Skip to content

chore(deps): bump the prod-minor-patch group across 1 directory with 18 updates - #566

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/server/prod-minor-patch-746e31a3f9
Open

chore(deps): bump the prod-minor-patch group across 1 directory with 18 updates#566
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/server/prod-minor-patch-746e31a3f9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the prod-minor-patch group with 18 updates in the /apps/server directory:

Package From To
@aws-sdk/client-s3 3.1096.0 3.1133.0
@hono/node-server 2.0.12 2.1.1
@hono/zod-openapi 1.5.1 1.6.3
@pothos/core 4.13.1 4.15.1
@pothos/plugin-prisma 4.15.0 4.17.0
@prisma/adapter-mariadb 7.9.1 7.10.0
@prisma/client 7.9.1 7.10.0
@scalar/hono-api-reference 0.11.11 0.12.2
@xmldom/xmldom 0.9.10 0.9.12
graphql-ws 6.2.0 6.2.2
graphql-yoga 5.21.2 5.24.0
hono 4.12.32 4.13.8
hono-rate-limiter 0.5.3 0.5.4
resend 6.18.1 6.28.1
rotating-file-stream 3.2.9 3.2.10
sharp 0.35.3 0.35.4
ws 8.21.1 8.21.3
xmllint-wasm 5.2.0 5.3.0

Updates @aws-sdk/client-s3 from 3.1096.0 to 3.1133.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1133.0

3.1133.0(2026-09-15)

Chores
New Features
  • client-direct-connect: AWS Direct Connect is introducing flat-rate pricing, a simplified billing model that gives you a fixed monthly price for dedicated connectivity with no per-gigabyte data transfer out charges within the selected pricing tier. (b9956a5a)
  • client-bedrock-agentcore-control: Amazon Bedrock AgentCore Runtime now supports specifying the platform version of an agent runtime through the new platformVersion field on CreateAgentRuntime, UpdateAgentRuntime, and GetAgentRuntime. (d3a50d22)
  • client-workspaces: Added support for 4 new graphics-optimized compute types - Graphics.g7 (2xlarge, 4xlarge, 8xlarge, 12xlarge). (271c68d3)
  • client-transfer: AWS Transfer Family now preserves the original source IP address using Proxy Protocol v2 when you place a Network Load Balancer in front of your server for SFTP connections. (b1d62fea)

For list of updated packages, view updated-packages.md in assets-3.1133.0.zip

v3.1132.0

3.1132.0(2026-09-14)

New Features
  • clients: update client endpoints as of 2026-09-14 (8ab948b9)
  • client-codedeploy: AWS CodeDeploy now returns the deployment mode on GetDeployment and BatchGetDeployments. The new deploymentMode field on DeploymentInfo indicates whether a deployment used the standard deployment process or restarted the application using a previously installed revision (RESTART mode). (05f1a7a2)
  • client-sts: Increases the maximum session token size to 4,096 bytes and removes the packed policy size limit. Adds SessionTokenSize and SessionTokenUtilization fields and a new MinimumSessionTokenSize parameter. PackedPolicySize is deprecated. (906e0db8)
  • client-imagebuilder: This release adds a dryRun option to Image Builder create APIs (except CreateImage), structured failure context on failed images including component and distribution failure details, and step retry attempt tracking. (7ee2144d)
  • client-glue: Amazon Glue releasing the new API ListIntegrationTableProperties and adding IntegrationArn to TargetTableConfig (ab0dc23e)
  • client-billing: Increased the maximum number of services returned in the supportEligibleSpendByService field of ListEnterpriseSupportLinkedAccountCharges (eb2a3871)
  • client-billingconductor: This release adds support for custom volume tiering. You can now define custom tiers on a pricing rule's tiering configuration, where each tier specifies a usage range and the rate applied to usage in that range. (7d5844d5)
Tests
  • client-cloudwatch: update error tests for ValidationException (#8304) (51802645)

For list of updated packages, view updated-packages.md in assets-3.1132.0.zip

v3.1131.0

3.1131.0(2026-09-11)

Documentation Changes
  • client-s3: Updated S3 Object Lock Default Retention documentation. (996d6642)
New Features

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1133.0 (2026-09-15)

Note: Version bump only for package @​aws-sdk/client-s3

3.1132.0 (2026-09-14)

