[dependabot]

Update the dependency group across Go, JavaScript, and GitHub Actions while retaining TypeScript 6.0.3 and typescript-eslint 8.65.0 for the current compiler API and lint configuration.

Use Vitest and coverage 4.1.12 to include the mocker security fixes while keeping compatibility with the Temporal polyfill. Defer TypeScript 7, Vitest 5, and the newer TypeScript ESLint rules to separate migrations.

Package	From	To
actions/cache	5	6
modernc.org/sqlite	1.60.1	1.61.0
@types/node	26.1.1	26.6.5
@vitest/coverage-v8	4.1.11	4.1.12
eslint	10.8.0	10.13.0
knip	6.38.0	6.42.0
pg	8.22.0	8.23.1
pino	10.3.1	10.4.0
prettier	3.9.6	3.9.10
publint	0.3.24	0.3.25
vite	8.1.6	8.3.4
vitest	4.1.11	4.1.12
zod	4.6.5	4.6.7
@prisma/adapter-pg	7.9.1	7.10.1
@prisma/client	7.9.1	7.10.1
prisma	7.9.1	7.10.1

[bgentry]

@dependabot rebase

[bgentry]

🤖 Codex review: Changes requested. The dependency artifact/source review found no blocking malicious-code or checksum issue, but this head fails compatibility checks and must not merge.

Blocking compatibility findings

1. [P1] Keep a compatible TypeScript compiler API. typescript 6.0.3 → 7.0.2 removes the API used by the CLI codemod (createSourceFile, transpileModule, AST types, etc.). The full build and both test typechecks fail, codemod tests cannot load the API, and typescript-eslint@8.71.2 explicitly rejects TS 7. Retain TS 6 for API consumers or complete a deliberate side-by-side compiler/API integration. Microsoft documents this transition.
2. [P2] Resolve Vitest 5's Temporal fake-timer incompatibility. Five existing timer tests throw TypeError: Cannot redefine property: Now on Node 24. Vitest 5's bundled timers copy the polyfill's nonconfigurable Temporal.Now descriptor, then redefine it. This happens even in tests requesting only setTimeout/clearTimeout. The exact five tests pass with Vitest 4.1.11 on the base tree. Adapt the integration before upgrading, or retain a patched compatible Vitest 4 line.

Upgrade

• Reviewed head: 15a482ea10882c92c5073d67938a59d6ac5c6a37; base: 21ec5ea1a7ebad21e2b83e6c1aee019b926ecb7f.
• 19 distinct direct upgrades across Actions, Go, and npm; 24 changed files. The group title's “3 updates” describes ecosystem groups rather than the actual package count.

Package	From	To
actions/cache	5	6
modernc.org/sqlite	1.60.1	1.61.0
@types/node	26.1.1	26.6.5
@types/pg	8.20.0	8.23.1
@vitest/coverage-v8	4.1.11	5.0.5
eslint	10.8.0	10.13.0
knip	6.38.0	6.42.0
pg	8.22.0	8.23.1
pino	10.3.1	10.4.0
prettier	3.9.6	3.9.10
publint	0.3.24	0.3.25
typescript	6.0.3	7.0.2
typescript-eslint	8.65.0	8.71.2
vite	8.1.6	8.3.4
vitest	4.1.11	5.0.5
zod	4.6.5	4.6.7
@prisma/adapter-pg	7.9.1	7.10.1
@prisma/client	7.9.1	7.10.1
prisma	7.9.1	7.10.1

Security review

• Independent Go, npm, and Actions reviews inspected published artifacts/source before execution. Verified 20 old/new Go module identities through proxy/sumdb; 72 npm artifacts against registry/lockfile SHA-512; and 43 action runtime dependency artifacts against upstream lockfile integrity. No same-version checksum/integrity rewrites or unexpected source substitutions.
• Go: inspected SQLite authorizer, cancellation/lock handling and hook cleanup; libc/platform primitives; formatting, syscall, compiler, and tooling deltas. The required SQLite/libc versions agree. Independently reproduced generated vendor manifest hashes; v1.61.0's 515-file SHA-256 is 51f1fd1c6e98f205a6a27e4c09630b8b81b807e0f53e5602dda160a143e0e523. No Go/toolchain/workspace/replace change.
• npm: inspected all 17 direct upgrades, graph churn (142 added/133 removed identities), sensitive database/compiler/native/Prisma transitives, lifecycle scripts, loaders, and generated bundles. No new direct install hooks; Prisma's existing installer behavior remains. The Darwin-arm64 TS 7 artifact matches Microsoft's release asset.
• Actions: v5 resolves to caa296126883cff596d87d8935842f9db880ef25 (5.1.0), v6 to 55cc8345863c7cc4c66a329aec7e433d2d1c52a9 (6.1.0). Action metadata and top-level source are unchanged; Node24 remains. Inspected ESM/toolkit/HTTP/XML deltas and embedded Azure CRC64 WASM loader; no external binary downloader identified.
• Confirmed security content: Zod fixes GHSA-mrhx-c7xc-m3w5, and the upgraded mocker fixes GHSA-xp26-3454-mjgp and GHSA-qxg6-89mg-rqv8. The mocker attack paths require exposed dev-server plugins; no such River configuration was identified.

