chore(deps): update dependency prisma to v7

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
prisma (source)	5.7.1 → 7.10.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	prisma@​7.10.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		High CVE: DeepmergeTS has stack exhaustion when merging recursive object graphs in npm deepmerge-ts CVE: GHSA-ggr8-5vv4-36mx DeepmergeTS has stack exhaustion when merging recursive object graphs (HIGH) Affected versions: < 8.0.0 Patched version: 8.0.0 From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/deepmerge-ts@7.1.5 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/deepmerge-ts@7.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm robust-predicates is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/robust-predicates@3.0.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/robust-predicates@3.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential security risk (AI signal): npm @electric-sql/pglite-socket is 68.0% likely risky Notes: This module functions as a high-power runtime launcher: it dynamically imports extensions based directly on user-provided CLI strings (including npm package specifiers) and can execute an arbitrary user-specified command when the server starts listening, optionally passing a constructed DATABASE_URL (with hardcoded postgres:postgres credentials) into the subprocess environment. No explicit exfiltration/backdoor/obfuscation is evident in the provided code, but the execution primitives create a serious security risk if CLI/config inputs or extension specifiers are not strictly trusted. Confidence: 0.68 Severity: 0.74 From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@electric-sql/pglite-socket@0.1.3 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@electric-sql/pglite-socket@0.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential security risk (AI signal): npm @electric-sql/pglite-socket is 74.0% likely risky Notes: This module is primarily a development/ops CLI wrapper, but it contains two high-impact execution primitives driven directly by user-controlled CLI inputs: (1) dynamic in-process module loading for extensions (code execution within the server runtime) and (2) arbitrary OS command execution via --run with inherited stdio. It also embeds fixed database credentials (postgres:postgres) and can pass them (via DATABASE_URL) into the spawned subprocess when enabled. No explicit stealth/persistence/data-exfiltration behavior is evident in this fragment, but the ability to execute attacker-influenced code/commands makes it security-sensitive and potentially dangerous if CLI arguments or extension selection can be influenced by an attacker. Confidence: 0.74 Severity: 0.74 From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@electric-sql/pglite-socket@0.1.3 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@electric-sql/pglite-socket@0.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential security risk (AI signal): npm @electric-sql/pglite-socket is 72.0% likely risky Notes: No clear evidence of covert malware, exfiltration, or backdoor installation in the provided snippet. However, the code enables high-impact actions driven by user input: dynamic in-process module loading for database extensions (including arbitrary package imports via package/path:exportName) and arbitrary subprocess execution via --run. It also hardcodes database credentials (postgres:postgres) and can leak them to logs and subprocess environment via --include-database-url. This makes the module security-sensitive and potentially dangerous if CLI arguments are attacker-influenced. Confidence: 0.72 Severity: 0.70 From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@electric-sql/pglite-socket@0.1.3 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@electric-sql/pglite-socket@0.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential security risk (AI signal): npm @electric-sql/pglite is 63.0% likely risky Notes: No direct, explicit malware (e.g., hardcoded credentials, obvious exfiltration routines) is visible in this fragment. However, it is high-risk from a supply-chain perspective: it downloads and unpacks executable/native extension artifacts into a filesystem, instantiates wasm binaries, and uses eval() to execute JavaScript glue extracted from wasm/custom-section contents. If remote artifacts are tampered with or URLs/config are attacker-influenced, this can enable host-context code execution and persistent compromise via IDBFS. Confidence: 0.63 Severity: 0.77 From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@electric-sql/pglite@0.4.3 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@electric-sql/pglite@0.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential security risk (AI signal): npm @electric-sql/pglite is 62.0% likely risky Notes: No clear evidence of overt malware such as exfiltration, backdoors, or process spawning is visible in this fragment. However, the code contains a high-risk pattern: it executes eval() on JavaScript strings extracted from the wasm module (__start_em_asm and __em_js__). Combined with dynamic wasm fetching/instantiation without visible integrity controls, this creates a plausible supply-chain / untrusted-module execution risk. This warrants strict wasm trust/allowlisting and integrity verification. Confidence: 0.62 Severity: 0.74 From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@electric-sql/pglite@0.4.3 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@electric-sql/pglite@0.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential security risk (AI signal): npm @electric-sql/pglite is 68.0% likely risky Notes: The snippet appears to be an Emscripten-style WASM runtime/loader. The highest concern is deliberate dynamic code execution: it extracts JS source text from the WASM module’s memory (via __start_em_asm / em_js patterns) and executes it with eval(). If an attacker can influence the WASM payload (or the injected emscripten JS strings), this becomes host-level arbitrary JS execution. Additionally, the loader supports dynamic/remote WASM fetching and instantiation, increasing supply-chain risk if URLs/paths are not strictly controlled. UUID generation includes a Math.random fallback when crypto is unavailable, which is weaker but not inherently malicious. Confidence: 0.68 Severity: 0.72 From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@electric-sql/pglite@0.4.3 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@electric-sql/pglite@0.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm @prisma/dev in module child_process Module: child_process Location: Package overview From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@prisma/dev@0.24.17 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@prisma/dev@0.24.