fix(adapter-neon): map args through mapArg in PrismaNeonHttpAdapter by santichausis · Pull Request #29747 · prisma/orm

santichausis · 2026-07-21T13:39:09Z

Description

PrismaNeonHttpAdapter.performIO passes query arguments to the Neon HTTP client without running them through mapArg, while NeonWsQueryable.performIO (used by the WebSocket adapter, same file) maps every argument:

// NeonWsQueryable.performIO (WebSocket) — correct
args.map((arg, i) => mapArg(arg, query.argTypes[i]))

// PrismaNeonHttpAdapter.performIO (HTTP) — args passed through raw, before this PR
const { sql, args: values } = query

mapArg is what converts the engine's wire representation of arguments into driver-ready values — e.g. Bytes arguments arrive as base64 strings and need decoding to a Buffer, and Date arguments need to be formatted in UTC rather than left to the driver's default (local-timezone) serialization. Skipping it on the HTTP path caused two silent data-corruption bugs, with no error raised anywhere:

Bytes values are stored/compared as literal base64 text instead of raw bytes — writes are corrupted, and filters on Bytes columns never match rows written by anything other than the HTTP adapter itself.
Date values are serialized with the process's local timezone offset instead of UTC, so a timestamp (without time zone) column silently stores skewed wall-clock time.

This applies the same mapArg call the WebSocket path already uses, in PrismaNeonHttpAdapter.performIO.

Closes #29743

Test plan

Added a regression test in packages/adapter-neon/src/__tests__/neon.test.ts (there were no existing tests for PrismaNeonHttpAdapter) that constructs the adapter with a mocked query function and asserts a base64-encoded Bytes argument is decoded to a Buffer before being passed to the client, rather than passed through as the raw base64 string.
Confirmed the new test fails on the pre-fix code with the exact corruption described in the issue (expected 'aGVsbG8tcmF3LWJ5dGVz' to be an instance of Buffer), and passes with the fix.
pnpm run test in packages/adapter-neon — 5/5 tests passing.
eslint on the changed files — no new errors (3 pre-existing warnings elsewhere in the file, unrelated to this change).

PrismaNeonHttpAdapter.performIO passed query arguments to the Neon HTTP client unmapped, while NeonWsQueryable.performIO (used by the WebSocket adapter, same file) maps every argument through mapArg. This silently corrupted data on the HTTP adapter: Bytes arguments arrive from the engine as base64 strings, so without mapArg they were written and compared as literal base64 text instead of raw bytes, and Date arguments were serialized with the process's local timezone offset instead of UTC. No error was raised in either case. Apply the same mapArg call the WebSocket path already uses, and add a regression test (there were none for PrismaNeonHttpAdapter). Closes prisma#29743

coderabbitai · 2026-07-21T13:39:44Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9382b80d-35a4-488f-88e8-04b48ec831a6

📥 Commits

Reviewing files that changed from the base of the PR and between f5d6d35 and 370b355.

📒 Files selected for processing (1)

packages/adapter-neon/src/__tests__/neon.test.ts

Summary by CodeRabbit

Bug Fixes
- Fixed Neon HTTP queries so byte-encoded arguments are correctly decoded before being sent.
- Ensured base64-encoded values are not forwarded unchanged to the underlying database client.
- Correctly maps ISO UTC datetime arguments to the expected UTC timestamp format.
Tests
- Added coverage verifying correct handling of byte arguments and datetime mapping in Neon HTTP queries.

Walkthrough

Updated PrismaNeonHttpAdapter.performIO to map SQL query arguments with mapArg before sending them to the Neon HTTP client. Added tests covering base64-encoded bytes and ISO datetime arguments, verifying they are converted to a Buffer and UTC timestamp string respectively.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: mapping HTTP adapter args through mapArg.
Description check	✅ Passed	The description matches the code changes and explains the bug, fix, and regression tests.
Linked Issues check	✅ Passed	The PR implements the linked issue by mapping Neon HTTP query args through mapArg and adding Bytes and DateTime coverage.
Out of Scope Changes check	✅ Passed	The changes stay within the issue scope, with only the adapter fix and targeted regression tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

✨ Simplify code

Create PR with simplified code

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/adapter-neon/src/__tests__/neon.test.ts`:
- Around line 82-102: Add a DateTime mapping test alongside the existing Bytes
test for PrismaNeonHttpAdapter.performIO, using a DateTime argument and its date
scalar type. Assert that the value passed through mockClient is the expected UTC
string, confirming local-time serialization does not skew the parameter.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f94ca5ed-08e8-424b-bb97-12dc9bb649c5

📥 Commits

Reviewing files that changed from the base of the PR and between a6d0155 and f5d6d35.

