[wmadden-electric]

Every pull request to v7 currently fails CI, whatever it changes. Here is what #30368, a one-line client fix, gets today:

Lint             pnpm audit --prod  ->  7 vulnerabilities found (5 high, 2 moderate)
macOS (3 jobs)   brew install mysql ->  compiles MySQL 26.7.0 from source -> make: *** [all] Error 2

This PR makes v7 CI pass again in three ways:

1. It updates the two vulnerable dependencies that have patched releases: mariadb and source-map-js.
2. It tells pnpm audit to ignore two advisories, for braces and sprintf-js. These have no patched release, and Prisma can't be attacked through them.
3. It moves the macOS jobs from the deprecated macos-14 runner to macos-latest.

The mariadb update reaches users. @prisma/adapter-mariadb now depends on mariadb 3.5.4 instead of 3.5.3, and it stops rewriting IPv6 hosts in connection strings, because 3.5.4 accepts them as written. Without that second change, the update would break IPv6 connections.

Why CI broke without a code change

v7 last passed CI on 16 September. Nothing in the repository broke it. Two things outside the repository changed after that date.

New security advisories fail the audit step

The Lint job ends with pnpm audit --prod. That step fails when any production dependency has a known advisory. Since 16 September, advisories were published against four packages in our lockfile:

Package	Reached through	Advisories	What this PR does
mariadb 3.5.3	@prisma/adapter-mariadb, a direct dependency	4 (3 high)	Bumps it to 3.5.4, a patch release with the fixes
source-map-js 1.2.1	@prisma/config > c12 > magicast	1 (high)	Adds a pnpm override that forces at least 1.2.2
braces 3.0.3	@prisma/client-generator-ts > fast-glob > micromatch	GHSA-vfj7-8cjw-p6xm (high)	Ignores it
sprintf-js 1.1.3	@prisma/adapter-mssql > mssql > tedious	GHSA-hp3w-g68c-fv3c (moderate)	Ignores it

The first two have fixes, so we take them. The overrides follow the same pattern as #30314, the previous audit fix on v7.

The last two can't be fixed by upgrading. Their advisories name 3.0.4 and 1.1.4 as the patched versions, but neither version exists on npm: 3.0.3 and 1.1.3 are the latest releases. Both advisories describe a crash that happens only when an attacker controls the input string, and in Prisma no attacker can:

• The generator calls fast-glob, which uses braces, only with patterns built from the user's own output folder (generateClient.ts).
• tedious, the SQL Server driver, calls sprintf only with its own fixed message templates, for debug output and error messages.

So pnpm-workspace.yaml now lists both advisory IDs under auditConfig.ignoreGhsas, with this reason written next to them. Once fixed releases exist, the ignores can go.

Updating mariadb needs a change to the adapter

mariadb 3.5.3 parsed connection strings with a regular expression that rejected the colons in a bracketed IPv6 host such as [::1]. So @prisma/adapter-mariadb rewrote that host to a percent-encoded form, which the old parser decoded back into ::1 (#29026):

mariadb://user:pass@[::1]:3306/db  ->  mariadb://user:pass@%3A%3A1:3306/db

mariadb 3.5.4 parses connection strings with the standard URL parser instead, and it accepts [::1] as written. It no longer decodes the host, so the rewritten string made the driver look up a host literally named %3A%3A1. The adapter's IPv6 tests caught this. The adapter now passes the bracketed host through unchanged, and the tests check that the driver accepts it and connects to a server listening on ::1. The release notes for 3.5.4 don't mention this parser change. Its other changes are security limits, such as the new maxAllowedColumns option, and bug fixes.

Homebrew dropped macOS 14

The cross-platform test jobs run on Windows and macOS, and on macOS they install MySQL with brew install mysql. Homebrew no longer ships prebuilt packages for macOS 14, so that command now compiles MySQL from source, and the compile fails. GitHub has deprecated the macos-14 runner as well.

We pinned macos-14 in #22904 in March 2024, when it was the newest runner, and nobody moved the pin after that. This PR switches those jobs, and build-engine-branch.yml, to macos-latest, which is macOS 26 on Apple Silicon today. The same jobs already use windows-latest, and one other macOS job in test-template.yml already used macos-latest.

How it was checked

• pnpm audit --prod exits 0 locally. The lockfile diff touches only mariadb, source-map-js and iconv-lite, which mariadb 3.5.4 depends on.
• The @prisma/adapter-mariadb unit tests pass locally, including the IPv6 test that connects to a server on ::1.
• ESLint and Prettier pass on every changed file.
• The macOS change can only be checked by this PR's own CI run.

