security: surface next-major Prisma remediation evidence

[azumag]

Summary

Advance #3114 without applying a breaking Prisma upgrade.

• add a read-only security-audit-next-major.js probe that derives the next major only from the current caret Prisma selector and reuses the existing canonical-registry / stable-only / dependency-edge checks
• surface next-major Prisma → @prisma/config → deepmerge-ts evidence and an observation timestamp in the manual Security audit review summary
• keep this evidence advisory-only (continue-on-error) so the existing current-range fail-closed gate is unchanged
• add regression coverage and document the decision boundary

Why

Prisma upstream PR prisma/orm#30189 was merged to the v7 branch on 2026-09-01 and bumps deepmerge-ts to a patched 8.x release. JSMKC currently uses Prisma ^6.19.3, so the existing compatible-range probe correctly cannot see that remediation. This change records that a next-major remediation path exists without silently treating Prisma 6 → 7 as a safe automatic update.

Safety

No dependency versions, lockfile contents, production behavior, #3114 exception scope/deadline, audit severity, or consumer-side overrides are changed. A Prisma major upgrade still requires a separate explicit migration PR and full compatibility validation.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	smkc	154d807	Sep 10 2026, 08:41 PM

[azumag]

コード・設計・テストを確認しました。blocking finding はありません。next-major probe は既存の canonical registry / stable-only / dependency-edge 判定を再利用し、current ^6.19.3 から次 major を導出する場合も caret selector に限定して fail-closed です。workflow 側も continue-on-error の advisory evidence に留め、既存の compatible_upstream_gate に next-major state を混ぜていないため、Prisma 6→7 の重大な仕様判断を自動化していません。新規 script / workflow contract の回帰テストと runbook も整合しています。初回CIの changed-file formatting 失敗は同PRで修正済みで、最新HEADでは Prisma/D1 parity・lint・format・unit tests・security audit が成功しています。Cloudflare/review workflow の最終完了だけ継続確認します。