Note: Version bump only for package @​aws-sdk/client-s3

3.1131.0 (2026-09-11)

Note: Version bump only for package @​aws-sdk/client-s3

3.1130.0 (2026-09-10)

Note: Version bump only for package @​aws-sdk/client-s3

3.1129.0 (2026-09-09)

Note: Version bump only for package @​aws-sdk/client-s3

3.1128.0 (2026-09-08)

Features

  • client-s3: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (8b58987)

... (truncated)

Commits
  • 615a1ca Publish v3.1133.0
  • 99b4bd0 Publish v3.1132.0
  • 33f2cc7 Publish v3.1131.0
  • 996d664 docs(client-s3): Updated S3 Object Lock Default Retention documentation.
  • cd49ceb Publish v3.1130.0
  • cece980 Publish v3.1129.0
  • 523fff6 Publish v3.1128.0
  • 8b58987 feat(client-s3): Adds support for Amazon S3 Object Lock variable retention. ...
  • 8893344 Publish v3.1127.0
  • 7131e74 Publish v3.1126.0
  • Additional commits viewable in compare view

Updates @hono/node-server from 2.0.12 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

Commits

Updates @hono/zod-openapi from 1.5.1 to 1.6.3

Release notes

Sourced from @​hono/zod-openapi's releases.

@​hono/zod-openapi@​1.6.3

Patch Changes

@​hono/zod-openapi@​1.6.2

Patch Changes

@​hono/zod-openapi@​1.6.1

Patch Changes

@​hono/zod-openapi@​1.6.0

Minor Changes

@​hono/zod-openapi@​1.5.3

Patch Changes

@​hono/zod-openapi@​1.5.2

Patch Changes

  • #2069 fc0377c5595bde3147d181e5013a3fc710175e40 Thanks @​edenbuilds! - fix(zod-openapi): keep the z import edge so .openapi() survives bundling

    Re-exporting zod's z as a pass-through let esbuild code-splitting resolve import { z } from '@hono/zod-openapi' straight to zod and drop the edge to the module that runs extendZodWithOpenApi(z), so schemas could be built before the patch applied and .openapi() was undefined at runtime. Export z as an alias declaration instead: it compiles to a binding local to the module, which keeps that edge, while still carrying zod's type namespace so z.infer, z.ZodType and the rest continue to work. Fixes #2051.

Changelog

Sourced from @​hono/zod-openapi's changelog.

1.6.3

Patch Changes

1.6.2

Patch Changes

1.6.1

Patch Changes

1.6.0

Minor Changes

1.5.3

Patch Changes

1.5.2

Patch Changes

  • #2069 fc0377c5595bde3147d181e5013a3fc710175e40 Thanks @​edenbuilds! - fix(zod-openapi): keep the z import edge so .openapi() survives bundling

    Re-exporting zod's z as a pass-through let esbuild code-splitting resolve import { z } from '@hono/zod-openapi' straight to zod and drop the edge to the module that runs extendZodWithOpenApi(z), so schemas could be built before the patch applied and .openapi() was undefined at runtime. Export z as an alias declaration instead: it compiles to a binding local to the module, which keeps that edge, while still carrying zod's type namespace so z.infer, z.ZodType and the rest continue to work. Fixes #2051.

Commits
  • bc7d9e6 Version Packages (#2123)
  • 3b08600 fix(zod-openapi): return 415 for request bodies with undeclared content type ...
  • b125de5 Version Packages (#2121)
  • 28f1d39 fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler (#...
  • 525564d perf(zod-openapi): Flatten batched route schemas (#2115)
  • 38232db perf(zod-openapi): Reuse route response projections (#2116)
  • fdad95a Version Packages (#2101)
  • 4fce28c fix(zod-openapi): reduce route type instantiations (#1988)
  • eb5f75d Version Packages (#2088)
  • 1dc1a4a feat(zod-openapi): support the HTTP QUERY method (#2086)
  • Additional commits viewable in compare view

Updates @pothos/core from 4.13.1 to 4.15.1

Release notes

Sourced from @​pothos/core's releases.

@​pothos/core@​4.15.1

Patch Changes

  • d0a521b: Preserve lazy enum values supplied by plugin configuration hooks on GraphQL 17.

