fix(deps): override deepmerge-ts to clear GHSA-ggr8-5vv4-36mx

[joryirving]

Summary

• Add overrides.deepmerge-ts: ^8.0.0 to clear GHSA-ggr8-5vv4-36mx, and record the rationale in the existing "//" block.

Why

npm audit fails on main right now with 3 high-severity findings. deepmerge-ts reaches us transitively through prisma > @prisma/config, and npm's only advertised stable fix is downgrading prisma to 6.12.0, which is breaking — so an override is the cheaper path, consistent with how postcss and sharp are already handled.

The advisory published 2026-08-17T13:32:13Z, 48 minutes after main's last npm audit run passed at 12:44:47Z. So main's green check is stale rather than accurate, and every PR opened since has failed an audit for something it did not introduce.

That is not hypothetical: four open foreman PRs (#779, #780, #781, #783) each independently added their own copy of this same pin while trying to work unrelated issues. Fixing it once here removes the trigger.

Notes

• Renovate did not catch this, and the reason is worth recording: it sources vulnerabilities from Dependabot alerts, and those are disabled org-wide (dependabot_alerts_enabled_for_new_repositories: false, and the alerts endpoint returns an empty array for this repo). Renovate's scan logged "No vulnerability alerts found" and correctly did nothing. Enabling org-level alerts is the durable fix and is out of scope here.
• osvVulnerabilityAlerts would not have helped either — it covers direct dependencies only, and this is transitive.

Verification

• npm audit --omit=dev: 3 high → found 0 vulnerabilities
• npx tsc --noEmit: clean
• npm run test: 126 files, 2288 tests passing
• resolved version is deepmerge-ts@8.0.1

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This PR adds an npm overrides pin for deepmerge-ts ^8.0.0 to remediate GHSA-ggr8-5vv4-36mx, which reaches the repo transitively via prisma > @prisma/config. The change is minimal (package.json + lockfile), the rationale is documented in the existing "//" overrides block, and all CI checks — including npm audit, Typecheck, Lint, Tests, and Build — pass on the head commit.

Change-by-Change Findings

package.json

• Adds "deepmerge-ts": "^8.0.0" to the existing overrides block, alongside the pre-existing postcss and sharp pins. This is consistent with the repository's established pattern for remediating transitive advisories.
• The "//" rationale block is updated to explain the advisory (GHSA-ggr8-5vv4-36mx, stack exhaustion, published 2026-08-17), the transitive path (prisma > @prisma/config), and why an override is preferred over npm's only advertised stable fix (downgrading prisma to 6.12.0, which would be breaking). This matches the documented convention that overrides must not be removed without verifying the originating transitive deps have shipped patched versions.

package-lock.json

• deepmerge-ts resolves from 7.1.5 to 8.0.1 with a matching integrity hash and updated funding metadata. The lockfile change is consistent with the override.

Breaking-Change Assessment

The override forces deepmerge-ts from 7.1.5 to 8.0.1, and v8.0.0 is a major release with breaking changes (deep Map-value merging by default, renamed DeepMergeMetaMetaData/DeepMergeIntoFunctionUtils types, and deepmergeInto no longer leak-mutating inputs). However, deepmerge-ts is a transitive dependency here — the repo does not import it directly — so the breaking changes only matter if @prisma/config (the consumer) is incompatible with v8. The full test suite (2288 tests across 126 files, per the PR body) and the Typecheck CI job both pass, which is strong evidence that Prisma's use of the library is compatible with v8.0.1. No direct usage of deepmerge-ts exists in the repo's source.

Standards Compliance

• The change follows the repository's documented override convention: pins live in the top-level overrides block, and the rationale is recorded in the "//" field because npm validates overrides entries strictly.
• No secrets, env files, or build output are committed.
• The PR is a dependency-update task, which AGENTS.md classifies as NORMAL-lane work; the change is scoped and testable.

Tool Harness Findings

• GitHub release data for deepmerge-ts confirms v8.0.1 (2026-08-16) is a bug-fix release on top of v8.0.0, and v8.0.0 (2026-08-16) is the major release containing the breaking changes and the security-relevant fixes. The resolved lockfile version 8.0.1 is the latest available.
• The GitHub advisory page for GHSA-ggr8-5vv4-36mx could not be fetched directly (the API endpoint returned 404 and the HTML fetch returned an unparseable page), so the advisory's exact affected-range and patched-version metadata could not be independently confirmed from the advisory itself. The PR body and the package.json rationale both cite the advisory ID and describe it as a stack-exhaustion issue; the npm audit CI check passing on the head commit is the authoritative confirmation that the override clears the finding.

Unknowns or Needs Verification

• The advisory page itself was not directly verifiable during this review (fetch/API 404). The passing npm audit CI check on the head commit is the primary evidence that the override resolves the finding; if the advisory page becomes available, it would be worth confirming the patched range includes 8.0.1.
• No host-platform compatibility matrix applies here: this is a pure npm dependency override, not a bump to a component that runs on a pinned host OS or alongside a pinned peer platform.

Must-Check Items

• Check for breaking API changes in updated dependencies: Verified. deepmerge-ts v8.0.0 has breaking changes, but the package is transitive-only (via prisma > @prisma/config); Typecheck and the full test suite pass, indicating no incompatibility with the consumer.
• Run full test suite after upgrade: Verified. The Tests CI check is green on the head commit, and the PR body reports 126 files / 2288 tests passing.

[its-saffron]

Info: The GHSA-ggr8-5vv4-36mx advisory page could not be fetched during review; the passing npm audit CI check is the authoritative confirmation that the override clears the finding.

