chore(release): v0.28.0 by wmadden-electric · Pull Request #342 · prisma/composer

wmadden-electric · 2026-10-07T09:57:40Z

Composer 0.28.0, on Prisma ORM 8.0.0-rc.16 and CLI engine 0.6.3. Merging this PR ships 0.28.0.

Why

The Prisma CLI's next release mounts Composer and the ORM together, and its conformance check requires both to peer exactly the CLI engine it ships, @prisma/cli-engine@0.6.3. Composer already peers 0.6.3. ORM rc.16 is the first ORM release that does. This Composer release moves onto it, so the CLI can then ship Composer 0.28.0, ORM rc.16 and engine 0.6.3 together.

ORM rc.13 to rc.15

@prisma/orm-postgres and @prisma/orm-toolchain move from 8.0.0-rc.13 to 8.0.0-rc.15 in all seven manifests, following the ORM upgrade guides for both hops:

The data-type-in-contract script from the rc.14 to rc.15 guide rewrote every committed contract, snapshot, migration and ref: each column stores dataType, such as pg/text, in place of nativeType. Every contract was then emitted again. Storage hashes change once; execution and profile hashes do not. The commit message lists each hash.
The lockfile resolves one ArkType copy, 2.2.7. With two copies the ORM packages each got a nested ArkType, and contract emit failed validation.
The contracts were emitted with the rc.15 toolchain's emit function, because the catalog's prisma@8.0.0-rc.19 still carries toolchain rc.13. A second emit changes nothing.

Build, typecheck, lint, the package tests of every changed package and of the ArkType users, and the repository's pin and publish checks pass locally.

ORM rc.15 to rc.16

ORM rc.16 peers @prisma/cli-engine@0.6.3, the engine Composer already pins. No rc.16 upgrade entry matches Composer, so only the seven manifests and the lockfile change. Every contract emitted again with the rc.16 toolchain keeps its hashes and its files. Build, typecheck, check:publish-deps, check:orm-pins, check:cli-engine-pin, lint:deps and the tests of the ORM-dependent packages pass.

Release

pnpm bump-minor moves every workspace package from 0.27.0 to 0.28.0.

Agent: grendel-61

🤖 Generated with Claude Code

Pins @prisma/orm-postgres and @prisma/orm-toolchain at 8.0.0-rc.15 in all seven manifests. @prisma/cli-engine stays at 0.6.3 with its root override: ORM rc.15 peers the engine at 0.6.2, and a later ORM release moves it to 0.6.3. Following the rc.13 to rc.14 guides: no entry's detection matches Composer. Following the rc.14 to rc.15 guides: contract-stores-data-type ran its data-type-in-contract script from the repo root, which rewrote 21 files (nativeType becomes dataType, contract.d.ts declares many on every column) and renamed 4 snapshot directories, with their migration.json, migration.ts and refs. reemit-explicit-list-cardinality, reemit-extension-list-contracts, domain-types-match-their-columns and re-emit-for-the-row-locking-capabilities are covered by one re-emit of every contract; the re-emitted contracts gain the row-locking capability keys, and the auth pack version stamp moves to 0.27.0. sign-databases-after-upgrade has no database to sign here. The other entries whose patterns match (text-array-elements-nullable, char-reads-drop-only-padding, writes-on-a-conditional-collection-are-refused and the other collection entries) need no change: Composer calls no textArray(), defines no Collection subclass, and the compiler reports nothing. The contracts are re-emitted with the rc.15 toolchain's executeContractEmit, because the catalog's prisma 8.0.0-rc.19 host still carries toolchain rc.13. A second emit changes nothing. As before, Biome formats the three example contract.json files it checks after the emit. The lockfile now resolves one ArkType copy, 2.2.7. The rc.15 packages resolved ArkType 2.2.7 while Composer's own packages stayed on 2.2.3, so the hoisted linker gave each ORM package a nested copy of its own, and contract emit failed structural validation. Storage hashes (old -> new): - orm-demo: 2c0c3445 -> 175be575 - store catalog: 6e17ba1a -> 6db9c25a - store orders: a2c3b473 -> 37a51f56 - auth pack head, and the auth space in examples/auth: 9e4dbcee -> 310f206d - widget fixture: 6d63ff57 -> 4ac61af8 - gadget fixture: 091f941f -> 69ac5b6e No execution or profile hash changes. Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io>

prisma-gizmo · 2026-10-07T09:57:43Z

✅ Gizmo reviewed a87d48b — posted 1 inline comment(s) this pass.

