chore(dependency): update prisma monorepo to v7.10.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@prisma/adapter-better-sqlite3 (source)	7.8.0 → 7.10.0
@prisma/client (source)	7.8.0 → 7.10.0

---

Release Notes

prisma/prisma (@​prisma/adapter-better-sqlite3)

v7.10.0

Compare Source

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version

npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'

export default defineConfig({
  schema: 'prisma/schema.prisma',
  migrations: {
    path: 'prisma/migrations',
  },
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

npx prisma7 generate --config ./custom/prisma7.config.ts

New projects initialized by the Prisma 7 CLI use prisma7.config.ts. Existing projects containing only prisma.config.* continue to work without migration or additional warnings. If a prisma7.config.* file exists but cannot be loaded, Prisma reports the error rather than silently falling back to another configuration.

The prisma7 identity is carried through CLI help, version output, shell completion, initialization, migration, database, and generation guidance. Stable Prisma concepts such as schema.prisma, Prisma Migrate, @prisma/client, and PRISMA_* environment variables remain unchanged.

Together, the separate executable and configuration namespace make it possible to operate Prisma 7 and Prisma 8 side by side without command or config-file collisions.

#​29949, #​29969, #​29994, #​30000, #​30002, #​30020

Prisma Studio security hardening

Prisma Studio's local HTTP server now:

• Binds explicitly to 127.0.0.1 instead of all network interfaces.
• Rejects browser requests from origins other than the active localhost or 127.0.0.1 Studio URL.
• No longer returns wildcard CORS headers.
• Applies the same protections across Node.js, Bun, and Deno.

This prevents network clients or malicious websites from accessing Studio's database endpoints while Studio is running.

#​29890

Prisma Client

• Fixed P2002 errors from nested writes so meta.modelName identifies the model where the unique constraint violation occurred, including models using @@map and @@schema. #​29628
• Fixed automatically batched findUniqueOrThrow() calls so every missing record rejects with P2025; later misses no longer resolve to undefined. #​29654
• Parameter-chunked statements are now executed atomically in a transaction and rolled back if a later chunk fails. #​29771
• Improved interactive transaction cleanup during $disconnect(), including transactions whose driver-level startup is still in progress. #​28768
• Prevented transaction cleanup failures after a timeout or backend termination from becoming unhandled promise rejections. #​29611
• Fixed fluent relation queries when relation fields are literally named select or include. #​29683
• Fixed handling of Date and Uint8Array values created in other JavaScript realms, such as iframes, jsdom, and Node.js vm contexts. #​29177
• Invalid Date values passed to $queryRaw or $executeRaw now throw PrismaClientValidationError instead of a generic error. #​29718
• Fixed moduleFormat inference for the prisma-client generator in TypeScript projects using module: "node16" or "nodenext". Generated output now follows the nearest package.json type, defaulting to CommonJS when absent. #​29712
• Deserialized Bytes values now own standalone ArrayBuffers rather than exposing unrelated contents from Node.js's shared Buffer pool. This applies to both regular and raw query results. #​29701
• Fixed an incorrect logging context in the remote executor, including Accelerate-backed query execution. #​28892

Client extensions and observability

• Result-extension compute callbacks now receive the current model name as a typed second argument:

  compute(data, modelName) {
    // ...
  }

  The model name is also preserved when multiple extensions compose the same computed field. #​29782

• Improved OpenTelemetry context for remotely executed queries:

  • $on('query') callbacks run within the matching db_query span.
  • Events from one operation share the same trace.
  • Error events are recorded as span exceptions.
  • Log events continue to be emitted when tracing is disabled or their reported span is unavailable.