Automated finding from AI PR review.

[joryirving]

Summary

• Add overrides.deepmerge-ts: ^8.0.0 to clear GHSA-ggr8-5vv4-36mx, and record the rationale in the existing "//" block.

Why

npm audit fails on main right now with 3 high-severity findings. deepmerge-ts reaches us transitively through prisma > @prisma/config, and npm's only advertised stable fix is downgrading prisma to 6.12.0, which is breaking — so an override is the cheaper path, consistent with how postcss and sharp are already handled.

The advisory published 2026-08-17T13:32:13Z, 48 minutes after main's last npm audit run passed at 12:44:47Z. So main's green check is stale rather than accurate, and every PR opened since has failed an audit for something it did not introduce.

That is not hypothetical: four open foreman PRs (#779, #780, #781, #783) each independently added their own copy of this same pin while trying to work unrelated issues. Fixing it once here removes the trigger.

Notes

• Renovate did not catch this, and the reason is worth recording: it sources vulnerabilities from Dependabot alerts, and those are disabled org-wide (dependabot_alerts_enabled_for_new_repositories: false, and the alerts endpoint returns an empty array for this repo). Renovate's scan logged "No vulnerability alerts found" and correctly did nothing. Enabling org-level alerts is the durable fix and is out of scope here.
• osvVulnerabilityAlerts would not have helped either — it covers direct dependencies only, and this is transitive.

Verification

• npm audit --omit=dev: 3 high → found 0 vulnerabilities
• npx tsc --noEmit: clean
• npm run test: 126 files, 2288 tests passing
• resolved version is deepmerge-ts@8.0.1

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This PR adds an npm overrides pin for deepmerge-ts ^8.0.0 to remediate GHSA-ggr8-5vv4-36mx, which reaches the repo transitively via prisma > @prisma/config. The change is minimal (package.json + lockfile), the rationale is documented in the existing "//" overrides block, and all CI checks — including npm audit, Typecheck, Lint, Tests, and Build — pass on the head commit.

Change-by-Change Findings

package.json

• Adds "deepmerge-ts": "^8.0.0" to the existing overrides block, alongside the pre-existing postcss and sharp pins. This is consistent with the repository's established pattern for remediating transitive advisories.
• The "//" rationale block is updated to explain the advisory (GHSA-ggr8-5vv4-36mx, stack exhaustion, published 2026-08-17), the transitive path (prisma > @prisma/config), and why an override is preferred over npm's only advertised stable fix (downgrading prisma to 6.12.0, which would be breaking). This matches the documented convention that overrides must not be removed without verifying the originating transitive deps have shipped patched versions.

package-lock.json

• deepmerge-ts resolves from 7.1.5 to 8.0.1 with a matching integrity hash and updated funding metadata. The lockfile change is consistent with the override.

Breaking-Change Assessment

The override forces deepmerge-ts from 7.1.5 to 8.0.1, and v8.0.0 is a major release with breaking changes (deep Map-value merging by default, renamed DeepMergeMetaMetaData/DeepMergeIntoFunctionUtils types, and deepmergeInto no longer leak-mutating inputs). However, deepmerge-ts is a transitive dependency here — the repo does not import it directly — so the breaking changes only matter if @prisma/config (the consumer) is incompatible with v8. The full test suite (2288 tests across 126 files, per the PR body) and the Typecheck CI job both pass, which is strong evidence that Prisma's use of the library is compatible with v8.0.1. No direct usage of deepmerge-ts exists in the repo's source.

Standards Compliance

• The change follows the repository's documented override convention: pins live in the top-level overrides block, and the rationale is recorded in the "//" field because npm validates overrides entries strictly.
• No secrets, env files, or build output are committed.
• The PR is a dependency-update task, which AGENTS.md classifies as NORMAL-lane work; the change is scoped and testable.

Tool Harness Findings

• GitHub release data for deepmerge-ts confirms v8.0.1 (2026-08-16) is a bug-fix release on top of v8.0.0, and v8.0.0 (2026-08-16) is the major release containing the breaking changes and the security-relevant fixes. The resolved lockfile version 8.0.1 is the latest available.
• The GitHub advisory page for GHSA-ggr8-5vv4-36mx could not be fetched directly (the API endpoint returned 404 and the HTML fetch returned an unparseable page), so the advisory's exact affected-range and patched-version metadata could not be independently confirmed from the advisory itself. The PR body and the package.json rationale both cite the advisory ID and describe it as a stack-exhaustion issue; the npm audit CI check passing on the head commit is the authoritative confirmation that the override clears the finding.

Unknowns or Needs Verification

• The advisory page itself was not directly verifiable during this review (fetch/API 404). The passing npm audit CI check on the head commit is the primary evidence that the override resolves the finding; if the advisory page becomes available, it would be worth confirming the patched range includes 8.0.1.
• No host-platform compatibility matrix applies here: this is a pure npm dependency override, not a bump to a component that runs on a pinned host OS or alongside a pinned peer platform.

Must-Check Items

• Check for breaking API changes in updated dependencies: Verified. deepmerge-ts v8.0.0 has breaking changes, but the package is transitive-only (via prisma > @prisma/config); Typecheck and the full test suite pass, indicating no incompatibility with the consumer.
• Run full test suite after upgrade: Verified. The Tests CI check is green on the head commit, and the PR body reports 126 files / 2288 tests passing.

[its-saffron]

Info: The GHSA-ggr8-5vv4-36mx advisory page could not be fetched during review; the passing npm audit CI check is the authoritative confirmation that the override clears the finding.

