chore(deps): bump mysql2 and fast-uri past audited vulnerabilities

[wmadden-electric]

Summary

npm audit on prisma@7.10.0 reports high-severity findings in dependencies that Prisma pins (#30295). The deepmerge-ts finding is already fixed on this branch by #30189 but is unreleased. This PR fixes the rest:

• mysql2 3.15.3 → 3.24.4 in packages/cli. Prisma Studio's MySQL connection is its only consumer.
  • GHSA-3f6p-5ww8-9rcr (high): a server can downgrade authentication to mysql_clear_password and read the password in plaintext. Fixed in 3.22.0.
  • GHSA-rgwj-5xj2-c3m3 (moderate): unbounded zlib inflate in the compressed protocol handler. Fixed in 3.23.1.
• fast-uri override floor 3.1.5 → 3.1.6 in pnpm-workspace.yaml. Four fast-uri advisories reach the lockfile through @prisma/dev → @prisma/streams-local → ajv, and they fail the pnpm audit --prod step on every PR to v7. Users are not affected, because a fresh install already resolves fast-uri to 3.1.8.

The lockfile diff is limited to mysql2, its dependencies, and fast-uri.

Behavior changes for Studio users

• Cleartext authentication is off by default. mysql2 3.22.0 stops accepting a server's request for mysql_clear_password. That is the fix for the high-severity advisory. Servers that require it, such as AWS RDS IAM authentication, now need ?enableCleartextPlugin=true on the URL. normalizeMySQLConnectionString keeps that parameter, and mysql2 parses it to true.
• @types/node becomes a peer dependency of prisma's dependency tree. Starting with 3.18.0, mysql2 declares @types/node: ">= 8" as a required peer dependency, and no fixed version drops it. npm 7+ and pnpm install required peers automatically, so projects without @types/node will get it after upgrading. It is types only. If that is unwanted, the alternative is to move mysql2 to devDependencies so the CLI build bundles it, which is a larger change to the bundle.

Testing performed

• pnpm audit --prod: before, 6 findings (2 mysql2, 4 fast-uri). After, "No known vulnerabilities found".
• vitest run src/__tests__/Studio.vitest.ts in packages/cli: 31 passed. These tests mock mysql2, so they don't exercise the new version.
• pnpm run tsc in packages/cli: passes.
• Manual check against MySQL 9.0 in Docker. I built the CLI, ran prisma studio --url "mysql://…?connection_limit=2", and confirmed from packages/cli that mysql2 resolves to 3.24.4. I then posted to Studio's /bff endpoint:
  • a plain SELECT with a json-parse transformation, which returned the rows with parsed JSON
  • a parameterized SELECT, which returned the matching row
  • a transaction that inserts a value containing a single quote and reads it back, which round-tripped the value
  • a query against a missing table, which returned ER_NO_SUCH_TABLE as a serialized error

Release

Users only get these fixes, and the deepmerge-ts fix from #30189, from a new 7.x release. Merging into v7 does not close #30295 or #30052, so close them when that release ships.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the MySQL client dependency used by the CLI.
  • Updated the fast-uri version override to require a newer compatible release.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: dc1b6041-cf36-4e04-9825-400eac4692d6

📥 Commits

Reviewing files that changed from the base of the PR and between 3dcc5b3 and dc72438.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• packages/cli/package.json
• pnpm-workspace.yaml

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates the CLI mysql2 dependency and raises the workspace fast-uri override threshold.

Changes

Dependency updates

Layer / File(s)	Summary
Dependency version constraints packages/cli/package.json, pnpm-workspace.yaml	The CLI pins mysql2 to 3.24.4. The workspace override maps fast-uri versions below 3.1.6 to >=3.1.6 <4.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other · Severity of issue fixed: High

Suggested reviewers: aqrln

Merge Risk: ⚪ Minimal · up to dc724

The dependency updates address the reported vulnerability floors, so the change is mergeable with normal checks.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR updates mysql2 from 3.15.3 to 3.24.4, which satisfies the mysql2 requirements in issue #30295 for versions 3.22.0 and 3.23.1. The reviewed change summary contains no update of `deepmerge-ts…	Update the applicable Prisma package dependency or override so that deepmerge-ts resolves to version 8.x or later. Include the change in this PR, or provide reviewable evidence that the required dependency is already present at the review…
Out of Scope Changes check	⚠️ Warning	The PR raises the fast-uri override floor from 3.1.5 to 3.1.6. Issue #30295 identifies mysql2 and deepmerge-ts advisories, and the available evidence does not connect fast-uri to those require…	Remove the fast-uri override change from this PR, or link it to a directly applicable coding requirement and provide evidence that it is required for the clean-audit outcome in issue #30295.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency updates and their purpose. It matches the mysql2 and fast-uri changes described in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

The PR updates mysql2 from 3.15.3 to 3.24.4, which satisfies the mysql2 requirements in issue #30295 for versions 3.22.0 and 3.23.1. The reviewed change summary contains no update of deepmerge-ts to 8.x. Issue #30295 lists that update as a required coding outcome. The reference to separate issue #30189 does not establish that the required change is present in this PR. The ignored pnpm-lock.yaml prevents verification of lockfile resolution, but the missing deepmerge-ts package change is independently unresolved.

Resolution

Update the applicable Prisma package dependency or override so that deepmerge-ts resolves to version 8.x or later. Include the change in this PR, or provide reviewable evidence that the required dependency is already present at the reviewed head.

Full details: Out of Scope Changes check

Explanation

The PR raises the fast-uri override floor from 3.1.5 to 3.1.6. Issue #30295 identifies mysql2 and deepmerge-ts advisories, and the available evidence does not connect fast-uri to those requirements. This is a separate dependency change from the linked issue's stated scope.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/v7-mysql2-audit

Warning

Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use path_filters to narrow the review scope.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

size-limit report 📦

Path	Size
packages/client/runtime/index-browser.js	2.29 KB (0%)
packages/client/runtime/index-browser.d.ts	3.37 KB (0%)
packages/cli/build/index.js	110 B (0%)
packages/client/prisma-client-0.0.0.tgz	25.59 MB (+0.01% 🔺)
packages/cli/prisma-0.0.0.tgz	13.52 MB (-0.01% 🔽)
packages/bundle-size/da-workers-libsql/output.tgz	1.28 MB (0%)
packages/bundle-size/da-workers-neon/output.tgz	1.35 MB (0%)
packages/bundle-size/da-workers-pg/output.tgz	1.34 MB (0%)
packages/bundle-size/da-workers-planetscale/output.tgz	1.28 MB (0%)
packages/bundle-size/da-workers-d1/output.tgz	1.26 MB (0%)