Repository navigation
fix(v7): repair CI on every v7 pull request, and update mariadb to 3.5.4 with its IPv6 parsing change - #30668
Merged
Merged
Conversation
pnpm audit --prod fails on every pull request to v7 since advisories published after 16 September, and the macOS jobs fail because Homebrew no longer ships a prebuilt MySQL for macOS 14 and the source build breaks. - mariadb 3.5.3 -> 3.5.4 in adapter-mariadb - override source-map-js to >=1.2.2 - ignore the braces and sprintf-js advisories, which have no patched release and are not reachable with attacker input - run the macOS jobs on macos-15 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io>
Contributor
Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
size-limit report 📦
|
…anged mariadb 3.5.4 parses connection strings with the WHATWG URL parser and accepts a bracketed IPv6 host such as [::1]. The adapter percent-encoded the host for the old regex parser, which 3.5.4 no longer decodes, so the driver dialled the literal string "%3A%3A1" instead of ::1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io>
wmadden
approved these changes
Oct 9, 2026
OIRNOIR
pushed a commit
to OIRNOIR/YouTube-Helper-Server
that referenced
this pull request
Oct 23, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@prisma/client](https://www.prisma.io) ([source](https://github.com/prisma/orm/tree/HEAD/packages/client)) | imports | patch | [`7.10.0` -> `7.10.1`](https://renovatebot.com/diffs/npm/@prisma%2fclient/7.10.0/7.10.1) | --- ### Release Notes <details> <summary>prisma/orm (@​prisma/client)</summary> ### [`v7.10.1`](https://github.com/prisma/orm/releases/tag/7.10.1) [Compare Source](prisma/orm@7.10.0...7.10.1) Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories. ##### Fixes ##### Prisma Client: nested `$transaction` no longer changes the options object you pass in If you passed the same options object to a nested `tx.$transaction(...)` and later to a top-level `prisma.$transaction(...)`, the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction: - if the old transaction had committed, the new one failed with `P2028`; - if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction. ```ts const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 } await prisma.$transaction(async (tx) => { await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS) }) // Before 7.10.1, this call could fail with P2028 or join another transaction. await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS) ``` Prisma Client no longer modifies the options object. ([#​30368](prisma/orm#30368), thanks [@​lazerg](https://github.com/lazerg)) ##### Prisma Migrate: refuse a shadow database that is the main database Prisma Migrate now refuses to run with error `P3025` when the shadow database URL points at the same database as the main database URL. Before, `prisma migrate diff --from-migrations` with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. ([prisma/prisma-engines#5851](prisma/prisma-engines#5851)) ##### MariaDB adapter: updated to `mariadb` 3.5.4 `@prisma/adapter-mariadb` now depends on `mariadb` 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because `mariadb` 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. ([#​30668](prisma/orm#30668)) ##### Dependency updates Dependencies with security advisories were updated: `mysql2`, `fast-uri`, `deepmerge-ts`, `mariadb` and `source-map-js`. ([#​30314](prisma/orm#30314), [#​30189](prisma/orm#30189), [#​30668](prisma/orm#30668)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjguMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE2OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.oirnoir.dev/OIRNOIR/YouTube-Helper-Server/pulls/59
OIRNOIR
pushed a commit
to OIRNOIR/YouTube-Helper-Server
that referenced
this pull request
Oct 23, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@prisma/adapter-pg](https://github.com/prisma/orm) ([source](https://github.com/prisma/orm/tree/HEAD/packages/adapter-pg)) | imports | patch | [`7.10.0` -> `7.10.1`](https://renovatebot.com/diffs/npm/@prisma%2fadapter-pg/7.10.0/7.10.1) | --- ### Release Notes <details> <summary>prisma/orm (@​prisma/adapter-pg)</summary> ### [`v7.10.1`](https://github.com/prisma/orm/releases/tag/7.10.1) [Compare Source](prisma/orm@7.10.0...7.10.1) Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories. ##### Fixes ##### Prisma Client: nested `$transaction` no longer changes the options object you pass in If you passed the same options object to a nested `tx.$transaction(...)` and later to a top-level `prisma.$transaction(...)`, the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction: - if the old transaction had committed, the new one failed with `P2028`; - if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction. ```ts const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 } await prisma.