Automated finding from AI PR review.

[joryirving]

Summary

• Add overrides.deepmerge-ts: ^8.0.0 to clear GHSA-ggr8-5vv4-36mx, and record the rationale in the existing "//" block.

Why

npm audit fails on main right now with 3 high-severity findings. deepmerge-ts reaches us transitively through prisma > @prisma/config, and npm's only advertised stable fix is downgrading prisma to 6.12.0, which is breaking — so an override is the cheaper path, consistent with how postcss and sharp are already handled.

The advisory published 2026-08-17T13:32:13Z, 48 minutes after main's last npm audit run passed at 12:44:47Z. So main's green check is stale rather than accurate, and every PR opened since has failed an audit for something it did not introduce.

That is not hypothetical: four open foreman PRs (#779, #780, #781, #783) each independently added their own copy of this same pin while trying to work unrelated issues. Fixing it once here removes the trigger.

Notes

• Renovate did not catch this, and the reason is worth recording: it sources vulnerabilities from Dependabot alerts, and those are disabled org-wide (dependabot_alerts_enabled_for_new_repositories: false, and the alerts endpoint returns an empty array for this repo). Renovate's scan logged "No vulnerability alerts found" and correctly did nothing. Enabling org-level alerts is the durable fix and is out of scope here.
• osvVulnerabilityAlerts would not have helped either — it covers direct dependencies only, and this is transitive.

Verification

• npm audit --omit=dev: 3 high → found 0 vulnerabilities
• npx tsc --noEmit: clean
• npm run test: 126 files, 2288 tests passing
• resolved version is deepmerge-ts@8.0.1

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This PR adds an npm overrides pin for deepmerge-ts ^8.0.0 to remediate GHSA-ggr8-5vv4-36mx, which reaches the repo transitively via prisma > @prisma/config. The change is minimal (package.json + lockfile), the rationale is documented in the existing "//" overrides block, and all CI checks — including npm audit, Typecheck, Lint, Tests, and Build — pass on the head commit.

Change-by-Change Findings

package.json

• Adds "deepmerge-ts": "^8.0.0" to the existing overrides block, alongside the pre-existing postcss and sharp pins. This is consistent with the repository's established pattern for remediating transitive advisories.
• The "//" rationale block is updated to explain the advisory (GHSA-ggr8-5vv4-36mx, stack exhaustion, published 2026-08-17), the transitive path (prisma > @prisma/config), and why an override is preferred over npm's only advertised stable fix (downgrading prisma to 6.12.0, which would be breaking). This matches the documented convention that overrides must not be removed without verifying the originating transitive deps have shipped patched versions.

package-lock.json

• deepmerge-ts resolves from 7.1.5 to 8.0.1 with a matching integrity hash and updated funding metadata. The lockfile change is consistent with the override.

Breaking-Change Assessment

The override forces deepmerge-ts from 7.1.5 to 8.0.1, and v8.0.0 is a major release with breaking changes (deep Map-value merging by default, renamed DeepMergeMetaMetaData/DeepMergeIntoFunctionUtils types, and deepmergeInto no longer leak-mutating inputs). However, deepmerge-ts is a transitive dependency here — the repo does not import it directly — so the breaking changes only matter if @prisma/config (the consumer) is incompatible with v8. The full test suite (2288 tests across 126 files, per the PR body) and the Typecheck CI job both pass, which is strong evidence that Prisma's use of the library is compatible with v8.0.1. No direct usage of deepmerge-ts exists in the repo's source.

Standards Compliance

• The change follows the repository's documented override convention: pins live in the top-level overrides block, and the rationale is recorded in the "//" field because npm validates overrides entries strictly.
• No secrets, env files, or build output are committed.
• The PR is a dependency-update task, which AGENTS.md classifies as NORMAL-lane work; the change is scoped and testable.

Tool Harness Findings

• GitHub release data for deepmerge-ts confirms v8.0.1 (2026-08-16) is a bug-fix release on top of v8.0.0, and v8.0.0 (2026-08-16) is the major release containing the breaking changes and the security-relevant fixes. The resolved lockfile version 8.0.1 is the latest available.
• The GitHub advisory page for GHSA-ggr8-5vv4-36mx could not be fetched directly (the API endpoint returned 404 and the HTML fetch returned an unparseable page), so the advisory's exact affected-range and patched-version metadata could not be independently confirmed from the advisory itself. The PR body and the package.json rationale both cite the advisory ID and describe it as a stack-exhaustion issue; the npm audit CI check passing on the head commit is the authoritative confirmation that the override clears the finding.

Unknowns or Needs Verification

• The advisory page itself was not directly verifiable during this review (fetch/API 404). The passing npm audit CI check on the head commit is the primary evidence that the override resolves the finding; if the advisory page becomes available, it would be worth confirming the patched range includes 8.0.1.
• No host-platform compatibility matrix applies here: this is a pure npm dependency override, not a bump to a component that runs on a pinned host OS or alongside a pinned peer platform.

Must-Check Items

• Check for breaking API changes in updated dependencies: Verified. deepmerge-ts v8.0.0 has breaking changes, but the package is transitive-only (via prisma > @prisma/config); Typecheck and the full test suite pass, indicating no incompatibility with the consumer.
• Run full test suite after upgrade: Verified. The Tests CI check is green on the head commit, and the PR body reports 126 files / 2288 tests passing.

[its-saffron]

Info: The GHSA-ggr8-5vv4-36mx advisory page could not be fetched during review; the passing npm audit CI check is the authoritative confirmation that the override clears the finding.