  #​28892

Driver adapters

MariaDB

• @prisma/adapter-mariadb now accepts an existing mariadb pool. External pools remain caller-owned unless disposeExternalPool: true is supplied. #​27992
• Fixed pooled connection leaks during commit, rollback, and failed transaction startup. Connections are now returned with release() and transaction-specific listeners are removed before reuse. #​29612
• Added support for bracketed IPv6 addresses in both mysql:// and mariadb:// connection strings. #​29026
• Prevented malformed connection strings from exposing embedded passwords in retained debug output and diagnostic reports. #​27992

PostgreSQL, Neon, and Prisma Postgres Serverless

• PostgreSQL deadlocks using SQLSTATE 40P01 are now reported as P2034 transaction write conflicts. #​29717
• PostgreSQL RESTRICT violations using SQLSTATE 23001 are now reported as P2003, preserving an available field or constraint name. #​29554
• @prisma/adapter-pg now preserves database constraint names when reporting unique constraint violations through P2002. #​29587
• Prisma Postgres Serverless now prefers the named constraint for P2002, falling back to parsed field names when no constraint name is available. #​29801
• Fixed Neon HTTP adapter serialization for typed parameters such as Bytes and DateTime. #​29747

SQLite

• @prisma/adapter-better-sqlite3 now converts previously unhandled SQLite result codes into typed database errors instead of exposing raw driver errors.
• The complete SQLITE_BUSY family is now mapped to socket timeout errors, with numeric extended result codes preserved where available.

#​29794

CLI and Migrate

• prisma generate can now offer to install Prisma's agent skills. The opt-in prompt:

  • Is shown at most once per machine.
  • Is skipped in CI, containers, Git hooks, npm lifecycle scripts, and watch mode.
  • Is skipped when --no-hints is used or Prisma skills are already installed.
  • Times out after 30 seconds.
  • Never causes generation to fail if installation is unsuccessful.

  #​29690

• A globally installed CLI now warns during prisma generate when its version differs from the project's local prisma or @prisma/client, and recommends running the local CLI. The check is best-effort and does not fail generation. #​29593

• prisma version and prisma version --json now include the resolved Prisma CLI package path, making global-versus-local installation issues easier to diagnose. #​29573

• Empty or generator-only schema files now report Schema must contain a datasource block from db pull, db push, and migrate dev, rather than reaching the schema engine and potentially producing inconsistent errors. #​29657

• CLI commands now tolerate corrupt, unreadable, or unwritable command-state files. Invalid state is reinitialized, writes are atomic, and persistence failures fall back to in-memory state. #​29609

• Studio now recognizes semicolon-delimited sqlserver:// connection strings before reporting the existing explicit message that SQL Server is not supported by Studio. #​29623

• The AI-agent safety checkpoint now also covers interactive prisma db push confirmations involving data-loss warnings, rather than only invocations using --accept-data-loss. #​29793

Performance and reliability

• Optimized query-plan execution by eagerly evaluating plans with one unconditional database operation and synchronously interpreting the remaining pure plan. Cached plans remain immutable. #​29004
• Prevented call-stack overflows when rendering very large parameter lists or combining chunked results containing hundreds of thousands of rows. #​29751
• Reduced ordinary query setup overhead by constructing fluent-relation field maps lazily and in linear time. Non-fluent queries no longer build this map. #​29752

Dependencies

• Updated the transitive fast-uri dependency to a patched release addressing production audit advisories affecting versions through 3.1.3. #​29758

v7.9.1

Compare Source

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes #​29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

v7.9.0

Compare Source

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab

# 2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):
echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh
echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash
tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish
tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#​28351) — thank you!

prisma.mp4

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#​29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

npx prisma@latest init

A safer default around destructive commands (#​29684, #​29691, #​29713)

Prisma's AI safety checkpoint refuses to run destructive commands when it detects that an AI agent is at the keyboard, unless the user has given explicit consent. In this release we:

• Broadened agent detection to cover today's landscape — Codex CLI (now on Linux as well as macOS), Qwen Code, GitHub Copilot CLI, OpenCode, Cline, Goose, Amp, Crush, Augment Code, Antigravity, Replit Agent, and Devin — plus generic AI_AGENT / AGENT conventions so future agents are caught without a code change.
• Extended the guard to db push --accept-data-loss, which previously bypassed the checkpoint even though it can drop data.
• Removed the migrate-reset tool from the prisma mcp server entirely — resetting a database drops it, and that is not an operation an agent should be handed as a first-class tool. An agent that needs a reset must run the CLI, where the checkpoint applies.

Bug Fixes

Many of the fixes below are community contributions — thank you to everyone who reported and fixed these!

