Skip to content

chore: bump prisma from 7.8.0 to 7.9.1 in the prisma group across 1 directory - #187

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/prisma-f7294453a4
Closed

chore: bump prisma from 7.8.0 to 7.9.1 in the prisma group across 1 directory#187
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/prisma-f7294453a4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the prisma group with 1 update in the / directory: prisma.

Updates prisma from 7.8.0 to 7.9.1

Release notes

Sourced from prisma's releases.

7.9.1

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes prisma/prisma#29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab
2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):
echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh
echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash
tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish
tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

prisma.mp4

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

</tr></table> 

... (truncated)

Commits

@aquie00t

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot dependabot Bot changed the title chore: bump prisma from 7.8.0 to 7.9.1 in the prisma group chore: bump prisma from 7.8.0 to 7.9.1 in the prisma group across 1 directory Aug 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/prisma-f7294453a4 branch 2 times, most recently from fc3122f to 1d2f9ca Compare August 24, 2026 18:01
aquie00t added a commit that referenced this pull request Aug 24, 2026
The pin sat at exactly 4.17.23, which is the patched version for the older
advisory (<=4.17.22) but is itself inside the range of the newer one:
GHSA-r5fr-rjxr-66jc covers >=4.0.0 <=4.17.23, first patched in 4.18.0.

Dependency Review fails every PR whose diff touches the lockfile overrides
block because of it — #187 is the current example.

lodash is not in the dependency graph at all right now (zero entries in the
lockfile), so this floor is purely defensive: it costs nothing today and
covers the case where something pulls lodash back in.

Checked the other eleven overrides against the GitHub Advisory DB while I
was here; none of them are below their patched version.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Bumps the prisma group with 1 update in the / directory: [prisma](https://github.com/prisma/prisma/tree/HEAD/packages/cli).


Updates `prisma` from 7.8.0 to 7.9.1
- [Release notes](https://github.com/prisma/prisma/releases)
- [Commits](https://github.com/prisma/prisma/commits/7.9.1/packages/cli)

---
updated-dependencies:
- dependency-name: prisma
  dependency-version: 7.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: prisma
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/prisma-f7294453a4 branch from 1d2f9ca to f47d4bb Compare August 24, 2026 18:27
github-actions Bot pushed a commit that referenced this pull request Aug 24, 2026
## [1.0.3](v1.0.2...v1.0.3) (2026-08-24)

### Bug Fixes

* **deps:** raise lodash override above GHSA-r5fr-rjxr-66jc ([#198](#198)) ([ade9307](ade9307)), closes [#187](#187)
@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #201.

@dependabot dependabot Bot closed this Aug 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/prisma-f7294453a4 branch August 24, 2026 18:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant