Catalog / Prisma

7.10.1

todaysecurityaddedfixedOriginal notes

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

  • if the old transaction had committed, the new one failed with P2028;
  • if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.
const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 }

await prisma.$transaction(async (tx) => {
  await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS)
})

// Before 7.10.1, this call could fail with P2028 or join another transaction.
await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)

Prisma Client no longer modifies the options object. (https://github.com/prisma/orm/pull/30368, thanks @lazerg)

Prisma Migrate: refuse a shadow database that is the main database

Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (https://github.com/prisma/prisma-engines/pull/5851)

MariaDB adapter: updated to mariadb 3.5.4

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (https://github.com/prisma/orm/pull/30668)

Dependency updates

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (https://github.com/prisma/orm/pull/30314, https://github.com/prisma/orm/pull/30189, https://github.com/prisma/orm/pull/30668)