You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
chore(deps): override mysql2 and deepmerge-ts to patched versions
fix(deps): pin the mysql2/deepmerge-ts overrides to exact versions
Summary by CodeRabbit
Chores
Made a routine update to project configuration. There are no changes to app features, workflows, or visible behavior, and no action is required. Existing functionality remains unchanged. These maintenance changes are not expected to affect how the app looks or works.
Both are transitive dependencies of prisma, bundled for its multi-database
driver support regardless of which provider a project actually uses. This
project only ever uses the postgresql provider, but the installed
versions were still below the patched thresholds for their respective
advisories.
We reviewed changes in a53c32c...3e97e32 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
➖ A suitable Prisma release may not yet contain both patched dependencies.
➖ A Prisma upgrade would expand the review and regression-testing scope.
Recommendation: The overrides are the best immediate remediation because they address installed vulnerable packages without changing the PostgreSQL runtime path or upgrading Prisma. Prefer removing them once Prisma natively resolves both dependencies above the advisory thresholds.
Files changed (2) +38 / -31
Other (2) +38 / -31
pnpm-lock.yamlResolve Prisma transitives to patched versions+32/-31
Resolve Prisma transitives to patched versions
• Records deepmerge-ts 8.0.2 and mysql2 3.24.4 after applying workspace overrides. Regeneration also updates mysql2’s dependency and @types/node peer graph, plus incidental peer snapshot keys.
• Adds workspace overrides requiring mysql2 3.23.1 or newer and deepmerge-ts 8.0.0 or newer. Comments document that Prisma installs them despite the project’s PostgreSQL-only configuration.
The pinned versions are reflected in the lockfile, so this change is ready to merge after normal checks.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check name
Status
Explanation
Resolution
Description check
⚠️ Warning
The description only lists summary statements. It omits the required change explanation, testing details, and checklist.
Use the repository template. Add a one- or two-sentence explanation of the change and reason, document the tests that were run, and complete the checklist items.
✅ Passed checks (4 passed)
Check name
Status
Explanation
Docstring Coverage
✅ Passed
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check
✅ Passed
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
✅ Passed
Check skipped because no linked issues were found for this pull request.
Title check
✅ Passed
The title clearly identifies the dependency overrides for mysql2 and deepmerge-ts. It accurately summarizes the main change.
✨ Finishing Touches🧪 Generate unit tests (beta)
Commit to this branch
Create a new PR
Comment @coderabbitai help to get the list of available commands.
1. Lock refreshes can force new majors✓ Resolved🐞 Bug⚙ Maintainability
Description
The two bare overrides use open-ended >= ranges, replacing matching dependency edges throughout
the workspace without retaining Prisma's compatible major-version constraints. A routine lockfile
refresh can therefore select later breaking majors of either package and force them into present or
future consumers without a corresponding manifest change that explicitly reviews that upgrade.
ⓘ Recommendations generated based on similar findings in past PRs
Evidence
The workspace declares pnpm 11.3.0 and the new override values are unrestricted above their security
thresholds, while the lock currently resolves only one specific snapshot of each dependency. pnpm's
documentation states that a regular root override rewrites matching dependency edges throughout the
dependency graph, confirming that these bare ranges are not limited to Prisma or to the current
major releases.
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
## Issue description
The bare, open-ended overrides allow future major versions and apply across the workspace, so regenerating the lockfile can force an unreviewed breaking release into Prisma or another consumer.
## Fix Focus Areas
- pnpm-workspace.yaml[4-9]
- pnpm-lock.yaml[7-9]
## Recommended Fix
Replace the `>=` ranges with exact reviewed patched versions such as `mysql2: "3.24.4"` and `deepmerge-ts: "8.0.2"`, optionally scope each override to its Prisma parent, and regenerate the lockfile with the repository's pinned pnpm version.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
2. The security note misstates config use✓ Resolved🐞 Bug⚙ Maintainability
Description
The new comment says neither overridden package is exercised by PostgreSQL-only usage, but
deepmerge-ts is a database-independent dependency used by @prisma/config. Prisma config loading
calls its basic deepmerge export, so the note gives future maintainers an incorrect basis for
evaluating whether that security dependency can be removed or deprioritized.
+ # Prisma bundles these regardless of database provider; both are below+ # patched versions for known advisories. Neither is exercised by this+ # project's postgresql-only usage, but pin them past the fix anyway.
Relevance
●●● Strong
Recent precedent accepts corrections to inaccurate configuration comments, especially when they
affect operational understanding.
ⓘ Recommendations generated based on similar findings in past PRs
Evidence
The lockfile places deepmerge-ts directly under @prisma/config, while this repository invokes
Prisma config loading through its generate and migration scripts. Prisma's own dependency-update
analysis identifies the concrete call site as the deepmerge merger in loadConfigFromFile.ts,
disproving the comment's claim that PostgreSQL-only usage leaves this package unexercised.
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
## Issue description
The override comment incorrectly groups `deepmerge-ts` with unused database drivers even though Prisma uses it while loading configuration independently of the selected database provider.
## Fix Focus Areas
- pnpm-workspace.yaml[5-7]
## Recommended Fix
Rewrite the comment to distinguish `mysql2`, which is unused by the PostgreSQL application, from `deepmerge-ts`, which Prisma config loading actively uses and is overridden to address its advisory.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Review mode: ⚖️ Balanced: This dependency override changes workspace configuration and the resolved Prisma dependency graph, so compatibility and install/runtime behavior require a careful review despite the localized scope.
Tip of the day
💡 Did you know, you can choose which labels appear on a finding, and whether they show icons or text
An open-ended >= range means a routine lockfile refresh could silently
pull in an unreviewed future major release for either package. Also
correct the accompanying comment: deepmerge-ts isn't dormant like
mysql2 is, @prisma/config calls it directly while loading configuration
regardless of database provider, so it's a real vulnerable dependency
being patched here, not dead code.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
The PR aims to address security vulnerabilities by overriding transitive dependencies for mysql2 and deepmerge-ts. While the intent is correct, the implementation is currently ineffective because the overrides field is placed in pnpm-workspace.yaml. In a pnpm environment, dependency overrides must be defined in the root package.json under the pnpm.overrides key. Until this configuration is moved, the project remains vulnerable as the package manager will ignore these pins.
Test suggestions
Verify that the lockfile (pnpm-lock.yaml) correctly resolves mysql2 to exactly 3.24.4.
Verify that the lockfile (pnpm-lock.yaml) correctly resolves deepmerge-ts to exactly 8.0.2.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the lockfile (pnpm-lock.yaml) correctly resolves mysql2 to exactly 3.24.4.
2. Verify that the lockfile (pnpm-lock.yaml) correctly resolves deepmerge-ts to exactly 8.0.2.
This was supposed to be Renovate's or Dependabot jobs, I don't know why they're not actively opening PR. Please help to check why they're not responding and actively patching the version. Please see it here #105
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Summary by CodeRabbit