[dependabot]

Bumps the prisma group with 5 updates in the / directory:

Package	From	To
@prisma/generator-helper	7.10.0	7.10.1
@prisma/client-runtime-utils	7.10.0	7.10.1
@prisma/dmmf	7.10.0	7.10.1
@prisma/generator	7.10.0	7.10.1
prisma	7.10.0	7.10.1

Updates @prisma/generator-helper from 7.10.0 to 7.10.1

Release notes

Sourced from @​prisma/generator-helper's releases.

7.10.1

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

• if the old transaction had committed, the new one failed with P2028;
• if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.

const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 }
await prisma.$transaction(async (tx) => {
await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS)
})
// Before 7.10.1, this call could fail with P2028 or join another transaction.
await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)

Prisma Client no longer modifies the options object. (prisma/orm#30368, thanks @​lazerg)

Prisma Migrate: refuse a shadow database that is the main database

Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (prisma/prisma-engines#5851)

MariaDB adapter: updated to mariadb 3.5.4

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (prisma/orm#30668)

Dependency updates

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (prisma/orm#30314, prisma/orm#30189, prisma/orm#30668)

Commits

• 312e543 chore: update npm provenance repository (#30146)
• See full diff in compare view

Updates @prisma/client-runtime-utils from 7.10.0 to 7.10.1

Release notes

Sourced from @​prisma/client-runtime-utils's releases.

7.10.1

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

• if the old transaction had committed, the new one failed with P2028;
• if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.

const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 }
await prisma.$transaction(async (tx) => {
await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS)
})
// Before 7.10.1, this call could fail with P2028 or join another transaction.
await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)

Prisma Client no longer modifies the options object. (prisma/orm#30368, thanks @​lazerg)

Prisma Migrate: refuse a shadow database that is the main database

Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (prisma/prisma-engines#5851)

MariaDB adapter: updated to mariadb 3.5.4

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (prisma/orm#30668)

Dependency updates

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (prisma/orm#30314, prisma/orm#30189, prisma/orm#30668)

Commits

• 312e543 chore: update npm provenance repository (#30146)
• See full diff in compare view

Updates @prisma/dmmf from 7.10.0 to 7.10.1

Release notes

Sourced from @​prisma/dmmf's releases.

7.10.1

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

• if the old transaction had committed, the new one failed with P2028;
• if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.

const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 }
await prisma.$transaction(async (tx) => {
await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS)
})
// Before 7.10.1, this call could fail with P2028 or join another transaction.
await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)

Prisma Client no longer modifies the options object. (prisma/orm#30368, thanks @​lazerg)

Prisma Migrate: refuse a shadow database that is the main database

Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (prisma/prisma-engines#5851)

MariaDB adapter: updated to mariadb 3.5.4

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (prisma/orm#30668)

Dependency updates

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (prisma/orm#30314, prisma/orm#30189, prisma/orm#30668)

Commits

• 312e543 chore: update npm provenance repository (#30146)
• See full diff in compare view

Updates @prisma/generator from 7.10.0 to 7.10.1

Release notes

Sourced from @​prisma/generator's releases.

7.10.1

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

• if the old transaction had committed, the new one failed with P2028;
• if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.

const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 }
await prisma.$transaction(async (tx) => {
await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS)
})
// Before 7.10.1, this call could fail with P2028 or join another transaction.
await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)

Prisma Client no longer modifies the options object. (prisma/orm#30368, thanks @​lazerg)

Prisma Migrate: refuse a shadow database that is the main database

Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (prisma/prisma-engines#5851)

MariaDB adapter: updated to mariadb 3.5.4

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (prisma/orm#30668)

Dependency updates

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (prisma/orm#30314, prisma/orm#30189, prisma/orm#30668)

Commits

• 312e543 chore: update npm provenance repository (#30146)
• See full diff in compare view

Updates prisma from 7.10.0 to 7.10.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[arthurfiorette]

@kody start-review

[mira-arthur]

✅ Review complete

Kody Self-Hosted finished reviewing this PR with the repository's current settings.