@​pothos/core@​4.15.0

Minor Changes

  • da938c5: - Compute recursive input mapping reachability to a fixed point so mapped fields reachable only through a cycle are no longer pruned
    • Correct the input and output types on the ref returned by scalarType, which were swapped relative to the scalar's Input/Output shapes
    • Normalize refs (and promises of refs) returned from an interface resolveType to type names, as the union path already did
    • Type the fourth argument of an interface resolveType callback as GraphQLInterfaceType instead of GraphQLUnionType
    • Honor the name option when implementing an interface ref
    • Keep heterogeneous TypeScript enum members whose string value happens to name a numeric member
    • Omit arguments removed by onInputFieldConfig from the config.args passed to resolver wrappers
    • Preserve specifiedByURL on imported scalars, and accept it as a scalarType option. This changes the printed schema and introspection: a scalar imported with addScalarType that carries a specification URL (many graphql-scalars exports do, such as EmailAddressResolver) now prints as scalar EmailAddress @specifiedBy(url: "…") and reports that URL through introspection, where both were previously absent. Expect SDL snapshot tests and schema-diff checks to register the addition.
    • Make the no-Buffer encodeBase64/decodeBase64 fallback UTF-8 safe, including preserving a leading BOM
    • Build separate field and argument configs for inherited interface fields. Plugin hooks and resolver wrappers receive the owning type in parentType and the original interface in the new declaringType property. Field kind and graphqlKind retain the declaring field builder's kind. Hooks now run for each declaration and owner pair. Plugins generating shared interface output types must use declaringType ?? parentType for type identity, while owner-specific policies should use parentType. Unwrapped default field resolvers remain unset in the GraphQL schema.
    • Keep default field registrations separate from local declarations. Local fields, including inherited interface fields and fields added after a schema build, take precedence without duplicate-field errors.

@​pothos/core@​4.14.0

Minor Changes

  • 0c7565a: Selections can be built by async callbacks. New AsyncSelections flag in the schema types, off by default.
    • AsyncSelections: true widens what the selection callbacks accept: a field's select function, a relation query callback, a relationCount / relatedCount where callback, and the select / query callbacks of prismaConnectionHelpers and drizzleConnectionHelpers may all return promises. Without the flag they are typed as synchronous and an async callback is a type error, which is what the prisma plugin needed: it accepted an async select and silently dropped the selection it resolved to.
    • The plugins still build one query. Callbacks start in the same tick, and what they return is merged after every synchronous selection, in document order. Async argument mappers (such as the validation plugin's) are awaited before the field's select runs. Synchronous selection planning remains synchronous and does not create promises solely to support async callbacks.
    • Inside an async select, await the result of nestedSelection before adding it to the selection. A select that returns while a nested selection it started is still pending throws, naming the field.
    • Everything the plugins generate settles its plan before your resolver runs, so a schema built only from t.relation, t.relationCount / t.relatedCount, t.prismaField / t.drizzleField, t.prismaConnection / t.drizzleConnection and t.relatedConnection can turn the flag on and change nothing else. The query() builder handed to a drizzleField or drizzleConnection resolver never returns a promise for the same reason.
    • The places where your own code asks for a query or a selection are the ones to audit:

... (truncated)

Changelog

Sourced from @​pothos/core's changelog.

4.15.1

Patch Changes

  • d0a521b: Preserve lazy enum values supplied by plugin configuration hooks on GraphQL 17.

4.15.0

Minor Changes

  • da938c5: - Compute recursive input mapping reachability to a fixed point so mapped fields reachable only through a cycle are no longer pruned
    • Correct the input and output types on the ref returned by scalarType, which were swapped relative to the scalar's Input/Output shapes
    • Normalize refs (and promises of refs) returned from an interface resolveType to type names, as the union path already did
    • Type the fourth argument of an interface resolveType callback as GraphQLInterfaceType instead of GraphQLUnionType
    • Honor the name option when implementing an interface ref
    • Keep heterogeneous TypeScript enum members whose string value happens to name a numeric member
    • Omit arguments removed by onInputFieldConfig from the config.args passed to resolver wrappers
    • Preserve specifiedByURL on imported scalars, and accept it as a scalarType option. This changes the printed schema and introspection: a scalar imported with addScalarType that carries a specification URL (many graphql-scalars exports do, such as EmailAddressResolver) now prints as scalar EmailAddress @specifiedBy(url: "…") and reports that URL through introspection, where both were previously absent. Expect SDL snapshot tests and schema-diff checks to register the addition.
    • Make the no-Buffer encodeBase64/decodeBase64 fallback UTF-8 safe, including preserving a leading BOM
    • Build separate field and argument configs for inherited interface fields. Plugin hooks and resolver wrappers receive the owning type in parentType and the original interface in the new declaringType property. Field kind and graphqlKind retain the declaring field builder's kind. Hooks now run for each declaration and owner pair. Plugins generating shared interface output types must use declaringType ?? parentType for type identity, while owner-specific policies should use parentType. Unwrapped default field resolvers remain unset in the GraphQL schema.
    • Keep default field registrations separate from local declarations. Local fields, including inherited interface fields and fields added after a schema build, take precedence without duplicate-field errors.

