fix(deps): patch fast-uri production audit advisories - #29758
Merged
Conversation
`pnpm audit --prod` flagged two advisories in a shipped dependency path, both in fast-uri via packages/cli > @prisma/dev > @prisma/streams-local > ajv: - GHSA-4c8g-83qw-93j6 (host confusion via failed IDN canonicalization), patched >=3.1.3 - GHSA-v2hh-gcrm-f6hx (host confusion via literal backslash authority delimiter), patched >=3.1.4 Raise the existing fast-uri override from '>=3.1.2' to '>=3.1.4 <4' so it resolves to 3.1.4; the upper bound keeps the resolution within the ^3.x range ajv declares. `pnpm audit --prod` is now clean. The lockfile also picks up incidental re-resolution churn (peer-suffix normalization, libc metadata, small transitive patch bumps) that pnpm 11 produces whenever overrides change. Dev-tooling-only advisories (vitest, wrangler, jest transitive deps, etc.) are intentionally left untouched — they are not part of any published package's runtime dependency tree, and CI gates on `pnpm audit --prod`. Signed-off-by: Alexey Orlenko's AI Agent <robot@aqrln.net>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Summary by CodeRabbit
WalkthroughUpdated the pnpm workspace override for 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
aqrln
approved these changes
Jul 22, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
size-limit report 📦
|
Merging this PR will improve performance by 22.56%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ⚡ | getBinaryTargetForCurrentPlatform |
2.1 ms | 1.7 ms | +22.56% |
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix/pnpm-audit (ba76d4b) with main (3005a01)
Footnotes
-
30 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
aqrln
pushed a commit
that referenced
this pull request
Jul 27, 2026
## Overview Backport of #29758 to the `7.9.x` release branch. `pnpm audit --prod` (the audit CI gates on in `test-template.yml`) flags two advisories on `7.9.x`, both in `fast-uri` via the shipped dependency path `packages/cli > @prisma/dev > @prisma/streams-local > ajv`: - [GHSA-4c8g-83qw-93j6](GHSA-4c8g-83qw-93j6) — host confusion via failed IDN canonicalization (patched `>=3.1.3`) - [GHSA-v2hh-gcrm-f6hx](GHSA-v2hh-gcrm-f6hx) — host confusion via literal backslash authority delimiter (patched `>=3.1.4`) The branch still carries `fast-uri@<=3.1.1: '>=3.1.2'`, which resolves to a version inside both advisories' vulnerable ranges. ## Changes Raises the existing override in `pnpm-workspace.yaml` from `fast-uri@<=3.1.1: '>=3.1.2'` to `fast-uri@<=3.1.3: '>=3.1.4 <4'`, resolving `fast-uri` to 3.1.4. The upper bound keeps the resolution within the `^3.x` range `ajv` declares — without it, pnpm resolves to `fast-uri@4.x`, a major `ajv` is not tested against. The override line is byte-identical to the one already on `main`. Unlike #29758, the lockfile picks up no incidental re-resolution churn here — the diff is 12 lines, confined to `fast-uri` moving 3.1.2 → 3.1.4 at each call site — because `7.9.x`'s lockfile was regenerated recently by #29795. ## Out of scope Dev-tooling-only advisories reported by the full `pnpm audit` are intentionally left untouched, consistent with #29758 and prior audit fixes — they are not part of any published package's runtime dependency tree. ## Verification - `pnpm audit --prod` → `No known vulnerabilities found` (exit 0). This is the exact command CI gates on. - `CI=true pnpm install --frozen-lockfile --lockfile-only` passes — no lockfile drift. - `fast-uri` resolves to a single version, `3.1.4`, at every site in the lockfile. Note: `pnpm build` was **not** run locally — the machine ran out of disk during `pnpm install`, so no `node_modules` tree could be materialised. `fast-uri` is a runtime transitive dependency of the published CLI rather than a build input, and this change touches no source, so `pnpm audit --prod` is the relevant gate; CI will exercise the build regardless.