Using Kody on this repository

• Request another review: comment @kody start-review at the root of the PR.
• Ask a question: reply to a suggestion starting with @kody, for example @kody why is this a problem?
• Give feedback: react to a suggestion with 👍 if it helped or 👎 if it didn't. Reactions shape future reviews.
• Add context: mention the affected route (e.g. POST /api/payments) in the PR description, or attach a repository file with @file:path/to/file.md#L10-L50 (for example @file:CONTRIBUTING.md or @file:openapi.yaml).

Current review configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Kody Code Review — 1 suggested fix.
Paste the prompt below to your agent and all review fixed at once!

🛠️ Open Agent Prompt

A code review identified the following issues in this pull request.
Each section describes what was found and includes a reference implementation where available.

Files involved:
- pnpm-lock.yaml:47

---

### [1/1] pnpm-lock.yaml:47
Issue identified during code review:
Prisma CLI/runtime-utils bumped to 7.10.1 while @prisma/client stays at 7.8.0

The lockfile resolves the `prisma` CLI and `@prisma/client-runtime-utils` to 7.10.1 (with engines-version 8.1.0-1), but `@prisma/client` stays at 7.8.0 and still depends on `@prisma/client-runtime-utils` 7.8.0. The generator, DMMF and engines come from 7.10.1 while the client runtime and types come from 7.8.0, a mismatch that can break the generated client or TypedSQL output. This is the likely cause of the failing 'TypedSQL' CI job. Bump `@prisma/client` (and the peer ranges in package.json) in the same group update so every prisma package resolves to the same version, then regenerate the lockfile and re-run the TypedSQL job.
Reference implementation (from code review):

// pnpm-lock.yaml:47
'@prisma/client':
        specifier: ^7.10.0
        version: 7.10.1(prisma@7.10.1(...))(typescript@6.0.3)
...
      '@prisma/client-runtime-utils':
        specifier: ^7.10.0
        version: 7.10.1
...
      prisma:
        specifier: ^7.10.0
        version: 7.10.1(...)

---

Review each issue in context, use the reference implementations as guidance, and apply fixes that are consistent with the surrounding codebase.

[mira-arthur]

Prisma CLI/runtime-utils bumped to 7.10.1 while @prisma/client stays at 7.8.0

The generator and engines come from 7.10.1 while the client runtime and types stay at 7.8.0, which can break the generated client or TypedSQL output and likely explains the failing 'TypedSQL' job. Bump @prisma/client and its peer ranges in package.json so it matches prisma and @prisma/client-runtime-utils, then regenerate the lockfile.

Prompt for LLM

File pnpm-lock.yaml, lines 36-47:

Prisma CLI/runtime-utils bumped to 7.10.1 while @prisma/client stays at 7.8.0

The lockfile resolves the `prisma` CLI and `@prisma/client-runtime-utils` to 7.10.1 (with engines-version 8.1.0-1), but `@prisma/client` stays at 7.8.0 and still depends on `@prisma/client-runtime-utils` 7.8.0. The generator, DMMF and engines come from 7.10.1 while the client runtime and types come from 7.8.0, a mismatch that can break the generated client or TypedSQL output. This is the likely cause of the failing 'TypedSQL' CI job. Bump `@prisma/client` (and the peer ranges in package.json) in the same group update so every prisma package resolves to the same version, then regenerate the lockfile and re-run the TypedSQL job.

Suggested code:

'@prisma/client':
        specifier: ^7.10.0
        version: 7.10.1(prisma@7.10.1(...))(typescript@6.0.3)
...
      '@prisma/client-runtime-utils':
        specifier: ^7.10.0
        version: 7.10.1
...
      prisma:
        specifier: ^7.10.0
        version: 7.10.1(...)

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​