chore(deps): bump @hono/node-server and prisma in /app/migrator

[dependabot]

Removes @hono/node-server. It's no longer used after updating ancestor dependency prisma. These dependencies need to be updated together.

Removes @hono/node-server

Updates prisma from 7.8.0 to 7.9.1

Release notes

Sourced from prisma's releases.

7.9.1

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes prisma/prisma#29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab
2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):
echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh
echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash
tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish
tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

prisma.mp4

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

</tr></table> 

... (truncated)

Commits

• 3f492ab chore(deps): update @​prisma/dev to 0.24.17 (7.9.x backport) (#29795)
• 537583c feat(cli): add @bomb.sh/tab completions (#28351)
• bf7c40f fix(cli): update Studio to 0.33.0 and suppress aborted response errors (#29720)
• 9acd8dc feat(cli): install Prisma agent skills during prisma init (#29689)
• aef8cb5 fix(cli): remove the migrate-reset tool from the MCP server (#29691)
• cdca333 chore(deps): update @​prisma/dev to 0.24.14 (#29686)
• fda8fbc chore(deps): bump @​prisma/dev to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[guifav]

@dependabot review da Daisy — commit 41c20485

Resumo: Bump @hono/node-server e prisma 7.8.0→7.9.1 em /app/migrator. CI vermelho no step "Verify third-party license inventory" do lint-test-build — o bump altera a árvore de deps sem regenerar docs/THIRD-PARTY-LICENSES.md (gate documentado deste repo desde 2026-07-13; mesma causa dos bloqueios de #70/#72/#73/#74/#75/#93).

Contexto considerado: diff do PR, checks do head, memory/talkwithdata.md (gate de inventário de licença) | Cross-project: nenhum | Notion: sem projeto correlacionado

Validacao local:

• install: n/a (review via CI + diff)
• tests: n/a
• lint: n/a
• tsc: n/a
• build: CI fail — step Verify third-party license inventory (demais jobs verdes: browser-e2e, docker-image-smoke, functions-generate-thumbnail)

Bloqueadores (P1):

• Inventário de licenças stale quebra o gate de CI. Regenerar no branch: cd app && node ../scripts/generate-third-party-licenses.mjs (ou caminho equivalente ao do script no repo), commitar docs/THIRD-PARTY-LICENSES.md atualizado e empurrar — dependabot não faz isso sozinho. Sem CI verde, não mergear (regra deste repo).

Veredito: bloqueado

[roger-guifav]

TL;DR

Atualização do prisma de 7.8.0 para 7.9.1 (minor, dentro do major 7) em app/migrator, com reescrita grande do lockfile. A instalação e a CLI do prisma funcionam, mas o documento de licenças de terceiros ficou desatualizado — é por isso que a checagem principal do CI está vermelha — e o lockfile novo prende o fast-uri numa versão intermediária que ainda tem correção de segurança pendente em outro PR aberto. Não mergear sem esses ajustes.

Verdict: Ajustes necessários

(revisado no head SHA 41c2048)

Parecer

Bump de dependência gerado por automação no diretório app/migrator, pacote que só carrega a CLI do prisma para rodar migrate deploy em container. Três fatos fora do diff orientam o parecer: (1) o repo já viveu incidente de par prisma client/CLI dessincronizado, então conferi a matriz de versões em todos os package.json — aqui não há client, só CLI, e o skew de major não se aplica; (2) o prisma 7.9.1 não depende mais de hono node-server, então o bump do título na prática remove esse pacote da árvore e deixa o override de segurança sem alvo; (3) o fast-uri 3.1.7, alvo de PRs irmãos, fecha advisories públicos de segurança, e este lockfile prende 3.1.5. Validação local: npm ci limpo e CLI 7.9.1 operante. Pergunta de merge: eu mergearia depois de regenerar o documento de licenças e alinhar a ordem com o PR do fast-uri no mesmo diretório.

Críticos (P0)

Nenhum.

Bloqueadores de correção (P1)

1. Documento de licenças de terceiros desatualizado: a checagem lint-test-build do CI reprova indicando que docs/THIRD-PARTY-LICENSES.md está stale (o lockfile mudou prisma, fast-uri e dezenas de transitivos, e o documento fixa versões antigas). Aplicar a regeneração pelo script do repo e commitar o resultado neste PR antes do merge.

Endereçar no PR (P2)

1. Sequência de merge com o PR 141: este lockfile prende fast-uri em 3.1.5, abaixo do 3.1.7 que fecha advisories de segurança. Se este PR mergear depois do 141 sem rebase, há risco de regressão silenciosa da correção; se mergear antes, o 141 precisa de rebase. Fixar a ordem: mergear o 141 primeiro e rebasear este, ou garantir que o lock final fique em 3.1.7 ou superior.

Endereçar no PR (P3 / nits)

1. Override de hono node-server 1.19.13 ficou sem alvo: o prisma 7.9.1 não puxa mais esse pacote, então o pin de segurança virou configuração morta em app/migrator/package.json. Remover o override no mesmo PR (duas linhas).

Acoes que somente o humano pode fazer (ainda...)

Nenhuma além da decisão de ordem de merge entre os PRs de bump.

Verificado

• Head revisado: 41c2048 (merge-base igual ao main atual, sem base velha)
• npm ci em app/migrator: limpo (135 pacotes)
• CLI prisma 7.9.1 executa; o migrator não tem código próprio, só runtime de migrate
• Matriz prisma no repo: app declara client ^7.8.0 e CLI ^7.9.1; migrator fixa CLI 7.9.1 — mesmo major 7 nos pontos relevantes, sem skew de major
• CI: lint-test-build reprova apenas por documento de licenças stale; browser-e2e, docker-image-smoke e functions-generate-thumbnail passam
• Migrator não tem suite de testes nem typecheck próprio — limite declarado da validação local

---

Roger (Hermes KVM) - review v2 - 41c2048