lh0x00
pushed a commit
to lh0x00/prisma
that referenced
this pull request
Aug 9, 2026
## Overview `pnpm audit --prod` (the audit CI gates on in `test-template.yml`) flags two advisories, both in `fast-uri` via the shipped dependency path `packages/cli > @prisma/dev > @prisma/streams-local > ajv`: - [GHSA-4c8g-83qw-93j6](GHSA-4c8g-83qw-93j6) — host confusion via failed IDN canonicalization (patched `>=3.1.3`) - [GHSA-v2hh-gcrm-f6hx](GHSA-v2hh-gcrm-f6hx) — host confusion via literal backslash authority delimiter (patched `>=3.1.4`) ## Changes Raises the existing override in `pnpm-workspace.yaml` from `fast-uri@<=3.1.1: '>=3.1.2'` to `fast-uri@<=3.1.3: '>=3.1.4 <4'`, resolving `fast-uri` to 3.1.4. The upper bound keeps the resolution within the `^3.x` range `ajv` declares — without it, pnpm resolves to `fast-uri@4.x`, a major `ajv` is not tested against. The lockfile also picks up incidental re-resolution churn (peer-suffix normalization, `libc` metadata, small transitive patch bumps). This is what pnpm 11 produces whenever overrides change; a plain `pnpm install` on an untouched checkout leaves the lockfile alone, so the churn is unavoidable when touching overrides. ## Out of scope Dev-tooling-only advisories reported by the full `pnpm audit` (vitest, wrangler, jest transitive deps, etc.) are intentionally left untouched, consistent with prior audit fixes — they are not part of any published package's runtime dependency tree. ## Verification - `pnpm audit --prod` → `No known vulnerabilities found` - `CI=true pnpm install --frozen-lockfile` passes Signed-off-by: Alexey Orlenko's AI Agent <robot@aqrln.net>
OIRNOIR
pushed a commit
to OIRNOIR/YouTube-Helper-Server
that referenced
this pull request
Sep 1, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@prisma/adapter-pg](https://github.com/prisma/prisma) ([source](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg)) | imports | minor | [`7.9.1` -> `7.10.0`](https://renovatebot.com/diffs/npm/@prisma%2fadapter-pg/7.9.1/7.10.0) | | [@prisma/client](https://www.prisma.io) ([source](https://github.com/prisma/prisma/tree/HEAD/packages/client)) | imports | minor | [`7.9.1` -> `7.10.0`](https://renovatebot.com/diffs/npm/@prisma%2fclient/7.9.1/7.10.0) | --- ### Release Notes <details> <summary>prisma/prisma (@​prisma/adapter-pg)</summary> ### [`v7.10.0`](https://github.com/prisma/orm/releases/tag/7.10.0) [Compare Source](prisma/orm@7.9.1...7.10.0) ##### Prisma ORM 7.10.0 Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters. ##### Highlights ##### Run Prisma 7 alongside Prisma 8 This release introduces `@prisma/prisma7`, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project. Once 7.10.0 is released, a side-by-side installation can use: ```sh npm install --save-dev prisma@8 @prisma/prisma7@7.10.0 npm install @prisma/client@7.10.0 ``` Use `prisma` for the directly installed Prisma 8 CLI and `prisma7` for Prisma 7: ```sh npx prisma --version npx prisma7 --version npx prisma7 generate npx prisma7 migrate dev npx prisma7 db push ``` Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's `prisma.config.*` files: ```ts // prisma7.config.ts import { defineConfig } from '@prisma/prisma7/config' export default defineConfig({ schema: 'prisma/schema.prisma', migrations: { path: 'prisma/migrations', }, }) ``` Without an explicit `--config` option, Prisma 7 searches for: 1. Root-level `prisma7.config.*` files. 2. `.config/prisma7.*` files. 3. Existing `prisma.config.*` files as a backwards-compatible fallback. The supported extensions are `.js`, `.ts`, `.mjs`, `.cjs`, `.mts`, and `.cts`. An explicit config path always takes precedence: ```sh npx prisma7 generate --config ./custom/prisma7.config.ts ``` New projects initialized by the Prisma 7 CLI use `prisma7.config.ts`. Existing projects containing only `prisma.config.*` continue to work without migration or additional warnings. If a `prisma7.config.*` file exists but cannot be loaded, Prisma reports the error rather than silently falling back to another configuration. The `prisma7` identity is carried through CLI help, version output, shell completion, initialization, migration, database, and generation guidance. Stable Prisma concepts such as `schema.prisma`, Prisma Migrate, `@prisma/client`, and `PRISMA_*` environment variables remain unchanged. Together, the separate executable and configuration namespace make it possible to operate Prisma 7 and Prisma 8 side by side without command or config-file collisions. [#​29949](prisma/orm#29949), [#​29969](prisma/orm#29969), [#​29994](prisma/orm#29994), [#​30000](prisma/orm#30000), [#​30002](prisma/orm#30002), [#​30020](prisma/orm#30020) ##### Prisma Studio security hardening Prisma Studio's local HTTP server now: - Binds explicitly to `127.0.0.1` instead of all network interfaces. - Rejects browser requests from origins other than the active `localhost` or `127.0.0.1` Studio URL. - No longer returns wildcard CORS headers. - Applies the same protections across Node.js, Bun, and Deno. This prevents network clients or malicious websites from accessing Studio's database endpoints while Studio is running. [#​29890](prisma/orm#29890) ##### Prisma Client - Fixed `P2002` errors from nested writes so `meta.modelName` identifies the model where the unique constraint violation occurred, including models using `@@map` and `@@schema`. [#​29628](prisma/orm#29628) - Fixed automatically batched `findUniqueOrThrow()` calls so every missing record rejects with `P2025`; later misses no longer resolve to `undefined`. [#​29654](prisma/orm#29654) - Parameter-chunked statements are now executed atomically in a transaction and rolled back if a later chunk fails. [#​29771](prisma/orm#29771) - Improved interactive transaction cleanup during `$disconnect()`, including transactions whose driver-level startup is still in progress. [#​28768](prisma/orm#28768) - Prevented transaction cleanup failures after a timeout or backend termination from becoming unhandled promise rejections. [#​29611](prisma/orm#29611) - Fixed fluent relation queries when relation fields are literally named `select` or `include`. [#​29683](prisma/orm#29683) - Fixed handling of `Date` and `Uint8Array` values created in other JavaScript realms, such as iframes, jsdom, and Node.js `vm` contexts. [#​29177](prisma/orm#29177) - Invalid `Date` values passed to `$queryRaw` or `$executeRaw` now throw `PrismaClientValidationError` instead of a generic error. [#​29718](prisma/orm#29718) - Fixed `moduleFormat` inference for the `prisma-client` generator in TypeScript projects using `module: "node16"` or `"nodenext"`. Generated output now follows the nearest `package.json` `type`, defaulting to CommonJS when absent. [#​29712](prisma/orm#29712) - Deserialized `Bytes` values now own standalone `ArrayBuffer`s rather than exposing unrelated contents from Node.js's shared `Buffer` pool. This applies to both regular and raw query results. [#​29701](prisma/orm#29701) - Fixed an incorrect logging context in the remote executor, including Accelerate-backed query execution. [#​28892](prisma/orm#28892) ##### Client extensions and observability - Result-extension `compute` callbacks now receive the current model name as a typed second argument: ```ts compute(data, modelName) { // ... } ``` The model name is also preserved when multiple extensions compose the same computed field. [#​29782](prisma/orm#29782) - Improved OpenTelemetry context for remotely executed queries: - `$on('query')` callbacks run within the matching `db_query` span. - Events from one operation share the same trace. - Error events are recorded as span exceptions. - Log events continue to be emitted when tracing is disabled or their reported span is unavailable. [#​28892](prisma/orm#28892) ##### Driver adapters ##### MariaDB - `@prisma/adapter-mariadb` now accepts an existing `mariadb` pool. External pools remain caller-owned unless `disposeExternalPool: true` is supplied. [#​27992](prisma/orm#27992) - Fixed pooled connection leaks during commit, rollback, and failed transaction startup. Connections are now returned with `release()` and transaction-specific listeners are removed before reuse. [#​29612](prisma/orm#29612) - Added support for bracketed IPv6 addresses in both `mysql://` and `mariadb://` connection strings. [#​29026](prisma/orm#29026) - Prevented malformed connection strings from exposing embedded passwords in retained debug output and diagnostic reports. [#​27992](prisma/orm#27992) ##### PostgreSQL, Neon, and Prisma Postgres Serverless - PostgreSQL deadlocks using SQLSTATE `40P01` are now reported as `P2034` transaction write conflicts. [#​29717](prisma/orm#29717) - PostgreSQL `RESTRICT` violations using SQLSTATE `23001` are now reported as `P2003`, preserving an available field or constraint name. [#​29554](prisma/orm#29554) - `@prisma/adapter-pg` now preserves database constraint names when reporting unique constraint violations through `P2002`. [#​29587](prisma/orm#29587) - Prisma Postgres Serverless now prefers the named constraint for `P2002`, falling back to parsed field names when no constraint name is available. [#​29801](prisma/orm#29801) - Fixed Neon HTTP adapter serialization for typed parameters such as `Bytes` and `DateTime`. [#​29747](prisma/orm#29747) ##### SQLite - `@prisma/adapter-better-sqlite3` now converts previously unhandled SQLite result codes into typed database errors instead of exposing raw driver errors. - The complete `SQLITE_BUSY` family is now mapped to socket timeout errors, with numeric extended result codes preserved where available. [#​29794](prisma/orm#29794) ##### CLI and Migrate - `prisma generate` can now offer to install Prisma's agent skills. The opt-in prompt: - Is shown at most once per machine. - Is skipped in CI, containers, Git hooks, npm lifecycle scripts, and watch mode. - Is skipped when `--no-hints` is used or Prisma skills are already installed. - Times out after 30 seconds. - Never causes generation to fail if installation is unsuccessful. [#​29690](prisma/orm#29690) - A globally installed CLI now warns during `prisma generate` when its version differs from the project's local `prisma` or `@prisma/client`, and recommends running the local CLI. The check is best-effort and does not fail generation. [#​29593](prisma/orm#29593) - `prisma version` and `prisma version --json` now include the resolved Prisma CLI package path, making global-versus-local installation issues easier to diagnose. [#​29573](prisma/orm#29573) - Empty or generator-only schema files now report `Schema must contain a datasource block` from `db pull`, `db push`, and `migrate dev`, rather than reaching the schema engine and potentially producing inconsistent errors. [#​29657](prisma/orm#29657) - CLI commands now tolerate corrupt, unreadable, or unwritable command-state files. Invalid state is reinitialized, writes are atomic, and persistence failures fall back to in-memory state. [#​29609](prisma/orm#29609) - Studio now recognizes semicolon-delimited `sqlserver://` connection strings before reporting the existing explicit message that SQL Server is not supported by Studio. [#​29623](prisma/orm#29623) - The AI-agent safety checkpoint now also covers interactive `prisma db push` confirmations involving data-loss warnings, rather than only invocations using `--accept-data-loss`. [#​29793](prisma/orm#29793) ##### Performance and reliability - Optimized query-plan execution by eagerly evaluating plans with one unconditional database operation and synchronously interpreting the remaining pure plan. Cached plans remain immutable. [#​29004](prisma/orm#29004) - Prevented call-stack overflows when rendering very large parameter lists or combining chunked results containing hundreds of thousands of rows. [#​29751](prisma/orm#29751) - Reduced ordinary query setup overhead by constructing fluent-relation field maps lazily and in linear time. Non-fluent queries no longer build this map. [#​29752](prisma/orm#29752) ##### Dependencies - Updated the transitive `fast-uri` dependency to a patched release addressing production audit advisories affecting versions through `3.1.3`. [#​29758](prisma/orm#29758) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zMC4zIiwidXBkYXRlZEluVmVyIjoiNDQuMzAuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Reviewed-on: https://git.oirnoir.dev/OIRNOIR/YouTube-Helper-Server/pulls/41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
pnpm audit --prod(the audit CI gates on intest-template.yml) flags two advisories, both infast-urivia the shipped dependency pathpackages/cli > @prisma/dev > @prisma/streams-local > ajv:>=3.1.3)>=3.1.4)Changes
Raises the existing override in
pnpm-workspace.yamlfromfast-uri@<=3.1.1: '>=3.1.2'tofast-uri@<=3.1.3: '>=3.1.4 <4', resolvingfast-urito 3.1.4. The upper bound keeps the resolution within the^3.xrangeajvdeclares — without it, pnpm resolves tofast-uri@4.x, a majorajvis not tested against.The lockfile also picks up incidental re-resolution churn (peer-suffix normalization,
libcmetadata, small transitive patch bumps). This is what pnpm 11 produces whenever overrides change; a plainpnpm installon an untouched checkout leaves the lockfile alone, so the churn is unavoidable when touching overrides.Out of scope
Dev-tooling-only advisories reported by the full
pnpm audit(vitest, wrangler, jest transitive deps, etc.) are intentionally left untouched, consistent with prior audit fixes — they are not part of any published package's runtime dependency tree.Verification
pnpm audit --prod→No known vulnerabilities foundCI=true pnpm install --frozen-lockfilepasses