$transaction(async (tx) => { await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS) }) // Before 7.10.1, this call could fail with P2028 or join another transaction. await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS) ``` Prisma Client no longer modifies the options object. ([#​30368](prisma/orm#30368), thanks [@​lazerg](https://github.com/lazerg)) ##### Prisma Migrate: refuse a shadow database that is the main database Prisma Migrate now refuses to run with error `P3025` when the shadow database URL points at the same database as the main database URL. Before, `prisma migrate diff --from-migrations` with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. ([prisma/prisma-engines#5851](prisma/prisma-engines#5851)) ##### MariaDB adapter: updated to `mariadb` 3.5.4 `@prisma/adapter-mariadb` now depends on `mariadb` 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because `mariadb` 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. ([#​30668](prisma/orm#30668)) ##### Dependency updates Dependencies with security advisories were updated: `mysql2`, `fast-uri`, `deepmerge-ts`, `mariadb` and `source-map-js`. ([#​30314](prisma/orm#30314), [#​30189](prisma/orm#30189), [#​30668](prisma/orm#30668)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjguMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE2OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.oirnoir.dev/OIRNOIR/YouTube-Helper-Server/pulls/58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every pull request to
v7currently fails CI, whatever it changes. Here is what #30368, a one-line client fix, gets today:This PR makes
v7CI pass again in three ways:mariadbandsource-map-js.pnpm auditto ignore two advisories, forbracesandsprintf-js. These have no patched release, and Prisma can't be attacked through them.macos-14runner tomacos-latest.The
mariadbupdate reaches users.@prisma/adapter-mariadbnow depends onmariadb3.5.4 instead of 3.5.3, and it stops rewriting IPv6 hosts in connection strings, because 3.5.4 accepts them as written. Without that second change, the update would break IPv6 connections.Why CI broke without a code change
v7last passed CI on 16 September. Nothing in the repository broke it. Two things outside the repository changed after that date.New security advisories fail the audit step
The Lint job ends with
pnpm audit --prod. That step fails when any production dependency has a known advisory. Since 16 September, advisories were published against four packages in our lockfile:mariadb3.5.3@prisma/adapter-mariadb, a direct dependencysource-map-js1.2.1@prisma/config>c12>magicastbraces3.0.3@prisma/client-generator-ts>fast-glob>micromatchsprintf-js1.1.3@prisma/adapter-mssql>mssql>tediousThe first two have fixes, so we take them. The overrides follow the same pattern as #30314, the previous audit fix on
v7.The last two can't be fixed by upgrading. Their advisories name 3.0.4 and 1.1.4 as the patched versions, but neither version exists on npm: 3.0.3 and 1.1.3 are the latest releases. Both advisories describe a crash that happens only when an attacker controls the input string, and in Prisma no attacker can:
fast-glob, which usesbraces, only with patterns built from the user's own output folder (generateClient.ts).tedious, the SQL Server driver, callssprintfonly with its own fixed message templates, for debug output and error messages.So
pnpm-workspace.yamlnow lists both advisory IDs underauditConfig.ignoreGhsas, with this reason written next to them. Once fixed releases exist, the ignores can go.Updating
mariadbneeds a change to the adaptermariadb3.5.3 parsed connection strings with a regular expression that rejected the colons in a bracketed IPv6 host such as[::1]. So@prisma/adapter-mariadbrewrote that host to a percent-encoded form, which the old parser decoded back into::1(#29026):mariadb3.5.4 parses connection strings with the standardURLparser instead, and it accepts[::1]as written. It no longer decodes the host, so the rewritten string made the driver look up a host literally named%3A%3A1. The adapter's IPv6 tests caught this. The adapter now passes the bracketed host through unchanged, and the tests check that the driver accepts it and connects to a server listening on::1. The release notes for 3.5.4 don't mention this parser change. Its other changes are security limits, such as the newmaxAllowedColumnsoption, and bug fixes.Homebrew dropped macOS 14
The cross-platform test jobs run on Windows and macOS, and on macOS they install MySQL with
brew install mysql. Homebrew no longer ships prebuilt packages for macOS 14, so that command now compiles MySQL from source, and the compile fails. GitHub has deprecated themacos-14runner as well.We pinned
macos-14in #22904 in March 2024, when it was the newest runner, and nobody moved the pin after that. This PR switches those jobs, andbuild-engine-branch.yml, tomacos-latest, which is macOS 26 on Apple Silicon today. The same jobs already usewindows-latest, and one other macOS job intest-template.ymlalready usedmacos-latest.How it was checked
pnpm audit --prodexits 0 locally. The lockfile diff touches onlymariadb,source-map-jsandiconv-lite, whichmariadb3.5.4 depends on.@prisma/adapter-mariadbunit tests pass locally, including the IPv6 test that connects to a server on::1.Agent: nestor-69
🤖 Generated with Claude Code