Automated finding from AI PR review.

[joryirving]

Summary

• Add overrides.deepmerge-ts: ^8.0.0 to clear GHSA-ggr8-5vv4-36mx, and record the rationale in the existing "//" block.

Why

npm audit fails on main right now with 3 high-severity findings. deepmerge-ts reaches us transitively through prisma > @prisma/config, and npm's only advertised stable fix is downgrading prisma to 6.12.0, which is breaking — so an override is the cheaper path, consistent with how postcss and sharp are already handled.

The advisory published 2026-08-17T13:32:13Z, 48 minutes after main's last npm audit run passed at 12:44:47Z. So main's green check is stale rather than accurate, and every PR opened since has failed an audit for something it did not introduce.

That is not hypothetical: four open foreman PRs (#779, #780, #781, #783) each independently added their own copy of this same pin while trying to work unrelated issues. Fixing it once here removes the trigger.

Notes

• Renovate did not catch this, and the reason is worth recording: it sources vulnerabilities from Dependabot alerts, and those are disabled org-wide (dependabot_alerts_enabled_for_new_repositories: false, and the alerts endpoint returns an empty array for this repo). Renovate's scan logged "No vulnerability alerts found" and correctly did nothing. Enabling org-level alerts is the durable fix and is out of scope here.
• osvVulnerabilityAlerts would not have helped either — it covers direct dependencies only, and this is transitive.

Verification

• npm audit --omit=dev: 3 high → found 0 vulnerabilities
• npx tsc --noEmit: clean
• npm run test: 126 files, 2288 tests passing
• resolved version is deepmerge-ts@8.0.1

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This PR adds an npm overrides pin for deepmerge-ts ^8.0.0 to remediate GHSA-ggr8-5vv4-36mx, which reaches the repo transitively via prisma > @prisma/config. The change is minimal (package.json + lockfile), the rationale is documented in the existing "//" overrides block, and all CI checks — including npm audit, Typecheck, Lint, Tests, and Build — pass on the head commit.

Change-by-Change Findings

package.json

• Adds "deepmerge-ts": "^8.0.0" to the existing overrides block, alongside the pre-existing postcss and sharp pins. This is consistent with the repository's established pattern for remediating transitive advisories.
• The "//" rationale block is updated to explain the advisory (GHSA-ggr8-5vv4-36mx, stack exhaustion, published 2026-08-17), the transitive path (prisma > @prisma/config), and why an override is preferred over npm's only advertised stable fix (downgrading prisma to 6.12.0, which would be breaking). This matches the documented convention that overrides must not be removed without verifying the originating transitive deps have shipped patched versions.

package-lock.json

• deepmerge-ts resolves from 7.1.5 to 8.0.1 with a matching integrity hash and updated funding metadata. The lockfile change is consistent with the override.

Breaking-Change Assessment

The override forces deepmerge-ts from 7.1.5 to 8.0.1, and v8.0.0 is a major release with breaking changes (deep Map-value merging by default, renamed DeepMergeMetaMetaData/DeepMergeIntoFunctionUtils types, and deepmergeInto no longer leak-mutating inputs). However, deepmerge-ts is a transitive dependency here — the repo does not import it directly — so the breaking changes only matter if @prisma/config (the consumer) is incompatible with v8. The full test suite (2288 tests across 126 files, per the PR body) and the Typecheck CI job both pass, which is strong evidence that Prisma's use of the library is compatible with v8.0.1. No direct usage of deepmerge-ts exists in the repo's source.

Standards Compliance

• The change follows the repository's documented override convention: pins live in the top-level overrides block, and the rationale is recorded in the "//" field because npm validates overrides entries strictly.
• No secrets, env files, or build output are committed.
• The PR is a dependency-update task, which AGENTS.md classifies as NORMAL-lane work; the change is scoped and testable.

Tool Harness Findings

• GitHub release data for deepmerge-ts confirms v8.0.1 (2026-08-16) is a bug-fix release on top of v8.0.0, and v8.0.0 (2026-08-16) is the major release containing the breaking changes and the security-relevant fixes. The resolved lockfile version 8.0.1 is the latest available.
• The GitHub advisory page for GHSA-ggr8-5vv4-36mx could not be fetched directly (the API endpoint returned 404 and the HTML fetch returned an unparseable page), so the advisory's exact affected-range and patched-version metadata could not be independently confirmed from the advisory itself. The PR body and the package.json rationale both cite the advisory ID and describe it as a stack-exhaustion issue; the npm audit CI check passing on the head commit is the authoritative confirmation that the override clears the finding.

Unknowns or Needs Verification

• The advisory page itself was not directly verifiable during this review (fetch/API 404). The passing npm audit CI check on the head commit is the primary evidence that the override resolves the finding; if the advisory page becomes available, it would be worth confirming the patched range includes 8.0.1.
• No host-platform compatibility matrix applies here: this is a pure npm dependency override, not a bump to a component that runs on a pinned host OS or alongside a pinned peer platform.

Must-Check Items

• Check for breaking API changes in updated dependencies: Verified. deepmerge-ts v8.0.0 has breaking changes, but the package is transitive-only (via prisma > @prisma/config); Typecheck and the full test suite pass, indicating no incompatibility with the consumer.
• Run full test suite after upgrade: Verified. The Tests CI check is green on the head commit, and the PR body reports 126 files / 2288 tests passing.

[its-saffron]

Info: The GHSA-ggr8-5vv4-36mx advisory page could not be fetched during review; the passing npm audit CI check is the authoritative confirmation that the override clears the finding.