Prisma Client

• Fixed a severe TypeScript performance regression introduced in Prisma 7: restoring the OmitOpts generic default lets tsc reuse cached type instantiations again, bringing type-checking on large schemas back from minutes to seconds (#​29592, from @​nfl1ryxditimo12).
• The XOR type helper now rejects primitive values such as data: 5, which were previously accepted at compile time even though the runtime rejected them (#​29735, from @​kyungseopk1m).
• $queryRaw and $executeRaw now fail fast with a clear validation error when passed an invalid Date, instead of silently serializing it as null and corrupting the value sent to the database (#​29697, from @​jibin7jose).
• The generated client is no longer corrupted by a /// documentation comment that contains a */ sequence; the comment terminator is now escaped when doc comments are emitted, in both the TypeScript and JavaScript generators (#​29736, from @​kyungseopk1m).
• Improved the runtime and TypeScript error messages shown when a driver adapter is missing from the PrismaClient constructor; both now include a copy-pasteable example and a link to the driver adapters docs (#​29624).
• Unmapped database errors from driver adapters now surface as a user-facing P2039 (PrismaClientKnownRequestError) carrying the original code and message, instead of an opaque failure, which keeps schema-drift-style problems debuggable (#​29512).
• The prisma-client-js generator no longer emits a stray undefined statement when generating from a schema that declares only enums or types and no models (#​29738, from @​kyungseopk1m).
• Fixed a connection leak when an interactive transaction times out (maxWait) while it is still starting: the discarded transaction now sends an explicit ROLLBACK before the connection is returned to the pool, instead of releasing it mid-transaction. Previously, on adapters like @prisma/adapter-pg and @prisma/adapter-neon, the next query to reuse that connection could fail with there is already a transaction in progress — or silently commit the leaked transaction's work (#​29727, from @​lazerg).

CLI

• prisma validate (and other schema-loading commands) no longer hangs forever on a multi-file schema whose directories contain a symlink cycle, and no longer reports the same file twice when a directory is reachable under two spellings (e.g. /tmp → /private/tmp on macOS) (#​29740, from @​kyungseopk1m).
• On Windows, engine binaries are now cached in a stable, user-level directory (%APPDATA%\Prisma) instead of a cwd-relative node_modules\.cache, which eliminated duplicate cache directories and the bloated Serverless/Docker bundles they caused (#​29730, from @​santichausis; closes #​22574, #​6670, #​11577).

Driver Adapters

• @​prisma/adapter-pg, @​prisma/adapter-neon, @​prisma/adapter-ppg: Reading a Bytes column no longer emits Node.js' DEP0005 deprecation warning, thanks to an upstream postgres-bytea bump (#​29538, from @​kolia-zamnius).
• @​prisma/adapter-ppg: ColumnNotFound (P2022) errors now parse both quoted and unquoted PostgreSQL column names, including identifiers containing spaces, matching the fix previously applied to adapter-pg (#​29737, from @​kyungseopk1m).
• @​prisma/adapter-mssql: Setting a Bytes? (@db.VarBinary) field to null no longer fails with an implicit-conversion error; the adapter now sends the parameter typed as VarBinary instead of letting SQL Server default it to nvarchar (#​29630, from @​AnupamKumar-1).

Schema Engine

• prisma migrate status now reports a rolled-back migration that still exists on disk as unapplied, instead of incorrectly treating the schema as up to date (prisma/prisma-engines#5817, from @​goutamadwant).
• Primary-key constraint renames are now rendered as separate ALTER TABLE statements on PostgreSQL, avoiding a database error when a single table has multiple changes in one migration (prisma/prisma-engines#4906, from @​eruditmorina).

Security

• Resolved the hono security advisories at their source: @prisma/dev was updated to a version that no longer depends on hono at all, so the CLI is no longer exposed to those advisories through that path. We also patched moderate-severity advisories in ajv and uuid across production dependencies (#​29514).
• Hardened the Prisma Platform credentials file (~/.config/prisma-platform/auth.json) and its directory to 0o600 / 0o700 so OAuth tokens are no longer world-readable, bringing Prisma in line with the GitHub, AWS, and Google Cloud CLIs (#​29568, from Jaeyoung Yun).
• Bumped the openssl crate in the schema engine binaries from 0.10.74 to 0.10.81 (prisma/prisma-engines#5815).