4.14.0

Minor Changes

  • 0c7565a: Selections can be built by async callbacks. New AsyncSelections flag in the schema types, off by default.
    • AsyncSelections: true widens what the selection callbacks accept: a field's select function, a relation query callback, a relationCount / relatedCount where callback, and the select / query callbacks of prismaConnectionHelpers and drizzleConnectionHelpers may all return promises. Without the flag they are typed as synchronous and an async callback is a type error, which is what the prisma plugin needed: it accepted an async select and silently dropped the selection it resolved to.
    • The plugins still build one query. Callbacks start in the same tick, and what they return is merged after every synchronous selection, in document order. Async argument mappers (such as the validation plugin's) are awaited before the field's select runs. Synchronous selection planning remains synchronous and does not create promises solely to support async callbacks.
    • Inside an async select, await the result of nestedSelection before adding it to the selection. A select that returns while a nested selection it started is still pending throws, naming the field.
    • Everything the plugins generate settles its plan before your resolver runs, so a schema built only from t.relation, t.relationCount / t.relatedCount, t.prismaField / t.drizzleField, t.prismaConnection / t.drizzleConnection and t.relatedConnection can

... (truncated)

Commits
  • 3ef70e5 chore: update versions
  • ef48774 Remove local dependency symlink from patch
  • d0a521b Fix lazy enum values from plugin configuration
  • aa27e83 chore: update versions
  • f22ec02 fix(add-graphql): register imported roots as field defaults
  • 3838591 fix(core): give inherited interface fields owner configs
  • 276de26 docs(core): name the SCC rule the mapping check relies on
  • 2a33203 refactor(core): simplify the recursive input mapping check
  • 663f2c2 style(core): remove added code comments
  • c6a6535 style(core): trim comments to external facts
  • Additional commits viewable in compare view

Updates @pothos/plugin-prisma from 4.15.0 to 4.17.0

Release notes

Sourced from @​pothos/plugin-prisma's releases.

@​pothos/plugin-prisma@​4.17.0

Minor Changes

  • 269b554: Await async prismaNode ID resolvers before passing their results to a custom findUnique. Custom findUnique callbacks can now return promises. A rejected lookup fails only its own row; synchronous lookup timing and batching are unchanged.

Patch Changes

  • 263e092: Keep Decimal node ids exact instead of rounding them through a float when parsing
  • 7f4e1b0: Fix relatedConnection fields with a custom resolve when the parent row was not preloaded:
    • Plan the fallback query from the connection's node type and cursor selections.
    • Await async node IDs and custom unique lookups before loading fallback counts.
    • Load totalCount only when selected and make it available to custom connection fields. A parent that does not exist now produces an error naming the field and model instead of a zero count.
    • Compute hasNextPage from the requested page size and remove the extra probe row.
    • Skip the custom row resolver for selections that request only totalCount.
    • @​pothos/selection-mapper@​0.1.0

