chore(deps): bump path-to-regexp from 8.3.0 to 8.4.0 in /benchmarks/comparison in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /benchmarks/comparison directory: path-to-regexp.

Updates path-to-regexp from 8.3.0 to 8.4.0

Release notes

Sourced from path-to-regexp's releases.

8.4.0

Important

• Fix CVE-2026-4926 (GHSA-j3q9-mxjg-w52f)
• Fix CVE-2026-4923 (GHSA-27v5-c462-wpq7)

Fixed

• Restricts wildcard backtracking when using more than 1 in a path (pillarjs/path-to-regexp#421)

Changed

• Dedupes regex prefixes (pillarjs/path-to-regexp#422)
  • This will result in shorter regular expressions for some cases using optional groups
• Rejects large optional route combinations (pillarjs/path-to-regexp#424)
  • When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

Commits

• 34cb451 8.4.0
• 22a9679 Reject large optional route combinations (#424)
• 8881a88 Byte optimization (#423)
• 43669ac Dedupe regex prefixes (#422)
• 4864654 Restrict repeated wildcard backtracking (#421)
• 05a5a97 Remove dependabot config (#404)
• 5b635cd Remove package-lock.json (#407)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

📊 Benchmark Results

Benchmark	Time	Throughput

arena

| | 13.405 ns | - |
| | 6.5362 ns | - |
| | 456.73 ns | - |
| | 433.30 ns | - |
| | 647.99 ns | - |
| | 50.354 ns | - |
| | 620.66 ns | - |
| | 78.310 ns | - |
| | | - |
| | | - |
| | 324.59 ns | - |
| | 44.695 ns | - |
| | | - |
| | | - |
| | | - |
| | | - |
| | 56.994 ns | - |
| | 63.202 ns | - |

body

| | 22.531 ns | - |
| | 54.341 ns | - |
| | 14.697 ns | - |
| | 1.2444 ns | - |
| | 36.274 ns | - |
| | 14.689 ns | - |
| | 148.53 ns | - |
| | 84.403 ns | - |
| | 46.367 ns | - |
| | 39.442 ns | - |
| | 55.206 ns | - |
| | 31.930 ns | - |
| | 165.40 ns | - |
| | 6.2816 ns | - |
| | 68.900 ns | - |
| | 37.251 ns | - |
| | 148.71 ns | - |
| | | - |
| | 4.3564 ns | - |
| | 4.3601 ns | - |
| | 4.3596 ns | - |

json

| json_info/library_check | 324.43 ps | - |
| json_serialize/small | 72.306 ns | - |
| json_serialize/medium | 318.87 ns | - |
| json_serialize/large | | - |
| json_deserialize/small | 118.36 ns | - |
| json_deserialize/medium | 985.00 ns | - |
| json_deserialize/large | | - |
| json_roundtrip/small | 192.54 ns | - |
| json_roundtrip/medium | | - |
| json_roundtrip/large | | - |
| http_json/request_parse | | - |
| http_json/response_json | 420.93 ns | - |
| http_json/full_cycle | | - |

routing

| | 43.729 ns | - |
| | 112.25 ns | - |
| | 213.50 ns | - |
| | 218.30 ns | - |
| | 134.13 ns | - |
| | 4.0874 ns | - |
| | 18.399 ns | - |
| | 143.33 ns | - |
| | 311.32 ns | - |
| | | - |
| | 207.56 ns | - |
| | 37.119 ns | - |
| | 222.50 ns | - |
| | | - |
| | 68.210 ns | - |
| | 416.32 ns | - |
| | | - |
| routing/match_first/10 | 98.577 ns | - |
| routing/match_middle/10 | 285.47 ns | - |
| routing/match_last/10 | 279.65 ns | - |
| | 192.38 ns | - |
| routing/match_first/50 | 98.659 ns | - |
| routing/match_middle/50 | 888.92 ns | - |
| routing/match_last/50 | 280.84 ns | - |
| | | - |
| routing/match_first/100 | 98.813 ns | - |
| | 696.67 ns | - |
| routing/match_last/100 | | - |
| | | - |
| routing/match_first/500 | 98.968 ns | - |
| | 666.18 ns | - |
| routing/match_last/500 | 946.46 ns | - |
| | | - |
| | 318.46 ps | - |
| | 42.094 ns | - |
| | 457.02 ns | - |
| | 135.00 ns | - |
| | 197.81 ns | - |
| | 306.22 ns | - |
| | 6.0017 ns | - |
| | 47.771 ns | - |
| | 63.747 ns | - |
| | 158.66 ns | - |
| | 302.12 ns | - |
| | 476.65 ns | - |
| | 898.55 ns | - |
| full_cycle/health_check | 660.19 ns | - |
| | | - |
| | | - |
| | 14.006 ns | - |
| | 12.773 ns | - |
| allocations/vec_small | 10.582 ns | - |
| allocations/vec_large | 24.626 ns | - |
| | 72.451 ns | - |
| | | - |

security

| jwt/sign | 756.82 ns | - |
| jwt/verify | | - |
| jwt/sign_HS256 | 765.40 ns | - |
| jwt/sign_HS384 | | - |
| jwt/sign_HS512 | | - |

simd_parser

| query_string/small/simd | 221.86 ns | - |
| | 224.34 ns | - |
| | 600.80 ns | - |
| | 960.85 ns | - |
| query_string/large/simd | | - |
| | | - |
| url_decode/plain/simd | 26.501 ns | - |
| url_decode/encoded/simd | 73.214 ns | - |
| | 97.968 ns | - |
| | 6.5448 ns | - |
| | 16.444 ns | - |
| | 5.3006 ns | - |
| | 11.531 ns | - |
| | 86.538 ns | - |
| | 86.411 ns | - |
| | 110.18 ns | - |
| path_split/short/simd | 38.825 ns | - |
| path_split/medium/simd | 129.60 ns | - |
| path_split/long/simd | 243.28 ns | - |
| | 145.77 ns | - |
| | 444.62 ns | - |

Summary

• Commit: 320d36a678664356ab27d3796c2620e513e1e372
• Branch: 164/merge
• Runner: Linux

---

Benchmark run triggered by commit 320d36a