Skip to content
verdict:

Prisma 7.10.0

notable

Release notes

ok: safe to upgrade

0 breaking changes5 key points

Adds @prisma/prisma7 so Prisma 7 can run beside Prisma 8, and hardens Prisma Studio's local server.

summary · from the release notes only · claude-haiku-5-5 · prompt v7

key points

release-notesgithub.com/prisma/orm · 160 lines
  1. # Prisma ORM 7.10.0
  3. Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.
  5. ## Highlights
  7. ### Run Prisma 7 alongside Prisma 8
  9. This release introduces `@prisma/prisma7`, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.
  11. Once 7.10.0 is released, a side-by-side installation can use:
  13. ```sh
  14. npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
  15. npm install @prisma/client@7.10.0
  16. ```
  18. Use `prisma` for the directly installed Prisma 8 CLI and `prisma7` for Prisma 7:
  20. ```sh
  21. npx prisma --version
  22. npx prisma7 --version
  24. npx prisma7 generate
  25. npx prisma7 migrate dev
  26. npx prisma7 db push
  27. ```
  29. Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's `prisma.config.*` files:
  31. ```ts
  32. // prisma7.config.ts
  33. import { defineConfig } from '@prisma/prisma7/config'
  35. export default defineConfig({
  36. schema: 'prisma/schema.prisma',
  37. migrations: {
  38. path: 'prisma/migrations',
  39. },
  40. })
  41. ```
  43. Without an explicit `--config` option, Prisma 7 searches for:
  45. 1. Root-level `prisma7.config.*` files.
  46. 2. `.config/prisma7.*` files.
  47. 3. Existing `prisma.config.*` files as a backwards-compatible fallback.
  49. The supported extensions are `.js`, `.ts`, `.mjs`, `.cjs`, `.mts`, and `.cts`. An explicit config path always takes precedence:
  51. ```sh
  52. npx prisma7 generate --config ./custom/prisma7.config.ts
  53. ```
  55. New projects initialized by the Prisma 7 CLI use `prisma7.config.ts`. Existing projects containing only `prisma.config.*` continue to work without migration or additional warnings. If a `prisma7.config.*` file exists but cannot be loaded, Prisma reports the error rather than silently falling back to another configuration.
  57. The `prisma7` identity is carried through CLI help, version output, shell completion, initialization, migration, database, and generation guidance. Stable Prisma concepts such as `schema.prisma`, Prisma Migrate, `@prisma/client`, and `PRISMA_*` environment variables remain unchanged.
  59. Together, the separate executable and configuration namespace make it possible to operate Prisma 7 and Prisma 8 side by side without command or config-file collisions.
  61. [#29949](https://github.com/prisma/prisma/pull/29949), [#29969](https://github.com/prisma/prisma/pull/29969), [#29994](https://github.com/prisma/prisma/pull/29994), [#30000](https://github.com/prisma/prisma/pull/30000), [#30002](https://github.com/prisma/prisma/pull/30002), [#30020](https://github.com/prisma/prisma/pull/30020)
  63. ### Prisma Studio security hardening
  65. Prisma Studio's local HTTP server now:
  67. - Binds explicitly to `127.0.0.1` instead of all network interfaces.
  68. - Rejects browser requests from origins other than the active `localhost` or `127.0.0.1` Studio URL.
  69. - No longer returns wildcard CORS headers.
  70. - Applies the same protections across Node.js, Bun, and Deno.
  72. This prevents network clients or malicious websites from accessing Studio's database endpoints while Studio is running.
  74. [#29890](https://github.com/prisma/prisma/pull/29890)
  76. ## Prisma Client
  78. - Fixed `P2002` errors from nested writes so `meta.modelName` identifies the model where the unique constraint violation occurred, including models using `@@map` and `@@schema`. [#29628](https://github.com/prisma/prisma/pull/29628)
  79. - Fixed automatically batched `findUniqueOrThrow()` calls so every missing record rejects with `P2025`; later misses no longer resolve to `undefined`. [#29654](https://github.com/prisma/prisma/pull/29654)
  80. - Parameter-chunked statements are now executed atomically in a transaction and rolled back if a later chunk fails. [#29771](https://github.com/prisma/prisma/pull/29771)
  81. - Improved interactive transaction cleanup during `$disconnect()`, including transactions whose driver-level startup is still in progress. [#28768](https://github.com/prisma/prisma/pull/28768)
  82. - Prevented transaction cleanup failures after a timeout or backend termination from becoming unhandled promise rejections. [#29611](https://github.com/prisma/prisma/pull/29611)
  83. - Fixed fluent relation queries when relation fields are literally named `select` or `include`. [#29683](https://github.com/prisma/prisma/pull/29683)
  84. - Fixed handling of `Date` and `Uint8Array` values created in other JavaScript realms, such as iframes, jsdom, and Node.js `vm` contexts. [#29177](https://github.com/prisma/prisma/pull/29177)
  85. - Invalid `Date` values passed to `$queryRaw` or `$executeRaw` now throw `PrismaClientValidationError` instead of a generic error. [#29718](https://github.com/prisma/prisma/pull/29718)
  86. - Fixed `moduleFormat` inference for the `prisma-client` generator in TypeScript projects using `module: "node16"` or `"nodenext"`. Generated output now follows the nearest `package.json` `type`, defaulting to CommonJS when absent. [#29712](https://github.com/prisma/prisma/pull/29712)