@​pothos/plugin-prisma@​4.16.0

Minor Changes

  • 0c7565a: Selections can be built by async callbacks. New AsyncSelections flag in the schema types, off by default.
    • AsyncSelections: true widens what the selection callbacks accept: a field's select function, a relation query callback, a relationCount / relatedCount where callback, and the select / query callbacks of prismaConnectionHelpers and drizzleConnectionHelpers may all return promises. Without the flag they are typed as synchronous and an async callback is a type error, which is what the prisma plugin needed: it accepted an async select and silently dropped the selection it resolved to.
    • The plugins still build one query. Callbacks start in the same tick, and what they return is merged after every synchronous selection, in document order. Async argument mappers (such as the validation plugin's) are awaited before the field's select runs. Synchronous selection planning remains synchronous and does not create promises solely to support async callbacks.
    • Inside an async select, await the result of nestedSelection before adding it to the selection. A select that returns while a nested selection it started is still pending throws, naming the field.
    • Everything the plugins generate settles its plan before your resolver runs, so a schema built only from t.relation, t.relationCount / t.relatedCount, t.prismaField / t.drizzleField, t.prismaConnection / t.drizzleConnection and t.relatedConnection can turn the flag on and change nothing else. The query() builder handed to a drizzleField or drizzleConnection resolver never returns a promise for the same reason.
    • The places where your own code asks for a query or a selection are the ones to audit: queryFromInfo (prisma), a connection helper's getQuery (both plugins), nestedSelection, and mergeNestedSelection. queryFromInfo and getQuery build the query synchronously and take an awaitSelections option; pass awaitSelections: true to get a MaybePromise and await it. A call that did not ask for a promise throws, naming the option and what the call was building — queryFromInfo the field, getQuery the connection's model or table, which is as much as it is given — rather than returning one where the declared type said there was none: a promise spread into a prisma or drizzle call is one unusable key and no type error. Two things

... (truncated)

Changelog

Sourced from @​pothos/plugin-prisma's changelog.

4.17.0

Minor Changes

  • 269b554: Await async prismaNode ID resolvers before passing their results to a custom findUnique. Custom findUnique callbacks can now return promises. A rejected lookup fails only its own row; synchronous lookup timing and batching are unchanged.

Patch Changes

  • 263e092: Keep Decimal node ids exact instead of rounding them through a float when parsing
  • 7f4e1b0: Fix relatedConnection fields with a custom resolve when the parent row was not preloaded:
    • Plan the fallback query from the connection's node type and cursor selections.
    • Await async node IDs and custom unique lookups before loading fallback counts.
    • Load totalCount only when selected and make it available to custom connection fields. A parent that does not exist now produces an error naming the field and model instead of a zero count.
    • Compute hasNextPage from the requested page size and remove the extra probe row.
    • Skip the custom row resolver for selections that request only totalCount.
    • @​pothos/selection-mapper@​0.1.0

4.16.0

Minor Changes

  • 0c7565a: Selections can be built by async callbacks. New AsyncSelections flag in the schema types, off by default.
    • AsyncSelections: true widens what the selection callbacks accept: a field's select function, a relation query callback, a relationCount / relatedCount where callback, and the select / query callbacks of prismaConnectionHelpers and drizzleConnectionHelpers may all return promises. Without the flag they are typed as synchronous and an async callback is a type error, which is what the prisma plugin needed: it accepted an async select and silently dropped the selection it resolved to.
    • The plugins still build one query. Callbacks start in the same tick, and what they return is merged after every synchronous selection, in document order. Async argument mappers (such as the validation plugin's) are awaited before the field's select runs. Synchronous selection planning remains synchronous and does not create promises solely to support async callbacks.
    • Inside an async select, await the result of nestedSelection before adding it to the selection. A select that returns while a nested selection it started is still pending throws, naming the field.
    • Everything the plugins generate settles its plan before your resolver runs, so a schema built only from t.relation, t.relationCount / t.relatedCount, t.prismaField / t.drizzleField, t.prismaConnection / t.drizzleConnection and t.relatedConnection can turn the flag on and change nothing else. The query() builder handed to a drizzleField or drizzleConnection resolver never returns a promise for the same reason.
    • The places where your own code asks for a query or a selection are the ones to audit: queryFromInfo (prisma), a connection helper's getQuery (both plugins), nestedSelection, and mergeNestedSelection. queryFromInfo and getQuery build the query synchronously and take an awaitSelections option; pass awaitSelections: true to get a MaybePromise and await it. A call that did not ask for a promise throws, naming the option and what the call was building — queryFromInfo the field, getQuery the connection's model or table, which is

... (truncated)

Commits
  • aa27e83 chore: update versions
  • c857843 fix(prisma): resolve async parent lookups for fallback counts
  • 44038d8 Merge pull request #1770 from hayes/fix/prisma-related-connection-planning
  • 86214cb Merge pull request #1767 from hayes/fix/prisma-async-node-ids
  • 95db302 style(prisma): remove added code comments
  • 421fe5d style(prisma): remove added code comments
  • 31d9a10 style(prisma): remove added code comments
  • 24fcae8 style(prisma): drop review narration from comments
  • 7750c7d style(prisma): drop review narration from comments
  • 0e48267 style(prisma): drop review narration from comments
  • Additional commits viewable in compare view

Updates @prisma/adapter-mariadb from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/adapter-mariadb's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

  1. Root-level prisma7.config.* files.
  2. .config/prisma7.* files.
  3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits
  • 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
  • See full diff in compare view

Updates @prisma/client from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/client's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

  1. Root-level prisma7.config.* files.
  2. .config/prisma7.* files.
  3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits
  • 05c1b88 Teach Prisma 7 to prefer versioned config files (#30020)
  • cf2bc1f Rename prisma7 package to @​prisma/prisma7 (#30002)
  • ce5a34c Complete downstream actionable Prisma 7 guidance propagation (#29994)
  • 3f13ec6 Complete CLI-owned prisma7 distribution identity (#29969)
  • 179ba0c feat(prisma7): add side-by-side CLI wrapper (#29949)
  • 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
  • 6b6d9e9 chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...
  • b64e33c chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...
  • 2046f9b feat(client): expose ModelName to compute function in Result extensions (#29782)
  • f2b3abd chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...
  • Additional commits viewable in compare view

Updates @scalar/hono-api-reference from 0.11.11 to 0.12.2

Changelog

Sourced from @​scalar/hono-api-reference's changelog.

0.12.2

0.12.1

0.12.0

Minor Changes

  • #9976: Add Scalar.serve() to render the API reference and serve its OpenAPI document from a single mount. Instead of wiring a separate document route and keeping the reference's url in sync, mount it once with app.route('/scalar', Scalar.serve({ document })). document accepts an OpenAPI object or a function that returns one (for example () => app.getOpenAPI31Document(...) from Zod OpenAPI Hono), and the JSON path is configurable via documentPath.

0.11.16

Patch Changes

  • #9941: Republish every package through npm trusted publishing. No functional changes.

0.11.15

0.11.14

0.11.13

0.11.12

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​scalar/hono-api-reference since your current version.


Updates @xmldom/xmldom from 0.9.10 to 0.9.12

Release notes

Sourced from @​xmldom/xmldom's releases.

0.9.12

Commits

Fixed

  • Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
  • Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
  • Security: HTML raw-text parsing no longer amplifies output on a missing or case-mismatched closing tag; the closing tag is matched case-insensitively per the WHATWG HTML RAWTEXT end-tag rule and a missing closing tag is handled explicitly, preventing a denial-of-service. Output for well-formed input is unchanged. GHSA-6mj3-qw4j-hgrw
  • Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
  • Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
  • Security: the requireWellFormed serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, so a name containing a line terminator is rejected with InvalidStateError — closing a bypass of the XML QName check. GHSA-jxjr-3g7g-3944
  • Security: the requireWellFormed serializer's DocType publicId/systemId validators no longer treat an interior line terminator as satisfying the anchor, so an identifier containing an ECMAScript line terminator is rejected with InvalidStateError — closing a bypass of the XML PubidLiteral/SystemLiteral check. GHSA-vr34-hp96-76pp
  • Security: createElementNS(), createAttributeNS(), createDocumentType(), and createAttribute() now reject a name containing a line terminator with InvalidCharacterError, because name validation applies to the whole string — closing a creation-time bypass of the XML Name/QName production on the default serialization path.

@dependabot
chore(deps): bump the prod-minor-patch group across 1 directory with …
339200d 
…18 updates

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1133.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@hono/zod-openapi"
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@pothos/core"
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@pothos/plugin-prisma"
  dependency-version: 4.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@prisma/adapter-mariadb"
  dependency-version: 7.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@prisma/client"
  dependency-version: 7.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@scalar/hono-api-reference"
  dependency-version: 0.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.9.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: graphql-ws
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: graphql-yoga
  dependency-version: 5.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: hono
  dependency-version: 4.13.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: hono-rate-limiter
  dependency-version: 0.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: resend
  dependency-version: 6.28.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: rotating-file-stream
  dependency-version: 3.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: xmllint-wasm
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants