From dc72438a45041f20465f865818d4beaa87ad9a00 Mon Sep 17 00:00:00 2001 From: willbot Date: Wed, 16 Sep 2026 11:22:25 +0200 Subject: [PATCH] chore(deps): bump mysql2 and fast-uri past audited vulnerabilities npm audit on prisma@7.10.0 reports two mysql2 advisories: - GHSA-3f6p-5ww8-9rcr (high): a server can downgrade authentication to mysql_clear_password and read the password in plaintext. Fixed in 3.22.0. - GHSA-rgwj-5xj2-c3m3 (moderate): unbounded zlib inflate in the compressed protocol handler. Fixed in 3.23.1. Bump the CLI's mysql2 pin from 3.15.3 to 3.24.4. Prisma Studio is its only consumer. pnpm audit --prod also fails on four fast-uri advisories reached through @prisma/dev > @prisma/streams-local > ajv, which fail the audit step on every PR to this branch. Raise the existing fast-uri override floor from 3.1.5 to 3.1.6. Refs #30295 Co-Authored-By: Claude Opus 5 Signed-off-by: willbot Signed-off-by: Will Madden --- packages/cli/package.json | 2 +- pnpm-lock.yaml | 74 ++++++++++++++++++--------------------- pnpm-workspace.yaml | 2 +- 3 files changed, 37 insertions(+), 41 deletions(-) diff --git a/packages/cli/package.json b/packages/cli/package.json index 932641e4e78b..822fe500f5ea 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -188,7 +188,7 @@ "@prisma/dev": "0.24.17", "@prisma/engines": "workspace:*", "@prisma/studio-core": "0.33.0", - "mysql2": "3.15.3", + "mysql2": "3.24.4", "postgres": "3.4.7" }, "peerDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a1ba6ef926e9..c066112fd0e7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,7 +13,7 @@ overrides: ajv@^8.0.0: '>=8.18.0' '@azure/core-rest-pipeline@^1.0.0': '>=1.14.0' '@azure/msal-node>uuid': '>=14.0.0' - fast-uri@<3.1.5: '>=3.1.5 <4' + fast-uri@<3.1.6: '>=3.1.6 <4' ws@>=8.0.0 <8.20.1: '>=8.20.1' importers: @@ -443,8 +443,8 @@ importers: specifier: 0.33.0 version: 0.33.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.0(react@19.2.0))(react@19.2.0) mysql2: - specifier: 3.15.3 - version: 3.15.3 + specifier: 3.24.4 + version: 3.24.4(@types/node@20.19.25) postgres: specifier: 3.4.7 version: 3.4.7 @@ -6018,8 +6018,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.8: + resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -6986,14 +6986,14 @@ packages: resolution: {integrity: sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==} engines: {node: '>=10'} - lru-cache@7.18.3: - resolution: {integrity: sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==} - engines: {node: '>=12'} - lru.min@1.1.3: resolution: {integrity: sha512-Lkk/vx6ak3rYkRR0Nhu4lFUT2VDnQSxBe8Hbl7f36358p6ow8Bnvr8lrLt98H8J1aGxfhbX4Fs5tYg2+FTwr5Q==} engines: {bun: '>=1.0.0', deno: '>=1.30.0', node: '>=8.0.0'} + lru.min@1.1.5: + resolution: {integrity: sha512-5J9ysMYUpYIg9RF2vJpy9SinEmSviFSe0GyPpCQ4L5QSkLAgeLXlTAOu2ZwWUU5m+0SBl6gUU1R1ZQB3aKypfA==} + engines: {bun: '>=1.0.0', deno: '>=1.30.0', node: '>=8.0.0'} + magic-string@0.25.9: resolution: {integrity: sha512-RmF0AsMzgt25qzqqLc1+MbHmhdx0ojF2Fvs4XnOqz2ZOBXzzkEwc/dJQZCYHAn7v1jbVOjAZfK8msRn4BxO4VQ==} @@ -7264,13 +7264,15 @@ packages: resolution: {integrity: sha512-WWdIxpyjEn+FhQJQQv9aQAYlHoNVdzIzUySNV1gHUPDSdZJ3yZn7pAAbQcV7B56Mvu881q9FZV+0Vx2xC44VWA==} engines: {node: ^18.17.0 || >=20.5.0} - mysql2@3.15.3: - resolution: {integrity: sha512-FBrGau0IXmuqg4haEZRBfHNWB5mUARw6hNwPDXXGg0XzVJ50mr/9hb267lvpVMnhZ1FON3qNd4Xfcez1rbFwSg==} + mysql2@3.24.4: + resolution: {integrity: sha512-A2olluVlj0mvgyIRRISMEzXc51m+21mRtcMVjJyIpt2GG98+XrC9m9HzsqcMsX2LcnfccJvY5NB22g8fENBnOA==} engines: {node: '>= 8.0'} + peerDependencies: + '@types/node': '>= 8' - named-placeholders@1.1.3: - resolution: {integrity: sha512-eLoBxg6wE/rZkJPhU/xRX1WTpkFEwDJEN96oxFrTsqBdbT5ec295Q+CoHrL9IT0DipqKhmGcaZmwOt8OON5x1w==} - engines: {node: '>=12.0.0'} + named-placeholders@1.1.6: + resolution: {integrity: sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==} + engines: {node: '>=8.0.0'} nanoid@3.3.11: resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==} @@ -8057,9 +8059,6 @@ packages: resolution: {integrity: sha512-uaW0WwXKpL9blXE2o0bRhoL2EGXIrZxQ2ZQ4mgcfoBxdFmQold+qWsD2jLrfZ0trjKL6vOw0j//eAwcALFjKSw==} engines: {node: '>= 18'} - seq-queue@0.0.5: - resolution: {integrity: sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q==} - serialize-javascript@6.0.1: resolution: {integrity: sha512-owoXEFjWRllis8/M1Q+Cw5k8ZH40e3zhp/ovX+Xr/vi1qj6QesbyXXViFbpNvWvPNAD62SutwEXavefrLJWj7w==} @@ -8211,6 +8210,10 @@ packages: sprintf-js@1.1.3: resolution: {integrity: sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==} + sql-escaper@1.5.2: + resolution: {integrity: sha512-6CKD38c31SENivxOADeMNLdukOnUxUcflKtzVWzace7Riv1v7cAEym5Cx9Q7gYZ3ezIJI7ZpqecQq8cqNeSSFg==} + engines: {bun: '>=1.0.0', deno: '>=2.0.0', node: '>=12.0.0'} + sql-template-tag@5.2.1: resolution: {integrity: sha512-lFdvXCOqWhV40A7w4oQVDyuaNFb5yO+dhsHStZzOdtDJWCBWYv4+hhATK5nPpY5v/T1OMVcLMPeN4519qIyb9Q==} engines: {node: '>=14'} @@ -8221,10 +8224,6 @@ packages: sqlite3@5.1.7: resolution: {integrity: sha512-GGIyOiFaG+TUra3JIfkI/zGP8yZYLPQ0pl1bH+ODjiX57sPhrLU5sQJn1y9bDKZUFYkX1crlrPfSYt0BKKdkog==} - sqlstring@2.3.3: - resolution: {integrity: sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg==} - engines: {node: '>= 0.6'} - ssri@8.0.1: resolution: {integrity: sha512-97qShzy1AiyxvPNIkLWoGua7xoQzzPjQ0HAH4B0rWKo7SZ6USuPcrUiAFrws0UH8RrbWmgq3LMTObhPIHbbBeQ==} engines: {node: '>= 8'} @@ -10972,7 +10971,7 @@ snapshots: '@redocly/ajv@8.17.1': dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.8 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -11976,7 +11975,7 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.8 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -13253,7 +13252,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.5: {} + fast-uri@3.1.8: {} fast-wrap-ansi@0.2.2: dependencies: @@ -14470,10 +14469,10 @@ snapshots: dependencies: yallist: 4.0.0 - lru-cache@7.18.3: {} - lru.min@1.1.3: {} + lru.min@1.1.5: {} + magic-string@0.25.9: dependencies: sourcemap-codec: 1.4.8 @@ -14793,21 +14792,20 @@ snapshots: mute-stream@2.0.0: {} - mysql2@3.15.3: + mysql2@3.24.4(@types/node@20.19.25): dependencies: + '@types/node': 20.19.25 aws-ssl-profiles: 1.1.2 - denque: 2.1.0 generate-function: 2.3.1 - iconv-lite: 0.7.0 + iconv-lite: 0.7.3 long: 5.3.2 - lru.min: 1.1.3 - named-placeholders: 1.1.3 - seq-queue: 0.0.5 - sqlstring: 2.3.3 + lru.min: 1.1.5 + named-placeholders: 1.1.6 + sql-escaper: 1.5.2 - named-placeholders@1.1.3: + named-placeholders@1.1.6: dependencies: - lru-cache: 7.18.3 + lru.min: 1.1.3 nanoid@3.3.11: {} @@ -15586,8 +15584,6 @@ snapshots: transitivePeerDependencies: - supports-color - seq-queue@0.0.5: {} - serialize-javascript@6.0.1: dependencies: randombytes: 2.1.0 @@ -15780,6 +15776,8 @@ snapshots: sprintf-js@1.1.3: {} + sql-escaper@1.5.2: {} + sql-template-tag@5.2.1: {} sqlite-async@1.2.2: @@ -15805,8 +15803,6 @@ snapshots: - bluebird - supports-color - sqlstring@2.3.3: {} - ssri@8.0.1: dependencies: minipass: 3.3.6 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 9598ad4c29f6..66b9e45be72f 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -23,7 +23,7 @@ overrides: ajv@^8.0.0: '>=8.18.0' '@azure/core-rest-pipeline@^1.0.0': '>=1.14.0' '@azure/msal-node>uuid': '>=14.0.0' - fast-uri@<3.1.5: '>=3.1.5 <4' + fast-uri@<3.1.6: '>=3.1.6 <4' ws@>=8.0.0 <8.20.1: '>=8.20.1' peerDependencyRules: