Prisma 7.10.0 pins deepmerge-ts 7.1.5 and mysql2 3.15.3, which carry high-severity npm audit advisories

[wmadden-electric]

Package and version

prisma@7.10.0 and @prisma/config@7.10.0

What happened?

npm audit on a project using the latest Prisma 7 reports four high-severity findings, all in dependencies pinned by Prisma packages:

• @prisma/config 7.10.0 pins deepmerge-ts@7.1.5. GHSA-ggr8-5vv4-36mx (stack exhaustion when merging recursive object graphs) is fixed in deepmerge-ts@8.0.0.
• prisma 7.10.0 pins mysql2@3.15.3. GHSA-3f6p-5ww8-9rcr (auth plugin downgrade leaking plaintext credentials) is fixed in mysql2@3.22.0, and GHSA-rgwj-5xj2-c3m3 (unbounded zlib inflate in the compressed protocol handler) is fixed in mysql2@3.23.1.

The only fix npm audit fix --force offers is a downgrade to prisma@6.19.3.

Reported by a user on the Prisma Discord: https://discord.com/channels/937751382725886062/1548958064810393601/1549149135098675200

What did you expect to happen?

A clean npm audit on the current Prisma 7 release, with deepmerge-ts at 8.x and mysql2 at 3.23.1 or later.

Minimal reproduction

mkdir audit-repro && cd audit-repro
npm init -y
npm install prisma@7.10.0
npm audit

Environment

• Package manager: npm
• Prisma: 7.10.0 (latest 7.x at the time of filing)
• Database: MySQL and SQLite, per the reporter; the findings do not depend on the database in use

Additional context

The advisories are public and are in transitive dependencies, not in Prisma itself. These are pinned exact versions, so users cannot override them without overrides.