Compatibility verification
Local checks use the exact head, Go 1.27.1, Node 24.14.1, pinned pnpm 10.22.0, and an isolated Postgres 18 database. Dependency lifecycle scripts stayed disabled.

• make tidy — passed, no diff.
• go mod verify in all 10 workspace modules — passed.
• make test, make lint, make test/race TEST_DATABASE=sqlite — passed; no tracked changes.
• pnpm install --frozen-lockfile --ignore-scripts, make generate/fixtures, pnpm run fmt:check — passed.
• make build/js, pnpm run lint, pnpm run typecheck:tests, pnpm run typecheck:next — failed on the TS 7 incompatibility.
• pnpm run test — 1,343 passed / 10 failed, with 5 failing files including the codemod suite load failure; failures trace to TS 7 and Temporal fake timers.
• Base-tree make build/js and the five targeted timer tests — passed.
• Current remote Go/Java/Ruby/Rust/conformance checks pass; 13 JavaScript jobs fail. JS package archives, examples, and integration verification remain blocked by the build failure. Local checks do not independently exercise GitHub runner cache service/post-job behavior.

Residual risk

• Prisma CLI 7.10.1 loses npm build provenance relative to 7.9.1. This matches an intentional upstream publishing change and an open provenance issue; it remains a material provenance downgrade. Other upgraded Prisma packages retain provenance metadata.
• SQLite 1.61.0 has no signed release attestation; upstream documents the failed provenance job. Sumdb/source/vendor-stamp checks pass; the old version also lacked attestation.
• Native binaries, Prisma WASM, generated SQLite/libc, and action bundles were inspected without independent reproducible builds or exhaustive decompilation; published provenance metadata was not cryptographically reverified. Actions use floating major tags.
• Existing npm transitive advisories remain. Actions bundle Undici 6.27.0 with known advisories, including a newly affected WebSocket range (GHSA-3wwx-pv8p-q78v); no use of the required WebSocket/cookie/Blob/retry-interceptor paths was found in cache's current execution path.

The branch is still conflicted with current master. Dependabot rebase was requested; no new head has appeared. Rebase, resolve the two compatibility findings, and refresh the affected validation before approval or merge.

[bgentry]

🤖 Codex review: Approved after the amended dependency security and compatibility review. The previous compiler-API and Temporal timer findings are resolved.

Upgrade and reviewed tree

• Head: 4d8afc7ed4f95f6ef2bc1c142ffc159eb0ea933d; rebased onto 274c4b1f542d8c3d83fd5c299d5986d38feae60c.
• Keep TypeScript 6.0.3 and typescript-eslint 8.65.0. The newer lint rules also require a separate migration.
• Replace Vitest/coverage 5.0.5 with the patched compatible 4.1.12 releases. The PR description lists all 16 remaining direct upgrades. The already merged @types/pg update is absent from this diff.

Security review

Reuse the exact-version/integrity artifact and source evidence from the previous review for unchanged Go, npm, and Actions artifacts. The rebased Go inputs are unchanged by the subsequent JS-only edits; cache v5/v6 tag identities were refreshed and still resolve to the reviewed commits.

The new delta covers all nine Vitest 4.1.12 package tarballs and obug 2.2.1, with matching registry/lock SHA-512, retained trusted-publishing metadata, no new install hooks, and no exact-version advisory findings. Vitest's timer code is byte-identical to 4.1.11, with no Temporal fake-timer support; mocker 4.1.12 contains both security backports. Restored TypeScript and parser/plugin artifacts match the reviewed base identities. Retained parser service helpers were already reviewed in the original PR. All 26 existing native libc selectors are preserved; no unexplained versions, integrity rewrites, or source changes remain.

Final lock SHA-256: d33cc6c325ac70713148190c3e7c6d42256cf933734d92f609cf6bee43413fa4.

Compatibility verification

Local validation uses Go 1.27.1, Node 24.14.1, pinned pnpm 10.22.0, and disposable Postgres 18 databases. Lifecycle scripts remain disabled during installation.

• make tidy, make test, make lint, make test/race TEST_DATABASE=sqlite — passed. Go results remain applicable because all relevant Go sources, manifests, and dependency identities are identical after the JS-only amendment.
• Frozen pnpm install --ignore-scripts — passed; tree remains clean.
• make lint/js — passed, including full builds, ESLint/Knip, formatting, TS 6 and TS-next checks.
• make test/js — all 68 files / 1,381 tests passed, including the previously failing codemod and timer cases.
• pnpm run test:integration after CLI migration — all 14 files / 190 tests passed in a fresh database. An earlier run recorded three timeouts with anomalous 41-minute elapsed time; the complete fresh rerun passed in 23 seconds.
• make doc/js, pnpm run license:check, make check/js/package, pnpm run package:examples — passed. Nine packed packages and eight packed examples were validated, including Postgres behavior and the legacy archive/codemod consumer.
• GitHub CI is refreshing for this head; its required checks must pass before merge, including Node 26 and hosted runner/platform coverage.

Residual risk

The previously documented Prisma CLI provenance downgrade, SQLite release-attestation gap, native/generated artifact review limits, floating action tags, and bundled advisory reachability caveats remain. This amendment adds no new blocking supply-chain finding.