1.10; >= 7.0.0 < 8.0.0; >= 2.0.0 < 3.3.0; >= 4.0.0 < 6.3.0
Patched version: 6.3.0
From:pnpm-lock.yaml → npm/@astrojs/vercel@9.0.2 → npm/path-to-regexp@6.1.0
ℹ Read more on: This package | This alert | What is a CVE?
Next steps: Take a moment to review the security alert
above. Review the linked package source code to understand the potential
risk. Ensure the package is not malicious before proceeding. If you're
unsure how to proceed, reach out to your security team or ask the Socket
team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/path-to-regexp@6.1.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@adriandlam
adriandlam
merged commit 9582331
into
mainDec 2, 2025

56 of 59 checks passed

@adriandlam
adriandlam
deleted the

fix/path-to-regexp-override

branch
December 2, 2025 17:38
adriandlam added a commit
that referenced
this pull request
Dec 2, 2025
@adriandlam
fix: path-to-regexp override in package.json (#487)
0c6312d
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@VaguelySeriousVaguelySeriousVaguelySerious approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@adriandlam@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix: path-to-regexp override in package.json - #487
Merged
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Dec 2, 2025
Merged
fix: path-to-regexp override in package.json#487
adriandlam merged 1 commit into
mainfrom 
fix/path-to-regexp-override
Conversation
@adriandlam
@adriandlamadriandlam
commented
Dec 2, 2025

Copy link


Copy Markdown

Contributor
 No description provided. 
@vercel
vercelBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentPreviewCommentsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-nextjs-workflow-webpackReadyReadyPreviewCommentDec 2, 2025 5:37pm
example-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-express-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-hono-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nitro-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-nuxt-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-sveltekit-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workbench-vite-workflowReadyReadyPreviewCommentDec 2, 2025 5:37pm
workflow-docsReadyReadyPreviewCommentDec 2, 2025 5:37pm
@changeset-bot
changeset-botBot
commented
Dec 2, 2025