Open findings: 🟡 1 minor

Change walkthrough

This PR ships Composer 0.28.0: it moves the whole ORM family from 8.0.0-rc.13 to 8.0.0-rc.16 across all seven manifests, re-emits every committed contract with the rc.16 toolchain, and bumps every workspace package from 0.27.0 to 0.28.0. The release exists so the Prisma CLI can ship Composer, ORM rc.16, and @prisma/cli-engine@0.6.3 together under its exact-peer conformance check.

Dependency bumps. The version churn is uniform and machine-verifiable: every changed line in every package.json is either a workspace ref (workspace:0.27.0 → workspace:0.28.0), an ORM dep (8.0.0-rc.13 → 8.0.0-rc.16, including the peerDependencies in @prisma/composer-prisma-cloud), or the package's own version. A repo-wide grep for stale 0.27.0/rc.13–rc.15 references finds nothing outside the lockfile. The @prisma/cli-engine pin stays at exactly 0.6.3 everywhere, which is the invariant motivating the release. The rc.16 hop touches only manifests and the lockfile, as the description states.

Contract re-emits. The rc.14→rc.15 guide's data-type-in-contract rewrite replaced every nativeType: 'text'-style entry with dataType: 'pg/text'-style entries (plus a new many: false on columns) in all committed contracts, snapshots, migrations, and refs — auth, orm-demo, the store modules, the auth pack, and the target test fixtures. Each .d.ts/.json pair stays in agreement; storage hashes changed once and execution/profile hashes did not. Post-emit artifacts are internally consistent: each migration's snapshot import matches its contract's new StorageHash, and the auth migration hashes match refs/head.json and the pack's own migration. The rc.15 emit also picked up new Postgres capabilities (forShare/forUpdate, forKeyShare/forNoKeyUpdate, lock*) and refreshed the embedded auth extension version; the rc.16 re-emit changed nothing, as expected.

Release metadata. pnpm bump-minor moved all packages to 0.28.0, including root, the skill doc's library_version, and the test/integration/website manifests. The pnpm-workspace.yaml catalog is intentionally untouched (prisma@8.0.0-rc.19 there still carries toolchain rc.13; the emits used the rc.16 toolchain directly).

coderabbitai · 2026-10-07T09:57:48Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 9002e7c6-75e6-46c0-9d4b-f58fb551a7f2

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

pkg-pr-new · 2026-10-07T10:00:50Z

Open in StackBlitz

npm i https://pkg.pr.new/@prisma/composer@342

npm i https://pkg.pr.new/@prisma/composer-cli@342

npm i https://pkg.pr.new/@prisma/composer-prisma-cloud@342

commit: a87d48b

ORM rc.16 peers @prisma/cli-engine 0.6.3, the engine Composer already pins. No rc.15 to rc.16 guide entry matches Composer. Every contract emitted again with the rc.16 toolchain keeps its storage, execution and profile hashes, and no emitted file changes. Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io>

Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io>

prisma-gizmo

New findings: 🟡 1 minor · trace

prisma-gizmo

No critical or major Gizmo finding is open and the head commit has been reviewed. Approving.

Merge remote-tracking branch 'origin/main' into chore/release-v0.28.0

0e100a9

wmadden approved these changes Oct 7, 2026

View reviewed changes

wmadden-electric added 2 commits October 7, 2026 13:10

chore(release): v0.28.0

a87d48b

Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io>

wmadden-electric marked this pull request as ready for review October 7, 2026 11:11

wmadden enabled auto-merge (squash) October 7, 2026 11:11

prisma-gizmo Bot reviewed Oct 7, 2026

View reviewed changes

Comment thread examples/auth/contract.d.ts

prisma-gizmo Bot approved these changes Oct 7, 2026

View reviewed changes

wmadden merged commit 41edd3f into main Oct 7, 2026
25 checks passed

wmadden deleted the chore/release-v0.28.0 branch October 7, 2026 11:18

This was referenced Oct 7, 2026

chore(examples): the auth example records auth extension 0.28.0 #343

Merged

Bump to version 8.0.0-rc.21 prisma/prisma-cli#336

Merged

Navigation Menu

Repository navigation

chore(release): v0.28.0 - #342

chore(release): v0.28.0#342
wmadden merged 4 commits into
mainfrom
chore/release-v0.28.0

wmadden-electric commented Oct 7, 2026 •

edited

Loading

Uh oh!

prisma-gizmo Bot commented Oct 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 7, 2026 •

edited

Loading

Uh oh!

prisma-gizmo Bot left a comment

Uh oh!

Uh oh!

prisma-gizmo Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

wmadden-electric commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

ORM rc.13 to rc.15

ORM rc.15 to rc.16

Release

Uh oh!

prisma-gizmo Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

prisma-gizmo Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

prisma-gizmo Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

wmadden-electric commented Oct 7, 2026 •

edited

Loading

prisma-gizmo Bot commented Oct 7, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 7, 2026 •

edited

Loading