security: surface published Prisma remediation candidates

[azumag]

Summary

• distinguish an upstream branch merge from an installable stable Prisma remediation
• expose published_remediation_candidate=<version|none> from the next-major audit probe
• correct the next-major test fixtures so Prisma 7.10.0 remains the vulnerable example and a later synthetic stable release represents the patched edge
• document that chore(deps): bump deepmerge-ts and mariadb past audited vulnerabilities prisma/orm#30189 is merged on the v7 branch but the latest stable 7.10.0 predates that merge

Safety

• read-only audit/review evidence only
• no dependency, lockfile, schema, D1, runtime, deployment, or Security: Prisma → deepmerge-ts 暫定audit例外を upstream 修正後に削除する #3114 exception changes
• the compatible-range fail-closed gate is unchanged

Validation

GitHub CI and review checks should cover lint, formatting, unit tests, audit policy and Cloudflare build.

Refs #3114

[azumag]

コード・設計・テストを確認しました。blocking finding はありません。published_remediation_candidate は既存の stable-only npm evidence と compatible-forward-remediation-available state からのみ導出され、current compatible-range gate や #3114 の例外判定には接続していません。v7 branch への upstream merge と npm registry 上の installable stable release を分離する目的に沿っています。CI/format/audit/Cloudflare build の完了を最終マージ条件とします。

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	smkc	3e3aae7	Sep 11 2026, 09:29 AM