Repository navigation
feat(deps): upgrade Prisma to 7.10.1 to clear the high-severity deepmerge-ts advisory - #151
Conversation
…erge-ts advisory `npm audit --omit=dev` reported a high-severity finding in the production dependency tree (prisma -> @prisma/config -> deepmerge-ts < 8, GHSA-ggr8-5vv4-36mx). The only remedy npm offers is a breaking Prisma upgrade, and there is no 6.x backport: every stable 6.x pins deepmerge-ts@7.1.5, and the `latest` tag is still a 8.0.0-rc prerelease. 7.10.1 is the lowest stable release that ships the patched @prisma/config. Prisma 7 removed the Rust query engine, so a driver adapter is now mandatory — `new PrismaClient()` throws without one. @prisma/adapter-pg + pg are added and src/db/prisma-client.ts builds the client with one, keeping a 5s connect timeout because node-postgres defaults to none. The CLI's datasource URL moved out of the schema into a new backend/prisma.config.ts, which also loads .env itself since v7 stopped doing that. The prisma-client-js generator is kept on purpose: the client still generates into node_modules/@prisma/client and this backend stays CommonJS, so none of the 14 existing import sites changed. Also adds a high-severity production-dependency audit gate to CI, a repeatable migration-drift check, and a hermetic BigInt round-trip test for PaymentIntent.amountStroops — the field the upgrade most risked, whose previous coverage (the testnet payment test) cannot run without platform secrets. Verified: migration drift empty, typecheck and build clean, 30 unit + 25 integration tests passing, and the audit gate confirmed to fail when a knowingly vulnerable package is added. The testnet payment test is the one check that could not be completed here — it needs PLATFORM_PAYER_SECRET, PLATFORM_RELEASER_SECRET and a funded payer identity. Closes DocForum#47 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
|
@Hikmaholadele Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
@Hikmaholadele fix CI |
|
CI is failing on this PR. Integration tests fail (16 of 131), all in Please push a fix and CI will re-run. Before pushing, run |
…ction client Since prisma@7 the interactive-transaction client exposes `$transaction`, identical to the root client's. `audit.record()` refused what it believed was the root client by checking `typeof tx.$transaction === 'function'`, so after the upgrade it refused every *legitimate* in-transaction call — aborting the audited change with it (16 integration-test failures across audit, booking and email-verification; all real product paths that book, verify or fund inside a transaction). The guard now recognises the root client by its lifecycle methods (`$connect`/`$disconnect`) — present on the root client, absent on the transaction client in both v6 and v7. The guarantee is unchanged and verified: passing the real root client still throws, an event still exists iff its change committed, and the DB-trigger append-only checks are untouched. A regression test pins the v7 transaction-client shape (has `$transaction`, no lifecycle methods) as accepted, and ADR 0006 records the behavioural consequence of the upgrade. Verified: tsc --noEmit clean; 81 unit + 131 integration tests pass; audit:prod gate passes; build passes. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
afeezorobsco-cyber
left a comment
afeezorobsco-cyber
left a comment
There was a problem hiding this comment.
Reviewed: the Prisma 7 driver adapter keeps v6 behaviour (5s connect timeout, TLS left to the URL), CLI config moved to prisma.config.ts, the migration-drift script is a good addition, and the audit gate fails on any high/critical advisory except the documented, upstream-owned axios chain. LGTM.
Deploy note: watch the first Render deploy for P1010 (the v7 TLS certificate-validation change called out in ADR 0006).
…ng-and-facility-location Brings in upstream DocForum#151 (Prisma 7.10.1 + driver adapter), DocForum#155 (patient data export), DocForum#150 (field-level encryption), DocForum#147 (access-control tests). Conflicts resolved in backend/src/app.ts (kept /facilities and /pharmacy-orders mounts alongside /patients) and docs/api/README.md (kept the new Facilities/Pharmacy-orders tables; facilities and pharmacy-orders come out of the "no routes yet" list since this branch gives them routes). 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
3 participants
What this does
Clears the high-severity production-dependency advisory tracked in #47, and adds a CI gate so it cannot regress.
npm audit --omit=devreportedprisma -> @prisma/config -> deepmerge-ts < 8.0.0(GHSA-ggr8-5vv4-36mx).npm audit fix --forceoffers exactly one remedy and flags it breaking:prisma@7.10.1.Why 7.10.1 and not a 6.x patch: there is no 6.x backport. Every published stable 6.x
@prisma/configpinsdeepmerge-ts@7.1.5; the fix shipped in@prisma/config@7.10.1(verified against the npm registry - the only stable versions declaringdeepmerge-ts@8.0.2are7.10.1and unreleased8.1.0-dev.*). npm'slatesttag forprismais still8.0.0-rc.23, a prerelease, so 7.10.1 is the lowest stable release that clearsCloses #47