From a69c38f78db3abafe715fad3f37431f3c3ee9c61 Mon Sep 17 00:00:00 2001 From: Oleksii Orlenko Date: Tue, 1 Sep 2026 11:08:00 +0200 Subject: [PATCH] chore(deps): bump deepmerge-ts and mariadb past audited vulnerabilities pnpm audit --prod fails on every PR with four advisories: - deepmerge-ts < 8.0.0: stack exhaustion on recursive object graphs (GHSA-ggr8-5vv4-36mx) - mariadb >= 3.4.0 < 3.4.6: cleartext password leak to a MitM despite ssl: true (GHSA-cqhc-2h57-wpxf), cleartext transmission of sensitive information (GHSA-42r5-vhpq-m858), and possible SQL injection under multibyte client charsets (GHSA-g5xc-5w98-jfvm) Bump deepmerge-ts 7.1.5 -> 8.0.2 and mariadb 3.4.5 -> 3.5.3. The mariadb 3.4.x line has no 3.4.6 release on npm; 3.5.3 is the current release that satisfies >= 3.4.6. deepmerge-ts 8 changes Map merging and deepmergeInto mutation. Neither matters here: @prisma/config only calls the basic deepmerge export on plain config objects. Signed-off-by: Oleksii Orlenko --- packages/adapter-mariadb/package.json | 2 +- packages/config/package.json | 2 +- pnpm-lock.yaml | 43 ++++++++++++++++++++++----- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/packages/adapter-mariadb/package.json b/packages/adapter-mariadb/package.json index 98499f5fe1a3..45f4a53aa1f9 100644 --- a/packages/adapter-mariadb/package.json +++ b/packages/adapter-mariadb/package.json @@ -37,7 +37,7 @@ "sideEffects": false, "dependencies": { "@prisma/driver-adapter-utils": "workspace:*", - "mariadb": "3.4.5" + "mariadb": "3.5.3" }, "devDependencies": { "@prisma/debug": "workspace:*" diff --git a/packages/config/package.json b/packages/config/package.json index 854ff4b73b90..7b993e8b349f 100644 --- a/packages/config/package.json +++ b/packages/config/package.json @@ -13,7 +13,7 @@ "author": "Alberto Schiabel ", "dependencies": { "c12": "3.3.4", - "deepmerge-ts": "7.1.5", + "deepmerge-ts": "8.0.2", "effect": "3.20.0", "empathic": "2.0.0" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d54d684e5038..ff30d4bea288 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -268,8 +268,8 @@ importers: specifier: workspace:* version: link:../driver-adapter-utils mariadb: - specifier: 3.4.5 - version: 3.4.5 + specifier: 3.5.3 + version: 3.5.3 devDependencies: '@prisma/debug': specifier: workspace:* @@ -1177,8 +1177,8 @@ importers: specifier: 3.3.4 version: 3.3.4(magicast@0.5.2) deepmerge-ts: - specifier: 7.1.5 - version: 7.1.5 + specifier: 8.0.2 + version: 8.0.2 effect: specifier: 3.20.0 version: 3.20.0 @@ -5522,9 +5522,9 @@ packages: deep-is@0.1.4: resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==} - deepmerge-ts@7.1.5: - resolution: {integrity: sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==} - engines: {node: '>=16.0.0'} + deepmerge-ts@8.0.2: + resolution: {integrity: sha512-uqbvqLUMrc6p0MO+WBRtTxY55hmyh94WRwI5a++PZe54X+bfVh59FSN7uWCBCW1CCVjzjnrwzfI8zidE2obMMw==} + engines: {node: '>=16.9.0'} deepmerge@4.2.2: resolution: {integrity: sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==} @@ -5850,6 +5850,7 @@ packages: eslint@9.22.0: resolution: {integrity: sha512-9V/QURhsRN40xuHXWjV64yvrzMjcz7ZyNoF2jJFmy9j/SLk0u1OLSZgXi28MrXjymnjEGSR80WCdab3RGMDveQ==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} + deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options. hasBin: true peerDependencies: jiti: '*' @@ -6377,6 +6378,10 @@ packages: resolution: {integrity: sha512-cf6L2Ds3h57VVmkZe+Pn+5APsT7FpqJtEhhieDCvrE2MK5Qk9MyffgQyuxQTm6BChfeZNtcOLHp9IcWRVcIcBQ==} engines: {node: '>=0.10.0'} + iconv-lite@0.7.3: + resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==} + engines: {node: '>=0.10.0'} + identifier-regex@1.0.0: resolution: {integrity: sha512-Rcy5cjBOM9iTR+Vwy0Llyip9u0cA99T1yiWOhDW/+PDaTQhyski0tMovsipQ/FRNDkudjLWusJ/IMVIlG5WZnQ==} engines: {node: '>=18'} @@ -6970,6 +6975,10 @@ packages: lru-cache@10.4.3: resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==} + lru-cache@11.5.2: + resolution: {integrity: sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==} + engines: {node: 20 || >=22} + lru-cache@5.1.1: resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==} @@ -7023,6 +7032,10 @@ packages: resolution: {integrity: sha512-gThTYkhIS5rRqkVr+Y0cIdzr+GRqJ9sA2Q34e0yzmyhMCwyApf3OKAC1jnF23aSlIOqJuyaUFUcj7O1qZslmmQ==} engines: {node: '>= 14'} + mariadb@3.5.3: + resolution: {integrity: sha512-i053Kc0MgdUv/hu9mCyq67TYfPXFj3/MV8I7ZW5wvJNixIyXC0VztMPUjIVj/449nQo+BsxFD4Fdk/sA/uqKPQ==} + engines: {node: '>= 20.0.0'} + math-intrinsics@1.1.0: resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==} engines: {node: '>= 0.4'} @@ -12639,7 +12652,7 @@ snapshots: deep-is@0.1.4: {} - deepmerge-ts@7.1.5: {} + deepmerge-ts@8.0.2: {} deepmerge@4.2.2: {} @@ -13610,6 +13623,10 @@ snapshots: dependencies: safer-buffer: 2.1.2 + iconv-lite@0.7.3: + dependencies: + safer-buffer: 2.1.2 + identifier-regex@1.0.0: dependencies: reserved-identifiers: 1.0.0 @@ -14443,6 +14460,8 @@ snapshots: lru-cache@10.4.3: {} + lru-cache@11.5.2: {} + lru-cache@5.1.1: dependencies: yallist: 3.1.1 @@ -14516,6 +14535,14 @@ snapshots: iconv-lite: 0.6.3 lru-cache: 10.4.3 + mariadb@3.5.3: + dependencies: + '@types/geojson': 7946.0.16 + '@types/node': 20.19.37 + denque: 2.1.0 + iconv-lite: 0.7.3 + lru-cache: 11.5.2 + math-intrinsics@1.1.0: {} media-typer@1.1.0: {}