fix: patch Prisma configuration and build tooling dependencies

[brycejohnson1417]

Problem and outcome

Patch the remaining configuration/build-tool advisories while retaining Prisma 6 and the existing application architecture.

Closes #197.

• Pin matching Prisma client/CLI 6.19.3, which updates Effect to 3.21.0.
• Scope deepmerge-ts 8.0.0 override to @prisma/config. Prisma uses its deepmerge function for plain configuration records; the v8 Map/type changes do not affect this path. The actual config loader was exercised with schema and nested migration settings.
• Update tsx to 4.23.15, resolving esbuild to patched 0.28.2.
• Make the existing OAuth signature-tampering test deterministic by altering the first encoded signature character. The old final-character replacement sometimes decoded to identical bytes. No production authentication code changes.

Validation

Clean npm ci, Prisma generation, config loader smoke check, and full npm run verify passed. Refreshed against main 5feada8: 56 test files / 248 tests, lint, types, Prisma validation and build. Fresh npm audit reports zero vulnerabilities. git diff --check passed.

Scope / risk

Four files: package.json, package-lock.json, SESSION.md, one existing test. Lockfile size is mainly esbuild platform-package relocation and Prisma tooling dependency changes; semantic versions reviewed. No schema migration, data write, access-control change, provider rewrite, or Prisma major upgrade. Scoped override must be revisited when Prisma upstream adopts the fixed dependency.

References: https://github.com/RebeccaStevens/deepmerge-ts/releases/tag/v8.0.0 and GHSA-ggr8-5vv4-36mx

Production verification will follow green CI and merge.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
picc-push	Ready	Preview	Sep 29, 2026 6:11pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T18:15:16.239540Z	8a2c46e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[brycejohnson1417]

Production deployment dpl_ARPWuhNR5vhhYmCNneH5iK1XtxNX is READY and aliased to https://piccnewyork.org at cf42d43. Browser sign-in returned 200 with Google sign-in visible. Full local validation and fresh audit passed before merge; signed-in production flows remain limited by the authentication challenge in this browser session. No schema or production records changed.