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm @prisma/fetch-engine in module node:child_process Module: node:child_process Location: Package overview From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@prisma/fetch-engine@7.10.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@prisma/fetch-engine@7.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm @prisma/get-platform in module node:child_process Module: node:child_process Location: Package overview From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@prisma/get-platform@7.10.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@prisma/get-platform@7.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm @prisma/get-platform in module child_process Module: child_process Location: Package overview From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@prisma/get-platform@7.10.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@prisma/get-platform@7.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm @prisma/get-platform in module node:child_process Module: node:child_process Location: Package overview From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@prisma/get-platform@7.2.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@prisma/get-platform@7.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm @prisma/get-platform in module child_process Module: child_process Location: Package overview From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/@prisma/get-platform@7.2.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@prisma/get-platform@7.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm foreground-child in module child_process Module: child_process Location: Package overview From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/foreground-child@3.3.1 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/foreground-child@3.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential security risk (AI signal): npm prisma is 66.0% likely risky Notes: This module is primarily a Prisma Client/typed-artifact generator, but it also includes security-relevant auxiliary behavior: (1) outbound telemetry/survey network communication to third-party endpoints using embedded identifiers (privacy/exfiltration risk), and (2) an optional interactive “agent skills” installation feature that executes external package-manager commands to download/install additional packages (supply-chain expansion risk). File generation/cleanup behavior is consistent with codegen, but the co-located telemetry and install-by-command capabilities materially increase overall risk versus a standard generator. No direct evidence of covert malware (e.g., reverse shell) is visible in the provided fragment, but the supply-chain boundary is clearly expanded. Confidence: 0.66 Severity: 0.82 From: package.json → npm/prisma@7.10.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/prisma@7.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential security risk (AI signal): npm react-dom is 62.0% likely risky Notes: This module is a minimal CommonJS wrapper that unconditionally loads and exports a local native addon binary (./static.node). The JavaScript wrapper itself is benign-looking and contains no direct malicious logic, but it creates a significant supply-chain risk because all potentially sensitive behavior is implemented inside an opaque compiled addon. Inspect static.node (and its build/signing provenance) for network/FS/process actions, persistence behavior, hardcoded endpoints/credentials, and any unexpected runtime activity. Confidence: 0.62 Severity: 0.70 From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/react-dom@19.2.8 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-dom@19.2.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm d3-interpolate was last published 5 years ago Last Publish: 6/5/2021, 6:38:34 PM From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/d3-interpolate@3.0.1 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/d3-interpolate@3.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm generate-function was last published 8 years ago Last Publish: 8/31/2018, 2:46:21 PM From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/generate-function@2.3.1 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/generate-function@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm is-property was last published 12 years ago Last Publish: 12/25/2014, 2:50:43 PM From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/is-property@1.0.2 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/is-property@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm proper-lockfile was last published 6 years ago Last Publish: 1/25/2021, 6:55:18 PM From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/proper-lockfile@4.1.2 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/proper-lockfile@4.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm retry was last published 5 years ago Last Publish: 6/21/2021, 7:45:32 AM From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/retry@0.12.0 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/retry@0.12.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm safe-regex2 is now published by climba03003 instead of fdawgs New Author: climba03003 Previous Author: fdawgs From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/safe-regex2@5.1.1 ℹ Read more on: This package | This alert | What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/safe-regex2@5.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm safer-buffer was last published 8 years ago Last Publish: 4/8/2018, 10:42:42 AM From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/safer-buffer@2.1.2 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/safer-buffer@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 1 more row in the dashboard

View full report

[datadog-buape-studios]

⚠️ Warnings

⚠️ Your PR has warnings. Please review the issues below.

🚦 1 Pipeline job failed

Build | Docker Image — 🔧 Needs a code fix, caused by this PR

View in Datadog · View in GitHub Actions

Prisma schema validation error: The datasource property url is no longer supported in schema files at prisma/schema.prisma:7.

📋 Copy fix prompt

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/main HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: renovate/prisma-7.x

Build | Docker Image
Commit: 86ddaade9ae11aa0809b885aabb7926a73045ad7
Error (code / build):
Prisma schema validation error: The datasource property `url` is no longer supported in schema files at prisma/schema.prisma:7.
CI job: https://github.com/buape/Tags/actions/runs/33251246669/job/99097178254

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 86ddaad | Docs | View more details | Give us feedback!}