Automated finding from AI PR review.

[joryirving]

Summary

• Add overrides.deepmerge-ts: ^8.0.0 to clear GHSA-ggr8-5vv4-36mx, and record the rationale in the existing "//" block.

Why

npm audit fails on main right now with 3 high-severity findings. deepmerge-ts reaches us transitively through prisma > @prisma/config, and npm's only advertised stable fix is downgrading prisma to 6.12.0, which is breaking — so an override is the cheaper path, consistent with how postcss and sharp are already handled.

The advisory published 2026-08-17T13:32:13Z, 48 minutes after main's last npm audit run passed at 12:44:47Z. So main's green check is stale rather than accurate, and every PR opened since has failed an audit for something it did not introduce.

That is not hypothetical: four open foreman PRs (#779, #780, #781, #783) each independently added their own copy of this same pin while trying to work unrelated issues. Fixing it once here removes the trigger.

Notes

• Renovate did not catch this, and the reason is worth recording: it sources vulnerabilities from Dependabot alerts, and those are disabled org-wide (dependabot_alerts_enabled_for_new_repositories: false, and the alerts endpoint returns an empty array for this repo). Renovate's scan logged "No vulnerability alerts found" and correctly did nothing. Enabling org-level alerts is the durable fix and is out of scope here.
• osvVulnerabilityAlerts would not have helped either — it covers direct dependencies only, and this is transitive.

Verification

• npm audit --omit=dev: 3 high → found 0 vulnerabilities
• npx tsc --noEmit: clean
• npm run test: 126 files, 2288 tests passing
• resolved version is deepmerge-ts@8.0.1

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This PR adds an npm overrides pin for deepmerge-ts ^8.0.0 to remediate GHSA-ggr8-5vv4-36mx, which reaches the repo transitively via prisma > @prisma/config. The change is minimal (package.json + lockfile), the rationale is documented in the existing "//" overrides block, and all CI checks — including npm audit, Typecheck, Lint, Tests, and Build — pass on the head commit.

Change-by-Change Findings

package.json

• Adds "deepmerge-ts": "^8.0.0" to the existing overrides block, alongside the pre-existing postcss and sharp pins. This is consistent with the repository's established pattern for remediating transitive advisories.
• The "//" rationale block is updated to explain the advisory (GHSA-ggr8-5vv4-36mx, stack exhaustion, published 2026-08-17), the transitive path (prisma > @prisma/config), and why an override is preferred over npm's only advertised stable fix (downgrading prisma to 6.12.0, which would be breaking). This matches the documented convention that overrides must not be removed without verifying the originating transitive deps have shipped patched versions.

package-lock.json

• deepmerge-ts resolves from 7.1.5 to 8.0.1 with a matching integrity hash and updated funding metadata. The lockfile change is consistent with the override.

Breaking-Change Assessment

The override forces deepmerge-ts from 7.1.5 to 8.0.1, and v8.0.0 is a major release with breaking changes (deep Map-value merging by default, renamed DeepMergeMetaMetaData/DeepMergeIntoFunctionUtils types, and deepmergeInto no longer leak-mutating inputs). However, deepmerge-ts is a transitive dependency here — the repo does not import it directly — so the breaking changes only matter if @prisma/config (the consumer) is incompatible with v8. The full test suite (2288 tests across 126 files, per the PR body) and the Typecheck CI job both pass, which is strong evidence that Prisma's use of the library is compatible with v8.0.1. No direct usage of deepmerge-ts exists in the repo's source.

Standards Compliance

• The change follows the repository's documented override convention: pins live in the top-level overrides block, and the rationale is recorded in the "//" field because npm validates overrides entries strictly.
• No secrets, env files, or build output are committed.
• The PR is a dependency-update task, which AGENTS.md classifies as NORMAL-lane work; the change is scoped and testable.

Tool Harness Findings

• GitHub release data for deepmerge-ts confirms v8.0.1 (2026-08-16) is a bug-fix release on top of v8.0.0, and v8.0.0 (2026-08-16) is the major release containing the breaking changes and the security-relevant fixes. The resolved lockfile version 8.0.1 is the latest available.
• The GitHub advisory page for GHSA-ggr8-5vv4-36mx could not be fetched directly (the API endpoint returned 404 and the HTML fetch returned an unparseable page), so the advisory's exact affected-range and patched-version metadata could not be independently confirmed from the advisory itself. The PR body and the package.json rationale both cite the advisory ID and describe it as a stack-exhaustion issue; the npm audit CI check passing on the head commit is the authoritative confirmation that the override clears the finding.

Unknowns or Needs Verification

• The advisory page itself was not directly verifiable during this review (fetch/API 404). The passing npm audit CI check on the head commit is the primary evidence that the override resolves the finding; if the advisory page becomes available, it would be worth confirming the patched range includes 8.0.1.
• No host-platform compatibility matrix applies here: this is a pure npm dependency override, not a bump to a component that runs on a pinned host OS or alongside a pinned peer platform.

Must-Check Items

• Check for breaking API changes in updated dependencies: Verified. deepmerge-ts v8.0.0 has breaking changes, but the package is transitive-only (via prisma > @prisma/config); Typecheck and the full test suite pass, indicating no incompatibility with the consumer.
• Run full test suite after upgrade: Verified. The Tests CI check is green on the head commit, and the PR body reports 126 files / 2288 tests passing.

[its-saffron]

Info: The GHSA-ggr8-5vv4-36mx advisory page could not be fetched during review; the passing npm audit CI check is the authoritative confirmation that the override clears the finding.