Agent: nestor-69

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: prisma/orm/.coderabbit.yml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c6023cd8-502f-4643-bd5f-9003d0729836

---

📥 Commits

Reviewing files that changed from the base of the PR and between bde9efa and 4cedefa.

---

📒 Files selected for processing (3)

• packages/adapter-mariadb/src/ipv6.test.ts
• packages/adapter-mariadb/src/mariadb.test.ts
• packages/adapter-mariadb/src/mariadb.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

---

📝 Walkthrough

Walkthrough

This change updates macOS runners in selected workflows, changes MariaDB adapter dependency and IPv6 connection-string handling, and adds workspace dependency and audit settings.

Changes

macOS workflow runners

Layer / File(s)	Summary
Workflow runner updates .github/workflows/build-engine-branch.yml, .github/workflows/test-template.yml	The build matrix and two test jobs now use macos-latest instead of macos-14. The corresponding heap-size conditions check for macos-latest; configured memory limits are unchanged.

MariaDB adapter updates

Layer / File(s)	Summary
IPv6 connection-string handling packages/adapter-mariadb/src/mariadb.ts, packages/adapter-mariadb/src/mariadb.test.ts, packages/adapter-mariadb/src/ipv6.test.ts, packages/adapter-mariadb/package.json	rewriteConnectionString still changes the mysql: protocol to mariadb: but no longer percent-encodes bracketed IPv6 hosts. Tests expect bracketed hosts to remain unchanged and check driver acceptance of the rewritten string. The mariadb dependency changes from 3.5.3 to 3.5.4.

Workspace dependency and audit settings

Layer / File(s)	Summary
Dependency override and audit settings pnpm-workspace.yaml	The workspace overrides source-map-js versions below 1.2.2 to >=1.2.2 <2. It also adds two GHSA identifiers to auditConfig.ignoreGhsas and includes comments about the stated constraints.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: aqrln

---

Merge Risk: ⚪ Minimal · up to 4cede

The IPv6 connection test exercises a real local listener, and the ignored advisories are not shown reachable through attacker-controlled inputs in the supported paths. No actionable merge-blocking risk remains; normal checks still apply.

Architecture Summary

Architecture risk: 🔵 Low · up to 4cede

The change affects 2 systems.

Changed systems: packages/adapter-mariadb, pnpm-workspace.yaml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — packages/adapter-mariadb (library) was modified; 4 changed files map to changed impact.
• observed — pnpm-workspace.yaml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in packages/adapter-mariadb/package.json: The package now depends on mariadb version 3.5.4 instead of 3.5.3.
• observed — Modified behavior in pnpm-workspace.yaml: Adds an override requiring source-map-js versions below 1.2.2 to resolve to >=1.2.2 <2.
• observed — Modified behavior in pnpm-workspace.yaml: Adds comments stating that no patched release exists and describing the stated input constraints for fast-glob and tedious; adds both GHSA identifiers to auditConfig.ignoreGhsas.
• observed — Modified behavior in packages/adapter-mariadb/src/ipv6.test.ts: The test is renamed to describe driver acceptance and calls createPool with the rewritten connection string. It removes the explicit assertions that the original string throws a parsing error and the rewritten string does not.

---

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately summarizes the two main changes: CI repairs for v7 pull requests and the MariaDB 3.5.4 update with its IPv6 parsing change. It is specific and related to the full changeset, altho…

---

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

size-limit report 📦

Path	Size
packages/client/runtime/index-browser.js	2.29 KB (0%)
packages/client/runtime/index-browser.d.ts	3.37 KB (0%)
packages/cli/build/index.js	110 B (0%)
packages/client/prisma-client-0.0.0.tgz	25.59 MB (-0.01% 🔽)
packages/cli/prisma-0.0.0.tgz	13.52 MB (0%)
packages/bundle-size/da-workers-libsql/output.tgz	1.28 MB (0%)
packages/bundle-size/da-workers-neon/output.tgz	1.35 MB (0%)
packages/bundle-size/da-workers-pg/output.tgz	1.34 MB (0%)
packages/bundle-size/da-workers-planetscale/output.tgz	1.28 MB (0%)
packages/bundle-size/da-workers-d1/output.tgz	1.26 MB (0%)