Prisma Studio

The bundled Prisma Studio moves from 0.27.3 to 0.33.0 (#​29720), gathering up everything shipped in the Studio releases in between.

Migrations view

Studio can now visualise your migration history. This view is powered by Prisma Next — the next major version of Prisma ORM, a full TypeScript rewrite (available now in Early Access) that keeps the schema-first workflow and model-first queries you know, but treats your schema as a versioned, inspectable contract instead of compiling it into a heavy generated client. Prisma Next records every migration and its contract snapshots in the database, and Studio reads them to draw the timeline and diff below. Databases managed with classic Prisma Migrate don't carry this ledger, so the view simply stays hidden there.

When the connected database has a Prisma Next migration ledger, a Migrations entry appears in the sidebar: a newest-first timeline of every applied migration with its name, apply time, operation count, and compact chips summarizing what changed (+2 models, ~2 models +3 fields, +1 model, …). Selecting a migration opens a visual, FigJam-style diff canvas — added, removed, and changed models as colour-coded cards (NEW / UPDATED / UNCHANGED) with per-field before → after details, enum cards, and relation edges — next to a SQL panel of the executed statements and a Prisma-schema line diff. Switching migrations morphs the canvas rather than rebuilding it.

Prisma Streams browser

Studio gains first-class support for Prisma Streams: a dedicated stream browser, live stream aggregations, stream diagnostics, routing-key browsing, and a WAL-history handoff straight from your tables, plus richer stream request observability with concise event-log and OpenTelemetry span summaries.

Working with SQL

• SQL execution, linting, and navigation are now schema-aware: unqualified identifiers resolve against the schema you've selected instead of always falling back to the adapter's default schema.
• SQL result visualizations are rendered with Studio-owned chart configuration, and there's an optional Queries view backed by query-insights snapshots.
• Added copy actions to the Query Details view.

Fixes

• Fixed editing PostgreSQL text-array cells when queries are compiled with inline values.
• Avoided cancelling and repeating introspection requests when Studio first mounts, removing duplicate startup work.

Thanks to our contributors

A heartfelt thank you to the community members whose contributions shaped this release:

@​AmirSa12, @​kyungseopk1m, @​nfl1ryxditimo12, @​jibin7jose, @​santichausis, @​kolia-zamnius, @​goutamadwant, @​eruditmorina, @​lazerg, @​AnupamKumar-1, @​Swapanrishi, @​anupamme, and @​oyi77.

Prisma Compute is now in public beta

"Push code, it runs." Prisma Compute — managed hosting for TypeScript apps that run right next to your database — is now available in public beta, and free to use while the beta lasts.

Compute deploys your app as a long-lived process on Bun, colocated with your Prisma Postgres database, so there are no cold starts, no request timeouts, and no separate hosting vendor to wire up. It's a fit for REST and GraphQL APIs, full-stack apps, streaming and gRPC, and the long-running, stateful AI agents that keep connections open and hold in-process caches — "self-hosting, without the painful parts".

• Push-to-deploy from the CLI or via GitHub integration. Every deployment is an immutable, versioned release with its own preview URL, and rolling back is simply promoting a previous version.
• Branch-based environments — each branch gets its own app and database, so you can preview a change before promoting it to production.
• Auto-wires with Prisma Postgres (or bring any database), with automatic health checks and self-recovery.
• Custom domains — point a single CNAME at Prisma and Compute provisions and renews the TLS certificate for you, with no manual certificate uploads or private-key handling.

With Prisma ORM for type-safe data access, Prisma Postgres for the managed database, and now Prisma Compute for hosting, the whole stack lives in one place. Read the full story in the Prisma Compute blog series.

Enterprise support

Thousands of teams use Prisma and many of them already tap into our Enterprise & Agency Support Program for hands-on help with everything from schema integrations and performance tuning to security and compliance.

With this program you also get priority issue triage and bug fixes, expert scalability advice, and custom training so that your Prisma-powered apps stay rock-solid at any scale. Learn more or join: https://prisma.io/enterprise.

---

Configuration

📅 Schedule: (in timezone Europe/Moscow)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.