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: 35fa111
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@github-actions
github-actionsBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Benchmark Results
📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.
workflow with no steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.043s (-2.3%)1.019s (~)0.976s1.00x
💻 LocalNitro0.044s (+1.8%)1.007s (~)0.963s1.04x
💻 LocalExpress0.046s (+5.8% 🔺)1.008s (~)0.962s1.07x
🐘 PostgresNext.js (Turbopack)0.294s (-32.1% 🟢)1.021s (~)0.727s6.89x
🐘 PostgresNitro0.300s (+3.0%)1.038s (+2.6%)0.738s7.03x
🐘 PostgresExpress0.341s (-17.0% 🟢)1.013s (-3.7%)0.672s8.01x
▲ VercelNitro0.462s (-11.3% 🟢)1.504s (+7.4% 🔺)1.042s10.84x
▲ VercelExpress0.522s (-9.1% 🟢)2.085s (+30.6% 🔺)1.562s12.26x
▲ VercelNext.js (Turbopack)0.554s (-2.0%)1.448s (+4.1%)0.894s13.01x
workflow with 1 step
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.102s (~)1.012s (~)0.910s1.00x
💻 LocalNitro0.112s (+2.0%)1.006s (~)0.893s1.10x
💻 LocalExpress0.118s (+5.5% 🔺)1.007s (~)0.889s1.15x
🐘 PostgresNext.js (Turbopack)0.817s (+10.3% 🔺)1.015s (~)0.198s8.01x
🐘 PostgresExpress1.202s (+16.3% 🔺)2.011s (+33.1% 🔺)0.809s11.79x
🐘 PostgresNitro1.379s (+18.3% 🔺)1.910s (-5.0% 🟢)0.531s13.52x
▲ VercelExpress1.459s (-6.7% 🟢)2.505s (-4.0%)1.046s14.30x
▲ VercelNext.js (Turbopack)1.534s (-1.7%)2.450s (+0.8%)0.916s15.04x
▲ VercelNitro1.691s (+9.9% 🔺)2.657s (+9.1% 🔺)0.966s16.58x
workflow with 10 sequential steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.655s (+2.7%)1.010s (~)0.355s1.00x
💻 LocalNitro0.794s (+2.8%)1.005s (~)0.211s1.21x
💻 LocalExpress0.795s (+5.4% 🔺)1.006s (~)0.211s1.21x
🐘 PostgresNext.js (Turbopack)4.848s (-5.0%)5.421s (-10.0% 🟢)0.573s7.40x
🐘 PostgresNitro5.349s (-48.3% 🟢)6.015s (-45.4% 🟢)0.666s8.16x
🐘 PostgresExpress10.280s (+98.3% 🔺)11.025s (+83.2% 🔺)0.745s15.69x
▲ VercelNext.js (Turbopack)10.438s (-6.0% 🟢)11.414s (-2.0%)0.977s15.93x
▲ VercelExpress11.140s (+4.3%)12.057s (+5.8% 🔺)0.917s17.00x
▲ VercelNitro11.921s (+10.2% 🔺)12.907s (+12.9% 🔺)0.986s18.20x
workflow with 10 parallel steps
WorldFrameworkWorkflow TimeWall TimeOverheadvs Fastest
💻 Local🥇 Nitro0.395s (+0.8%)1.006s (~)0.611s1.00x
💻 LocalNext.js (Turbopack)0.401s (+1.8%)1.010s (~)0.609s1.01x
💻 LocalExpress0.430s (+8.6% 🔺)1.006s (~)0.577s1.09x
🐘 PostgresNext.js (Turbopack)1.197s (-6.3% 🟢)2.014s (+9.2% 🔺)0.817s3.03x
🐘 PostgresNitro1.455s (-12.0% 🟢)2.010s (~)0.555s3.68x
🐘 PostgresExpress1.687s (+31.9% 🔺)2.017s (~)0.331s4.27x
▲ VercelNitro2.709s (-4.6%)3.578s (+3.3%)0.869s6.86x
▲ VercelExpress2.855s (+4.0%)3.894s (+6.4% 🔺)1.039s7.23x
▲ VercelNext.js (Turbopack)2.858s (-5.1% 🟢)3.551s (-3.2%)0.693s7.24x
Stream Benchmarks
Stream benchmarks include Time to First Byte (TTFB) metrics.
workflow with stream
WorldFrameworkWorkflow TimeTTFBWall TimeOverheadvs Fastest
💻 Local🥇 Next.js (Turbopack)0.151s (+2.0%)1.003s (~)1.014s (~)0.863s1.00x
💻 LocalExpress0.181s (+3.2%)0.992s (~)1.009s (~)0.828s1.20x
💻 LocalNitro0.184s (+5.2% 🔺)0.992s (~)1.009s (~)0.824s1.22x
🐘 PostgresNext.js (Turbopack)0.746s (-34.4% 🟢)0.953s (-50.1% 🟢)1.015s (-49.7% 🟢)0.269s4.94x
🐘 PostgresNitro1.181s (-13.7% 🟢)1.863s (+9.5% 🔺)2.012s (~)0.831s7.83x
🐘 PostgresExpress2.329s (+68.0% 🔺)2.712s (+64.2% 🔺)3.014s (+49.7% 🔺)0.685s15.45x
▲ VercelNext.js (Turbopack)2.542s (+4.6%)3.112s (+4.1%)3.504s (+4.9%)0.961s16.86x
▲ VercelNitro2.678s (+7.4% 🔺)3.195s (+13.5% 🔺)3.643s (+14.1% 🔺)0.964s17.76x
▲ VercelExpress2.712s (+15.4% 🔺)3.027s (+20.6% 🔺)3.880s (+33.2% 🔺)1.169s17.98x
Summary: Fastest Framework by World
Winner determined by most benchmark wins
World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)4/5
🐘 PostgresNext.js (Turbopack)5/5
▲ VercelNitro2/5
Summary: Fastest World by Framework
Winner determined by most benchmark wins
Framework🥇 Fastest WorldWins
Express💻 Local5/5
Next.js (Turbopack)💻 Local5/5
Nitro💻 Local5/5
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark
Worlds:
  • 💻 Local: In-memory filesystem world
  • 🐘 Postgres: PostgreSQL database world
  • ▲ Vercel: Vercel production world
@socket-security
socket-securityBot
commented
Dec 2, 2025

Copy link


Copy Markdown

Caution
Review the following alerts detected in dependencies.
According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
BlockHigh
High CVE: npm path-to-regexp outputs backtracking regular expressions
CVE:GHSA-9wv6-86v2-598j path-to-regexp outputs backtracking regular expressions (HIGH)
Affected versions: >= 0.2.0 < 1.9.0; < 0.1.10; >= 7.0.0 < 8.0.0; >= 2.0.0 < 3.3.0; >= 4.0.0 < 6.3.0
Patched version: 6.3.0
From:pnpm-lock.yaml → npm/@astrojs/vercel@9.0.2 → npm/path-to-regexp@6.1.0
ℹ Read more on: This package | This alert | What is a CVE?
Next steps: Take a moment to review the security alert
above. Review the linked package source code to understand the potential
risk. Ensure the package is not malicious before proceeding. If you're
unsure how to proceed, reach out to your security team or ask the Socket
team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/path-to-regexp@6.1.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@adriandlam
adriandlam
merged commit 9582331
into
mainDec 2, 2025

56 of 59 checks passed

@adriandlam
adriandlam
deleted the

fix/path-to-regexp-override

branch
December 2, 2025 17:38
adriandlam added a commit
that referenced
this pull request
Dec 2, 2025
@adriandlam
fix: path-to-regexp override in package.json (#487)
0c6312d
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@VaguelySeriousVaguelySeriousVaguelySerious approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@adriandlam@VaguelySerious