Automated finding from AI PR review.

[joryirving]

Summary

• Add overrides.deepmerge-ts: ^8.0.0 to clear GHSA-ggr8-5vv4-36mx, and record the rationale in the existing "//" block.

Why

npm audit fails on main right now with 3 high-severity findings. deepmerge-ts reaches us transitively through prisma > @prisma/config, and npm's only advertised stable fix is downgrading prisma to 6.12.0, which is breaking — so an override is the cheaper path, consistent with how postcss and sharp are already handled.

The advisory published 2026-08-17T13:32:13Z, 48 minutes after main's last npm audit run passed at 12:44:47Z. So main's green check is stale rather than accurate, and every PR opened since has failed an audit for something it did not introduce.

That is not hypothetical: four open foreman PRs (#779, #780, #781, #783) each independently added their own copy of this same pin while trying to work unrelated issues. Fixing it once here removes the trigger.

Notes

• Renovate did not catch this, and the reason is worth recording: it sources vulnerabilities from Dependabot alerts, and those are disabled org-wide (dependabot_alerts_enabled_for_new_repositories: false, and the alerts endpoint returns an empty array for this repo). Renovate's scan logged "No vulnerability alerts found" and correctly did nothing. Enabling org-level alerts is the durable fix and is out of scope here.
• osvVulnerabilityAlerts would not have helped either — it covers direct dependencies only, and this is transitive.

Verification

• npm audit --omit=dev: 3 high → found 0 vulnerabilities
• npx tsc --noEmit: clean
• npm run test: 126 files, 2288 tests passing
• resolved version is deepmerge-ts@8.0.1

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This PR adds an npm overrides pin for deepmerge-ts ^8.0.0 to remediate GHSA-ggr8-5vv4-36mx, which reaches the repo transitively via prisma > @prisma/config. The change is minimal (package.json + lockfile), the rationale is documented in the existing "//" overrides block, and all CI checks — including npm audit, Typecheck, Lint, Tests, and Build — pass on the head commit.

Change-by-Change Findings

package.json

• Adds "deepmerge-ts": "^8.0.0" to the existing overrides block, alongside the pre-existing postcss and sharp pins. This is consistent with the repository's established pattern for remediating transitive advisories.
• The "//" rationale block is updated to explain the advisory (GHSA-ggr8-5vv4-36mx, stack exhaustion, published 2026-08-17), the transitive path (prisma > @prisma/config), and why an override is preferred over npm's only advertised stable fix (downgrading prisma to 6.12.0, which would be breaking). This matches the documented convention that overrides must not be removed without verifying the originating transitive deps have shipped patched versions.

package-lock.json

• deepmerge-ts resolves from 7.1.5 to 8.0.1 with a matching integrity hash and updated funding metadata. The lockfile change is consistent with the override.

Breaking-Change Assessment

The override forces deepmerge-ts from 7.1.5 to 8.0.1, and v8.0.0 is a major release with breaking changes (deep Map-value merging by default, renamed DeepMergeMetaMetaData/DeepMergeIntoFunctionUtils types, and deepmergeInto no longer leak-mutating inputs). However, deepmerge-ts is a transitive dependency here — the repo does not import it directly — so the breaking changes only matter if @prisma/config (the consumer) is incompatible with v8. The full test suite (2288 tests across 126 files, per the PR body) and the Typecheck CI job both pass, which is strong evidence that Prisma's use of the library is compatible with v8.0.1. No direct usage of deepmerge-ts exists in the repo's source.

Standards Compliance

• The change follows the repository's documented override convention: pins live in the top-level overrides block, and the rationale is recorded in the "//" field because npm validates overrides entries strictly.
• No secrets, env files, or build output are committed.
• The PR is a dependency-update task, which AGENTS.md classifies as NORMAL-lane work; the change is scoped and testable.

Tool Harness Findings

• GitHub release data for deepmerge-ts confirms v8.0.1 (2026-08-16) is a bug-fix release on top of v8.0.0, and v8.0.0 (2026-08-16) is the major release containing the breaking changes and the security-relevant fixes. The resolved lockfile version 8.0.1 is the latest available.
• The GitHub advisory page for GHSA-ggr8-5vv4-36mx could not be fetched directly (the API endpoint returned 404 and the HTML fetch returned an unparseable page), so the advisory's exact affected-range and patched-version metadata could not be independently confirmed from the advisory itself. The PR body and the package.json rationale both cite the advisory ID and describe it as a stack-exhaustion issue; the npm audit CI check passing on the head commit is the authoritative confirmation that the override clears the finding.

Unknowns or Needs Verification

• The advisory page itself was not directly verifiable during this review (fetch/API 404). The passing npm audit CI check on the head commit is the primary evidence that the override resolves the finding; if the advisory page becomes available, it would be worth confirming the patched range includes 8.0.1.
• No host-platform compatibility matrix applies here: this is a pure npm dependency override, not a bump to a component that runs on a pinned host OS or alongside a pinned peer platform.

Must-Check Items

• Check for breaking API changes in updated dependencies: Verified. deepmerge-ts v8.0.0 has breaking changes, but the package is transitive-only (via prisma > @prisma/config); Typecheck and the full test suite pass, indicating no incompatibility with the consumer.
• Run full test suite after upgrade: Verified. The Tests CI check is green on the head commit, and the PR body reports 126 files / 2288 tests passing.

[its-saffron]

Info: The GHSA-ggr8-5vv4-36mx advisory page could not be fetched during review; the passing npm audit CI check is the authoritative confirmation that the override clears the finding.