📒 Files selected for processing (2)

packages/adapter-neon/src/__tests__/neon.test.ts
packages/adapter-neon/src/neon.ts

Add a regression test for the DateTime-skew half of the mapArg fix, alongside the existing Bytes test.

santichausis · 2026-07-21T19:08:07Z

Good call — added a DateTime test alongside the Bytes one, asserting the exact UTC-formatted string formatDateTime produces rather than just checking it changed.

…risma#29747) ## Description `PrismaNeonHttpAdapter.performIO` passes query arguments to the Neon HTTP client without running them through `mapArg`, while `NeonWsQueryable.performIO` (used by the WebSocket adapter, same file) maps every argument: ```ts // NeonWsQueryable.performIO (WebSocket) — correct args.map((arg, i) => mapArg(arg, query.argTypes[i])) // PrismaNeonHttpAdapter.performIO (HTTP) — args passed through raw, before this PR const { sql, args: values } = query ``` `mapArg` is what converts the engine's wire representation of arguments into driver-ready values — e.g. `Bytes` arguments arrive as base64 strings and need decoding to a `Buffer`, and `Date` arguments need to be formatted in UTC rather than left to the driver's default (local-timezone) serialization. Skipping it on the HTTP path caused two silent data-corruption bugs, with no error raised anywhere: 1. **`Bytes` values are stored/compared as literal base64 text** instead of raw bytes — writes are corrupted, and filters on `Bytes` columns never match rows written by anything other than the HTTP adapter itself. 2. **`Date` values are serialized with the process's local timezone offset** instead of UTC, so a `timestamp` (without time zone) column silently stores skewed wall-clock time. This applies the same `mapArg` call the WebSocket path already uses, in `PrismaNeonHttpAdapter.performIO`. Closes prisma#29743 ## Test plan - Added a regression test in `packages/adapter-neon/src/__tests__/neon.test.ts` (there were no existing tests for `PrismaNeonHttpAdapter`) that constructs the adapter with a mocked query function and asserts a base64-encoded `Bytes` argument is decoded to a `Buffer` before being passed to the client, rather than passed through as the raw base64 string. - Confirmed the new test fails on the pre-fix code with the exact corruption described in the issue (`expected 'aGVsbG8tcmF3LWJ5dGVz' to be an instance of Buffer`), and passes with the fix. - `pnpm run test` in `packages/adapter-neon` — 5/5 tests passing. - `eslint` on the changed files — no new errors (3 pre-existing warnings elsewhere in the file, unrelated to this change).

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@prisma/adapter-pg](https://github.com/prisma/prisma) ([source](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg)) | imports | minor | [`7.9.1` -> `7.10.0`](https://renovatebot.com/diffs/npm/@prisma%2fadapter-pg/7.9.1/7.10.0) | | [@prisma/client](https://www.prisma.io) ([source](https://github.com/prisma/prisma/tree/HEAD/packages/client)) | imports | minor | [`7.9.1` -> `7.10.0`](https://renovatebot.com/diffs/npm/@prisma%2fclient/7.9.1/7.10.0) | --- ### Release Notes <details> <summary>prisma/prisma (@prisma/adapter-pg)</summary> ### [`v7.10.0`](https://github.com/prisma/orm/releases/tag/7.10.0) [Compare Source](prisma/orm@7.9.1...7.10.0) ##### Prisma ORM 7.10.0 Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters. ##### Highlights ##### Run Prisma 7 alongside Prisma 8 This release introduces `@prisma/prisma7`, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project. Once 7.10.0 is released, a side-by-side installation can use: ```sh npm install --save-dev prisma@8 @prisma/prisma7@7.10.0 npm install @prisma/client@7.10.0 ``` Use `prisma` for the directly installed Prisma 8 CLI and `prisma7` for Prisma 7: ```sh npx prisma --version npx prisma7 --version npx prisma7 generate npx prisma7 migrate dev npx prisma7 db push ``` Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's `prisma.config.*` files: ```ts // prisma7.config.ts import { defineConfig } from '@prisma/prisma7/config' export default defineConfig({ schema: 'prisma/schema.prisma', migrations: { path: 'prisma/migrations', }, }) ``` Without an explicit `--config` option, Prisma 7 searches for: 1. Root-level `prisma7.config.*` files. 2. `.config/prisma7.*` files. 3. Existing `prisma.config.*` files as a backwards-compatible fallback. The supported extensions are `.js`, `.ts`, `.mjs`, `.cjs`, `.mts`, and `.cts`. An explicit config path always takes precedence: ```sh npx prisma7 generate --config ./custom/prisma7.config.ts ``` New projects initialized by the Prisma 7 CLI use `prisma7.config.ts`. Existing projects containing only `prisma.config.*` continue to work without migration or additional warnings. If a `prisma7.config.*` file exists but cannot be loaded, Prisma reports the error rather than silently falling back to another configuration. The `prisma7` identity is carried through CLI help, version output, shell completion, initialization, migration, database, and generation guidance. Stable Prisma concepts such as `schema.prisma`, Prisma Migrate, `@prisma/client`, and `PRISMA_*` environment variables remain unchanged. Together, the separate executable and configuration namespace make it possible to operate Prisma 7 and Prisma 8 side by side without command or config-file collisions. [#29949](prisma/orm#29949), [#29969](prisma/orm#29969), [#29994](prisma/orm#29994), [#30000](prisma/orm#30000), [#30002](prisma/orm#30002), [#30020](prisma/orm#30020) ##### Prisma Studio security hardening Prisma Studio's local HTTP server now: - Binds explicitly to `127.0.0.1` instead of all network interfaces. - Rejects browser requests from origins other than the active `localhost` or `127.0.0.1` Studio URL. - No longer returns wildcard CORS headers. - Applies the same protections across Node.js, Bun, and Deno. This prevents network clients or malicious websites from accessing Studio's database endpoints while Studio is running. [#29890](prisma/orm#29890) ##### Prisma Client - Fixed `P2002` errors from nested writes so `meta.modelName` identifies the model where the unique constraint violation occurred, including models using `@@map` and `@@schema`. [#29628](prisma/orm#29628) - Fixed automatically batched `findUniqueOrThrow()` calls so every missing record rejects with `P2025`; later misses no longer resolve to `undefined`. [#29654](prisma/orm#29654) - Parameter-chunked statements are now executed atomically in a transaction and rolled back if a later chunk fails. [#29771](prisma/orm#29771) - Improved interactive transaction cleanup during `$disconnect()`, including transactions whose driver-level startup is still in progress. [#28768](prisma/orm#28768) - Prevented transaction cleanup failures after a timeout or backend termination from becoming unhandled promise rejections. [#29611](prisma/orm#29611) - Fixed fluent relation queries when relation fields are literally named `select` or `include`. [#29683](prisma/orm#29683) - Fixed handling of `Date` and `Uint8Array` values created in other JavaScript realms, such as iframes, jsdom, and Node.js `vm` contexts. [#29177](prisma/orm#29177) - Invalid `Date` values passed to `$queryRaw` or `$executeRaw` now throw `PrismaClientValidationError` instead of a generic error. [#29718](prisma/orm#29718) - Fixed `moduleFormat` inference for the `prisma-client` generator in TypeScript projects using `module: "node16"` or `"nodenext"`. Generated output now follows the nearest `package.json` `type`, defaulting to CommonJS when absent. [#29712](prisma/orm#29712) - Deserialized `Bytes` values now own standalone `ArrayBuffer`s rather than exposing unrelated contents from Node.js's shared `Buffer` pool. This applies to both regular and raw query results. [#29701](prisma/orm#29701) - Fixed an incorrect logging context in the remote executor, including Accelerate-backed query execution. [#28892](prisma/orm#28892) ##### Client extensions and observability - Result-extension `compute` callbacks now receive the current model name as a typed second argument: ```ts compute(data, modelName) { // ... } ``` The model name is also preserved when multiple extensions compose the same computed field. [#29782](prisma/orm#29782) - Improved OpenTelemetry context for remotely executed queries: - `$on('query')` callbacks run within the matching `db_query` span. - Events from one operation share the same trace. - Error events are recorded as span exceptions. - Log