chore(deps): bump deepmerge-ts and mariadb past audited vulnerabilities - #30189
Merged
Merged
Conversation
pnpm audit --prod fails on every PR with four advisories: - deepmerge-ts < 8.0.0: stack exhaustion on recursive object graphs (GHSA-ggr8-5vv4-36mx) - mariadb >= 3.4.0 < 3.4.6: cleartext password leak to a MitM despite ssl: true (GHSA-cqhc-2h57-wpxf), cleartext transmission of sensitive information (GHSA-42r5-vhpq-m858), and possible SQL injection under multibyte client charsets (GHSA-g5xc-5w98-jfvm) Bump deepmerge-ts 7.1.5 -> 8.0.2 and mariadb 3.4.5 -> 3.5.3. The mariadb 3.4.x line has no 3.4.6 release on npm; 3.5.3 is the current release that satisfies >= 3.4.6. deepmerge-ts 8 changes Map merging and deepmergeInto mutation. Neither matters here: @prisma/config only calls the basic deepmerge export on plain config objects. Signed-off-by: Oleksii Orlenko <robot@aqrln.net>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Team Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📝 WalkthroughWalkthroughTwo package manifests update the ChangesDependency updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This PR updates two vulnerable dependencies and the lockfile without any supplied merge-blocking concerns; no actionable risk remains beyond normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
size-limit report 📦
|
aqrln
approved these changes
Sep 1, 2026
This was referenced Sep 8, 2026
This was referenced Sep 9, 2026
azumag
added a commit
to azumag/JSMKC
that referenced
this pull request
Sep 13, 2026
Record prisma/orm#30189 as advisory historical evidence alongside the tracking issue while preserving the existing #3114 remediation policy.
GiHoon1123
pushed a commit
to GiHoon1123/prisma
that referenced
this pull request
Sep 19, 2026
…risma#30314) ## Summary `npm audit` on `prisma@7.10.0` reports high-severity findings in dependencies that Prisma pins (prisma#30295). The `deepmerge-ts` finding is already fixed on this branch by prisma#30189 but is unreleased. This PR fixes the rest: - **`mysql2` 3.15.3 → 3.24.4** in `packages/cli`. Prisma Studio's MySQL connection is its only consumer. - [GHSA-3f6p-5ww8-9rcr](GHSA-3f6p-5ww8-9rcr) (high): a server can downgrade authentication to `mysql_clear_password` and read the password in plaintext. Fixed in 3.22.0. - [GHSA-rgwj-5xj2-c3m3](GHSA-rgwj-5xj2-c3m3) (moderate): unbounded zlib inflate in the compressed protocol handler. Fixed in 3.23.1. - **`fast-uri` override floor 3.1.5 → 3.1.6** in `pnpm-workspace.yaml`. Four `fast-uri` advisories reach the lockfile through `@prisma/dev` → `@prisma/streams-local` → `ajv`, and they fail the `pnpm audit --prod` step on every PR to `v7`. Users are not affected, because a fresh install already resolves `fast-uri` to 3.1.8. The lockfile diff is limited to `mysql2`, its dependencies, and `fast-uri`. ## Behavior changes for Studio users - **Cleartext authentication is off by default.** `mysql2` 3.22.0 stops accepting a server's request for `mysql_clear_password`. That is the fix for the high-severity advisory. Servers that require it, such as AWS RDS IAM authentication, now need `?enableCleartextPlugin=true` on the URL. `normalizeMySQLConnectionString` keeps that parameter, and `mysql2` parses it to `true`. - **`@types/node` becomes a peer dependency of `prisma`'s dependency tree.** Starting with 3.18.0, `mysql2` declares `@types/node: ">= 8"` as a required peer dependency, and no fixed version drops it. npm 7+ and pnpm install required peers automatically, so projects without `@types/node` will get it after upgrading. It is types only. If that is unwanted, the alternative is to move `mysql2` to `devDependencies` so the CLI build bundles it, which is a larger change to the bundle. ## Testing performed - `pnpm audit --prod`: before, 6 findings (2 `mysql2`, 4 `fast-uri`). After, "No known vulnerabilities found". - `vitest run src/__tests__/Studio.vitest.ts` in `packages/cli`: 31 passed. These tests mock `mysql2`, so they don't exercise the new version. - `pnpm run tsc` in `packages/cli`: passes. - Manual check against MySQL 9.0 in Docker. I built the CLI, ran `prisma studio --url "mysql://…?connection_limit=2"`, and confirmed from `packages/cli` that `mysql2` resolves to 3.24.4. I then posted to Studio's `/bff` endpoint: - a plain `SELECT` with a `json-parse` transformation, which returned the rows with parsed JSON - a parameterized `SELECT`, which returned the matching row - a `transaction` that inserts a value containing a single quote and reads it back, which round-tripped the value - a query against a missing table, which returned `ER_NO_SUCH_TABLE` as a serialized error ## Release Users only get these fixes, and the `deepmerge-ts` fix from prisma#30189, from a new `7.x` release. Merging into `v7` does not close prisma#30295 or prisma#30052, so close them when that release ships. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the MySQL client dependency used by the CLI. * Updated the fast-uri version override to require a newer compatible release. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pnpm audit --prod(the "Run pnpm audit (production dependencies only)" step of the Lint job) fails on every PR to this branch with four advisories:deepmerge-ts< 8.0.0 — stack exhaustion on recursive object graphs (GHSA-ggr8-5vv4-36mx), highmariadb>= 3.4.0 < 3.4.6 — cleartext password leak to a MitM despitessl: true(GHSA-cqhc-2h57-wpxf, high), cleartext transmission of sensitive information (GHSA-42r5-vhpq-m858, moderate), and possible SQL injection in Buffer parameter escaping under multibyte client charsets (GHSA-g5xc-5w98-jfvm, moderate)This PR bumps:
deepmerge-ts7.1.5 → 8.0.2 inpackages/config. The v8 breaking changes are Map deep-merging and adeepmergeIntomutation fix;@prisma/configuses neither — it only calls the basicdeepmergeexport on plain config objects (loadConfigFromFile.ts). v8 still ships dual CJS/ESM.mariadb3.4.5 → 3.5.3 inpackages/adapter-mariadb. The advisories say "patched >= 3.4.6", but npm has no 3.4.6 — the 3.4.x line ends at 3.4.5; 3.5.3 is the current release satisfying the range.Lockfile updated with the repo-pinned pnpm 11.13.1.
Testing performed
pnpm audit --prodagainst the updated lockfile: "No known vulnerabilities found".pnpm --filter @prisma/config test: 4 files, 142 passed, 2 skipped — includes the config-merge tests that exercisedeepmerge.pnpm --filter @prisma/adapter-mariadb test: 45 passed.Notes for the reviewer
Summary by CodeRabbit