Automated finding from AI PR review.

[joryirving]

Summary

• Add overrides.deepmerge-ts: ^8.0.0 to clear GHSA-ggr8-5vv4-36mx, and record the rationale in the existing "//" block.

Why

npm audit fails on main right now with 3 high-severity findings. deepmerge-ts reaches us transitively through prisma > @prisma/config, and npm's only advertised stable fix is downgrading prisma to 6.12.0, which is breaking — so an override is the cheaper path, consistent with how postcss and sharp are already handled.

The advisory published 2026-08-17T13:32:13Z, 48 minutes after main's last npm audit run passed at 12:44:47Z. So main's green check is stale rather than accurate, and every PR opened since has failed an audit for something it did not introduce.

That is not hypothetical: four open foreman PRs (#779, #780, #781, #783) each independently added their own copy of this same pin while trying to work unrelated issues. Fixing it once here removes the trigger.

Notes

• Renovate did not catch this, and the reason is worth recording: it sources vulnerabilities from Dependabot alerts, and those are disabled org-wide (dependabot_alerts_enabled_for_new_repositories: false, and the alerts endpoint returns an empty array for this repo). Renovate's scan logged "No vulnerability alerts found" and correctly did nothing. Enabling org-level alerts is the durable fix and is out of scope here.
• osvVulnerabilityAlerts would not have helped either — it covers direct dependencies only, and this is transitive.

Verification

• npm audit --omit=dev: 3 high → found 0 vulnerabilities
• npx tsc --noEmit: clean
• npm run test: 126 files, 2288 tests passing
• resolved version is deepmerge-ts@8.0.1

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This PR adds an npm overrides pin for deepmerge-ts ^8.0.0 to remediate GHSA-ggr8-5vv4-36mx, which reaches the repo transitively via prisma > @prisma/config. The change is minimal (package.json + lockfile), the rationale is documented in the existing "//" overrides block, and all CI checks — including npm audit, Typecheck, Lint, Tests, and Build — pass on the head commit.

Change-by-Change Findings

package.json

• Adds "deepmerge-ts": "^8.0.0" to the existing overrides block, alongside the pre-existing postcss and sharp pins. This is consistent with the repository's established pattern for remediating transitive advisories.
• The "//" rationale block is updated to explain the advisory (GHSA-ggr8-5vv4-36mx, stack exhaustion, published 2026-08-17), the transitive path (prisma > @prisma/config), and why an override is preferred over npm's only advertised stable fix (downgrading prisma to 6.12.0, which would be breaking). This matches the documented convention that overrides must not be removed without verifying the originating transitive deps have shipped patched versions.

package-lock.json

• deepmerge-ts resolves from 7.1.5 to 8.0.1 with a matching integrity hash and updated funding metadata. The lockfile change is consistent with the override.

Breaking-Change Assessment

The override forces deepmerge-ts from 7.1.5 to 8.0.1, and v8.0.0 is a major release with breaking changes (deep Map-value merging by default, renamed DeepMergeMetaMetaData/DeepMergeIntoFunctionUtils types, and deepmergeInto no longer leak-mutating inputs). However, deepmerge-ts is a transitive dependency here — the repo does not import it directly — so the breaking changes only matter if @prisma/config (the consumer) is incompatible with v8. The full test suite (2288 tests across 126 files, per the PR body) and the Typecheck CI job both pass, which is strong evidence that Prisma's use of the library is compatible with v8.0.1. No direct usage of deepmerge-ts exists in the repo's source.

Standards Compliance

• The change follows the repository's documented override convention: pins live in the top-level overrides block, and the rationale is recorded in the "//" field because npm validates overrides entries strictly.
• No secrets, env files, or build output are committed.
• The PR is a dependency-update task, which AGENTS.md classifies as NORMAL-lane work; the change is scoped and testable.

Tool Harness Findings

• GitHub release data for deepmerge-ts confirms v8.0.1 (2026-08-16) is a bug-fix release on top of v8.0.0, and v8.0.0 (2026-08-16) is the major release containing the breaking changes and the security-relevant fixes. The resolved lockfile version 8.0.1 is the latest available.
• The GitHub advisory page for GHSA-ggr8-5vv4-36mx could not be fetched directly (the API endpoint returned 404 and the HTML fetch returned an unparseable page), so the advisory's exact affected-range and patched-version metadata could not be independently confirmed from the advisory itself. The PR body and the package.json rationale both cite the advisory ID and describe it as a stack-exhaustion issue; the npm audit CI check passing on the head commit is the authoritative confirmation that the override clears the finding.

Unknowns or Needs Verification

• The advisory page itself was not directly verifiable during this review (fetch/API 404). The passing npm audit CI check on the head commit is the primary evidence that the override resolves the finding; if the advisory page becomes available, it would be worth confirming the patched range includes 8.0.1.
• No host-platform compatibility matrix applies here: this is a pure npm dependency override, not a bump to a component that runs on a pinned host OS or alongside a pinned peer platform.

Must-Check Items

• Check for breaking API changes in updated dependencies: Verified. deepmerge-ts v8.0.0 has breaking changes, but the package is transitive-only (via prisma > @prisma/config); Typecheck and the full test suite pass, indicating no incompatibility with the consumer.
• Run full test suite after upgrade: Verified. The Tests CI check is green on the head commit, and the PR body reports 126 files / 2288 tests passing.

[its-saffron]

Info: The GHSA-ggr8-5vv4-36mx advisory page could not be fetched during review; the passing npm audit CI check is the authoritative confirmation that the override clears the finding.

Automated finding from AI PR review.