events continue to be emitted when tracing is disabled or their reported span is unavailable. [#28892](prisma/orm#28892) ##### Driver adapters ##### MariaDB - `@prisma/adapter-mariadb` now accepts an existing `mariadb` pool. External pools remain caller-owned unless `disposeExternalPool: true` is supplied. [#27992](prisma/orm#27992) - Fixed pooled connection leaks during commit, rollback, and failed transaction startup. Connections are now returned with `release()` and transaction-specific listeners are removed before reuse. [#29612](prisma/orm#29612) - Added support for bracketed IPv6 addresses in both `mysql://` and `mariadb://` connection strings. [#29026](prisma/orm#29026) - Prevented malformed connection strings from exposing embedded passwords in retained debug output and diagnostic reports. [#27992](prisma/orm#27992) ##### PostgreSQL, Neon, and Prisma Postgres Serverless - PostgreSQL deadlocks using SQLSTATE `40P01` are now reported as `P2034` transaction write conflicts. [#29717](prisma/orm#29717) - PostgreSQL `RESTRICT` violations using SQLSTATE `23001` are now reported as `P2003`, preserving an available field or constraint name. [#29554](prisma/orm#29554) - `@prisma/adapter-pg` now preserves database constraint names when reporting unique constraint violations through `P2002`. [#29587](prisma/orm#29587) - Prisma Postgres Serverless now prefers the named constraint for `P2002`, falling back to parsed field names when no constraint name is available. [#29801](prisma/orm#29801) - Fixed Neon HTTP adapter serialization for typed parameters such as `Bytes` and `DateTime`. [#29747](prisma/orm#29747) ##### SQLite - `@prisma/adapter-better-sqlite3` now converts previously unhandled SQLite result codes into typed database errors instead of exposing raw driver errors. - The complete `SQLITE_BUSY` family is now mapped to socket timeout errors, with numeric extended result codes preserved where available. [#29794](prisma/orm#29794) ##### CLI and Migrate - `prisma generate` can now offer to install Prisma's agent skills. The opt-in prompt: - Is shown at most once per machine. - Is skipped in CI, containers, Git hooks, npm lifecycle scripts, and watch mode. - Is skipped when `--no-hints` is used or Prisma skills are already installed. - Times out after 30 seconds. - Never causes generation to fail if installation is unsuccessful. [#29690](prisma/orm#29690) - A globally installed CLI now warns during `prisma generate` when its version differs from the project's local `prisma` or `@prisma/client`, and recommends running the local CLI. The check is best-effort and does not fail generation. [#29593](prisma/orm#29593) - `prisma version` and `prisma version --json` now include the resolved Prisma CLI package path, making global-versus-local installation issues easier to diagnose. [#29573](prisma/orm#29573) - Empty or generator-only schema files now report `Schema must contain a datasource block` from `db pull`, `db push`, and `migrate dev`, rather than reaching the schema engine and potentially producing inconsistent errors. [#29657](prisma/orm#29657) - CLI commands now tolerate corrupt, unreadable, or unwritable command-state files. Invalid state is reinitialized, writes are atomic, and persistence failures fall back to in-memory state. [#29609](prisma/orm#29609) - Studio now recognizes semicolon-delimited `sqlserver://` connection strings before reporting the existing explicit message that SQL Server is not supported by Studio. [#29623](prisma/orm#29623) - The AI-agent safety checkpoint now also covers interactive `prisma db push` confirmations involving data-loss warnings, rather than only invocations using `--accept-data-loss`. [#29793](prisma/orm#29793) ##### Performance and reliability - Optimized query-plan execution by eagerly evaluating plans with one unconditional database operation and synchronously interpreting the remaining pure plan. Cached plans remain immutable. [#29004](prisma/orm#29004) - Prevented call-stack overflows when rendering very large parameter lists or combining chunked results containing hundreds of thousands of rows. [#29751](prisma/orm#29751) - Reduced ordinary query setup overhead by constructing fluent-relation field maps lazily and in linear time. Non-fluent queries no longer build this map. [#29752](prisma/orm#29752) ##### Dependencies - Updated the transitive `fast-uri` dependency to a patched release addressing production audit advisories affecting versions through `3.1.3`. [#29758](prisma/orm#29758) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.oirnoir.dev/OIRNOIR/YouTube-Helper-Server/pulls/41

coderabbitai Bot requested changes Jul 21, 2026

View reviewed changes

Comment thread packages/adapter-neon/src/__tests__/neon.test.ts

test(adapter-neon): add DateTime coverage for PrismaNeonHttpAdapter

370b355

Add a regression test for the DateTime-skew half of the mapArg fix, alongside the existing Bytes test.

coderabbitai Bot approved these changes Jul 21, 2026

View reviewed changes

aqrln approved these changes Jul 21, 2026

View reviewed changes

dosubot Bot added the lgtm This PR has been approved by a maintainer label Jul 21, 2026

aqrln merged commit 272078a into prisma:main Jul 22, 2026
253 of 254 checks passed

Navigation Menu

Uh oh!

fix(adapter-neon): map args through mapArg in PrismaNeonHttpAdapter - #29747

fix(adapter-neon): map args through mapArg in PrismaNeonHttpAdapter#29747
aqrln merged 2 commits into
prisma:mainfrom
santichausis:fix/adapter-neon-http-maparg

santichausis commented Jul 21, 2026

Uh oh!

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

santichausis commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

santichausis commented Jul 21, 2026

Description

Test plan

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

santichausis commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading