Conversation
Benchmark Resultsbench/1-buffer-vector-add.bench.mo
|
| 10 | 10000 | 1000000 | |
|---|---|---|---|
| Buffer | 9_557 |
5_687_594 |
525_783_888 |
| Vector | 13_525 |
4_378_612 |
417_864_498 |
Heap
| 10 | 10000 | 1000000 | |
|---|---|---|---|
| Buffer | 272 B |
272 B |
272 B |
| Vector | 272 B |
272 B |
272 B |
Garbage Collection
| 10 | 10000 | 1000000 | |
|---|---|---|---|
| Buffer | 1.09 KiB |
143.28 KiB |
12.02 MiB |
| Vector | 1.09 KiB |
45.65 KiB |
3.86 MiB |
bench/2-vector-buffer-add.bench.mo $({\color{green}-10.02\%})$
Add
Add items one-by-one
Instructions:
Heap:
Stable Memory:
Garbage Collection:
Instructions
| 10 | 10000 | 1000000 | |
|---|---|---|---|
| Vector | 13_525 |
4_378_966 |
417_886_092 |
| Buffer | 9_557 |
5_686_886 |
525_781_056 |
Heap
| 10 | 10000 | 1000000 | |
|---|---|---|---|
| Vector | 272 B |
272 B |
272 B |
| Buffer | 272 B |
272 B |
272 B |
Garbage Collection
| 10 | 10000 | 1000000 | |
|---|---|---|---|
| Vector | 1.09 KiB |
45.65 KiB |
3.86 MiB |
| Buffer | 1.09 KiB |
143.28 KiB |
12.02 MiB |
bench/array.bench.mo $({\color{green}-17.47\%})$
Array
arr arr
Instructions:
Heap:
Stable Memory:
Garbage Collection:
Instructions
| 100k x1 | reset1 | 100k x3 | reset2 | 100k x4 | reset3 | |
|---|---|---|---|---|---|---|
| Array | 13_502_096 |
3_335 |
27_003_270 |
3_809 |
54_004_127 |
4_283 |
Heap
| 100k x1 | reset1 | 100k x3 | reset2 | 100k x4 | reset3 | |
|---|---|---|---|---|---|---|
| Array | 390.9 KiB |
-390.37 KiB |
390.9 KiB |
-390.37 KiB |
390.9 KiB |
-390.37 KiB |
Garbage Collection
| 100k x1 | reset1 | 100k x3 | reset2 | 100k x4 | reset3 | |
|---|---|---|---|---|---|---|
| Array | 360 B |
390.97 KiB |
391 KiB |
390.97 KiB |
1.14 MiB |
390.97 KiB |
bench/prng.bench.mo $({\color{gray}0\%})$
Prng
Benchmark N next calls for different PRNGs
Instructions:
Heap:
Stable Memory:
Garbage Collection:
Instructions
| 10 | 100 | 1000 | 10000 | |
|---|---|---|---|---|
| Seiran128 | 1_694 | 15_194 | 150_194 | 1_500_194 |
| SFC64 | 2_802 | 28_962 | 288_557 | 2_882_655 |
| SFC32 | 2_383 | 23_825 | 237_026 | 2_379_333 |
Heap
| 10 | 100 | 1000 | 10000 | |
|---|---|---|---|---|
| Seiran128 | 272 B | 272 B | 272 B | 272 B |
| SFC64 | 308 B | 272 B | 272 B | 272 B |
| SFC32 | 280 B | 280 B | 272 B | 272 B |
Garbage Collection
| 10 | 100 | 1000 | 10000 | |
|---|---|---|---|---|
| Seiran128 | 296 B | 296 B | 296 B | 296 B |
| SFC64 | 536 B | 4.98 KiB | 47.16 KiB | 469.04 KiB |
| SFC32 | 376 B | 1.78 KiB | 15.39 KiB | 156.11 KiB |
bench/removeLast.bench.mo $({\color{green}-10.90\%})$
Remove items using removeLast
Vector and buffer are initialized with 100k items and then 70k items are removed one-by-one.
Instructions:
Heap:
Stable Memory:
Garbage Collection:
Instructions
| remove 70k | |
|---|---|
| Vector | 27_707_716 |
| Buffer | 29_236_977 |
Heap
| remove 70k | |
|---|---|
| Vector | -136.8 KiB |
| Buffer | -269.76 KiB |
Garbage Collection
| remove 70k | |
|---|---|
| Vector | 139.45 KiB |
| Buffer | 540.43 KiB |
bench/stable-memory.bench.mo $({\color{green}-134.03\%})$
Stable Memory and Region
Grow Region and store blobs in it
Instructions:
Heap:
Stable Memory:
Garbage Collection:
Instructions
| Region (fill 1/100) | Region (fill 1/50) | StableMemory | |
|---|---|---|---|
| 10 pages | 2_627_029 |
10_496_302 |
2_693 |
| 100 pages | 52_466_897 |
104_914_730 |
2_698 |
| 256 pages | 134_273_310 |
268_575_103 |
3_246 |
Heap
| Region (fill 1/100) | Region (fill 1/50) | StableMemory | |
|---|---|---|---|
| 10 pages | 272 B |
272 B |
276 B |
| 100 pages | 272 B |
272 B |
272 B |
| 256 pages | 272 B |
272 B |
276 B |
Garbage Collection
| Region (fill 1/100) | Region (fill 1/50) | StableMemory | |
|---|---|---|---|
| 10 pages | 208.34 KiB |
832.38 KiB |
336 B |
| 100 pages | 4.06 MiB |
8.13 MiB |
340 B |
| 256 pages | 10.4 MiB |
20.8 MiB |
340 B |
Stable Memory
| Region (fill 1/100) | Region (fill 1/50) | StableMemory | |
|---|---|---|---|
| 10 pages | 8 MiB |
8 MiB |
8 MiB |
| 100 pages | 8 MiB |
8 MiB |
0 B |
| 256 pages | 16 MiB |
16 MiB |
16 MiB |
## Summary - Bumped `tar` (7.5.9 → 7.5.11) and `minimatch` (10.0.1 → 10.2.4) in `cli/package.json` — security fixes for path traversal and ReDoS - Updated `cli/package-lock.json` and `docs/package-lock.json` transitive deps in-place to pick up security patches (lodash, js-yaml, node-forge, jws, undici, flatted, ajv, etc.) - `cli-releases/frontend` changes come from merged PR #340 (vite 5.2.6 → 5.4.21) - `frontend/package-lock.json` reverted to main — `npm update --legacy-peer-deps` introduced a `@dfinity/agent` ↔ `@dfinity/candid` peer dep conflict that broke CI - `blog/package-lock.json` was already up to date (no changes needed) ### What was NOT included and why - **`frontend/package-lock.json`** — peer dep conflict between `@dfinity/agent@1.0.1` and `@dfinity/candid@0.19.3` prevents a clean lockfile update. Needs a coordinated `@dfinity/*` dependency bump in a separate PR. - **Unfixable transitive vulns in CLI** — `axios` (via `wasm-pack` → `binary-install`) and `esbuild` (via `tsx`) can't be updated without breaking upstream. Pre-existing on main. ### Closed dependabot PRs (replaced by this PR) #368, #341, #344, #338, #345, #346, #349, #323, #328, #382, #353, #359, #357, #348, #325, #324, #421, #419, #379, #377 ## Test plan - [x] Benchmarks pass - [x] mops test passes (node 20 + node 24, all install methods) - [ ] CI workflow passes - [ ] Code quality (lint, format) passes ## Verification Ran findings-verifier on both direct dependency bumps: - **minimatch 10.0.1 → 10.2.4**: All changes are additive (new options, perf/security hardening). CLI uses a simple glob pattern unaffected by any changes. - **tar 7.5.9 → 7.5.11**: Pure security fixes in extraction path validation. No API surface changes. CLI's tar usage (create + extract) is standard and unaffected. - **No new peer deps**, no engine requirement changes, no breaking API changes. --- ## Remaining Open PRs — TODO ### Review & Merge (real package.json bumps, security fixes) | PR | What | Status | |---|---|---| | #336 | Vite 5.2.6 → 5.4.21 in `/frontend` | Multiple CVEs fixed | | #361 | Elliptic + ic-mops in `/frontend` | Critical crypto vulnerability | | #367 | Tar + ic-mops in `/frontend` | Tar path traversal fix | | #420 | Devalue + @sveltejs/kit in `/cli-releases/frontend` | Real package.json bump | ### Need @dependabot rebase (merge conflict with main) | PR | What | Status | |---|---|---| | #372 | Tar 7.5.6 → 7.5.7 in `/cli` | Now superseded — tar bumped to 7.5.11 in this PR | | #342 | Glob 11.0.1 → 11.1.0 in `/cli` | Security fix — GHSA-5j98-mcp5-4vw2 | ### Need Careful Review (major version bumps, risk of breakage) | PR | What | Status | |---|---|---| | #380 | Docusaurus 2.4.3 → 3.9.2 in `/docs` | Major v2 → v3. Test docs locally. | | #329 | vite-plugin-static-copy 1.0.2 → 2.3.2 in `/frontend` | Major v1 → v2. Has security fix but API may differ. | ### Non-Dependabot PRs | PR | Author | What | |---|---|---| | #411 | rvanasa | Test global Mops installation in CI | | #363 | codecustard | Fix code page scroll naturally like docs page |
Simulates a globally installed
ic-mopsnpm package for better E2E test coverage.