[joryirving]

Summary

• Add overrides.deepmerge-ts: ^8.0.0 to clear GHSA-ggr8-5vv4-36mx, and record the rationale in the existing "//" block.

Why

npm audit fails on main right now with 3 high-severity findings. deepmerge-ts reaches us transitively through prisma > @prisma/config, and npm's only advertised stable fix is downgrading prisma to 6.12.0, which is breaking — so an override is the cheaper path, consistent with how postcss and sharp are already handled.

The advisory published 2026-08-17T13:32:13Z, 48 minutes after main's last npm audit run passed at 12:44:47Z. So main's green check is stale rather than accurate, and every PR opened since has failed an audit for something it did not introduce.

That is not hypothetical: four open foreman PRs (#779, #780, #781, #783) each independently added their own copy of this same pin while trying to work unrelated issues. Fixing it once here removes the trigger.

Notes

• Renovate did not catch this, and the reason is worth recording: it sources vulnerabilities from Dependabot alerts, and those are disabled org-wide (dependabot_alerts_enabled_for_new_repositories: false, and the alerts endpoint returns an empty array for this repo). Renovate's scan logged "No vulnerability alerts found" and correctly did nothing. Enabling org-level alerts is the durable fix and is out of scope here.
• osvVulnerabilityAlerts would not have helped either — it covers direct dependencies only, and this is transitive.

Verification

• npm audit --omit=dev: 3 high → found 0 vulnerabilities
• npx tsc --noEmit: clean
• npm run test: 126 files, 2288 tests passing
• resolved version is deepmerge-ts@8.0.1

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This PR adds an npm overrides pin for deepmerge-ts ^8.0.0 to remediate GHSA-ggr8-5vv4-36mx, which reaches the repo transitively via prisma > @prisma/config. The change is minimal (package.json + lockfile), the rationale is documented in the existing "//" overrides block, and all CI checks — including npm audit, Typecheck, Lint, Tests, and Build — pass on the head commit.

Change-by-Change Findings

package.json

• Adds "deepmerge-ts": "^8.0.0" to the existing overrides block, alongside the pre-existing postcss and sharp pins. This is consistent with the repository's established pattern for remediating transitive advisories.
• The "//" rationale block is updated to explain the advisory (GHSA-ggr8-5vv4-36mx, stack exhaustion, published 2026-08-17), the transitive path (prisma > @prisma/config), and why an override is preferred over npm's only advertised stable fix (downgrading prisma to 6.12.0, which would be breaking). This matches the documented convention that overrides must not be removed without verifying the originating transitive deps have shipped patched versions.

package-lock.json

• deepmerge-ts resolves from 7.1.5 to 8.0.1 with a matching integrity hash and updated funding metadata. The lockfile change is consistent with the override.

Breaking-Change Assessment

The override forces deepmerge-ts from 7.1.5 to 8.0.1, and v8.0.0 is a major release with breaking changes (deep Map-value merging by default, renamed DeepMergeMetaMetaData/DeepMergeIntoFunctionUtils types, and deepmergeInto no longer leak-mutating inputs). However, deepmerge-ts is a transitive dependency here — the repo does not import it directly — so the breaking changes only matter if @prisma/config (the consumer) is incompatible with v8. The full test suite (2288 tests across 126 files, per the PR body) and the Typecheck CI job both pass, which is strong evidence that Prisma's use of the library is compatible with v8.0.1. No direct usage of deepmerge-ts exists in the repo's source.

Standards Compliance

• The change follows the repository's documented override convention: pins live in the top-level overrides block, and the rationale is recorded in the "//" field because npm validates overrides entries strictly.
• No secrets, env files, or build output are committed.
• The PR is a dependency-update task, which AGENTS.md classifies as NORMAL-lane work; the change is scoped and testable.

Tool Harness Findings

• GitHub release data for deepmerge-ts confirms v8.0.1 (2026-08-16) is a bug-fix release on top of v8.0.0, and v8.0.0 (2026-08-16) is the major release containing the breaking changes and the security-relevant fixes. The resolved lockfile version 8.0.1 is the latest available.
• The GitHub advisory page for GHSA-ggr8-5vv4-36mx could not be fetched directly (the API endpoint returned 404 and the HTML fetch returned an unparseable page), so the advisory's exact affected-range and patched-version metadata could not be independently confirmed from the advisory itself. The PR body and the package.json rationale both cite the advisory ID and describe it as a stack-exhaustion issue; the npm audit CI check passing on the head commit is the authoritative confirmation that the override clears the finding.

Unknowns or Needs Verification

• The advisory page itself was not directly verifiable during this review (fetch/API 404). The passing npm audit CI check on the head commit is the primary evidence that the override resolves the finding; if the advisory page becomes available, it would be worth confirming the patched range includes 8.0.1.
• No host-platform compatibility matrix applies here: this is a pure npm dependency override, not a bump to a component that runs on a pinned host OS or alongside a pinned peer platform.

Must-Check Items

• Check for breaking API changes in updated dependencies: Verified. deepmerge-ts v8.0.0 has breaking changes, but the package is transitive-only (via prisma > @prisma/config); Typecheck and the full test suite pass, indicating no incompatibility with the consumer.
• Run full test suite after upgrade: Verified. The Tests CI check is green on the head commit, and the PR body reports 126 files / 2288 tests passing.

[its-saffron]

Info: The GHSA-ggr8-5vv4-36mx advisory page could not be fetched during review; the passing npm audit CI check is the authoritative confirmation that the override clears the finding.

Automated finding from AI PR review.