  87. - Deserialized `Bytes` values now own standalone `ArrayBuffer`s rather than exposing unrelated contents from Node.js's shared `Buffer` pool. This applies to both regular and raw query results. [#29701](https://github.com/prisma/prisma/pull/29701)
  88. - Fixed an incorrect logging context in the remote executor, including Accelerate-backed query execution. [#28892](https://github.com/prisma/prisma/pull/28892)
  90. ## Client extensions and observability
  92. - Result-extension `compute` callbacks now receive the current model name as a typed second argument:
  94. ```ts
  95. compute(data, modelName) {
  96. // ...
  97. }
  98. ```
  100. The model name is also preserved when multiple extensions compose the same computed field. [#29782](https://github.com/prisma/prisma/pull/29782)
  102. - Improved OpenTelemetry context for remotely executed queries:
  103. - `$on('query')` callbacks run within the matching `db_query` span.
  104. - Events from one operation share the same trace.
  105. - Error events are recorded as span exceptions.
  106. - Log events continue to be emitted when tracing is disabled or their reported span is unavailable.
  108. [#28892](https://github.com/prisma/prisma/pull/28892)
  110. ## Driver adapters
  112. ### MariaDB
  114. - `@prisma/adapter-mariadb` now accepts an existing `mariadb` pool. External pools remain caller-owned unless `disposeExternalPool: true` is supplied. [#27992](https://github.com/prisma/prisma/pull/27992)
  115. - Fixed pooled connection leaks during commit, rollback, and failed transaction startup. Connections are now returned with `release()` and transaction-specific listeners are removed before reuse. [#29612](https://github.com/prisma/prisma/pull/29612)
  116. - Added support for bracketed IPv6 addresses in both `mysql://` and `mariadb://` connection strings. [#29026](https://github.com/prisma/prisma/pull/29026)
  117. - Prevented malformed connection strings from exposing embedded passwords in retained debug output and diagnostic reports. [#27992](https://github.com/prisma/prisma/pull/27992)
  119. ### PostgreSQL, Neon, and Prisma Postgres Serverless
  121. - PostgreSQL deadlocks using SQLSTATE `40P01` are now reported as `P2034` transaction write conflicts. [#29717](https://github.com/prisma/prisma/pull/29717)
  122. - PostgreSQL `RESTRICT` violations using SQLSTATE `23001` are now reported as `P2003`, preserving an available field or constraint name. [#29554](https://github.com/prisma/prisma/pull/29554)
  123. - `@prisma/adapter-pg` now preserves database constraint names when reporting unique constraint violations through `P2002`. [#29587](https://github.com/prisma/prisma/pull/29587)
  124. - Prisma Postgres Serverless now prefers the named constraint for `P2002`, falling back to parsed field names when no constraint name is available. [#29801](https://github.com/prisma/prisma/pull/29801)
  125. - Fixed Neon HTTP adapter serialization for typed parameters such as `Bytes` and `DateTime`. [#29747](https://github.com/prisma/prisma/pull/29747)
  127. ### SQLite
  129. - `@prisma/adapter-better-sqlite3` now converts previously unhandled SQLite result codes into typed database errors instead of exposing raw driver errors.
  130. - The complete `SQLITE_BUSY` family is now mapped to socket timeout errors, with numeric extended result codes preserved where available.
  132. [#29794](https://github.com/prisma/prisma/pull/29794)
  134. ## CLI and Migrate
  136. - `prisma generate` can now offer to install Prisma's agent skills. The opt-in prompt:
  137. - Is shown at most once per machine.
  138. - Is skipped in CI, containers, Git hooks, npm lifecycle scripts, and watch mode.
  139. - Is skipped when `--no-hints` is used or Prisma skills are already installed.
  140. - Times out after 30 seconds.
  141. - Never causes generation to fail if installation is unsuccessful.
  143. [#29690](https://github.com/prisma/prisma/pull/29690)
  145. - A globally installed CLI now warns during `prisma generate` when its version differs from the project's local `prisma` or `@prisma/client`, and recommends running the local CLI. The check is best-effort and does not fail generation. [#29593](https://github.com/prisma/prisma/pull/29593)
  146. - `prisma version` and `prisma version --json` now include the resolved Prisma CLI package path, making global-versus-local installation issues easier to diagnose. [#29573](https://github.com/prisma/prisma/pull/29573)
  147. - Empty or generator-only schema files now report `Schema must contain a datasource block` from `db pull`, `db push`, and `migrate dev`, rather than reaching the schema engine and potentially producing inconsistent errors. [#29657](https://github.com/prisma/prisma/pull/29657)
  148. - CLI commands now tolerate corrupt, unreadable, or unwritable command-state files. Invalid state is reinitialized, writes are atomic, and persistence failures fall back to in-memory state. [#29609](https://github.com/prisma/prisma/pull/29609)
  149. - Studio now recognizes semicolon-delimited `sqlserver://` connection strings before reporting the existing explicit message that SQL Server is not supported by Studio. [#29623](https://github.com/prisma/prisma/pull/29623)
  150. - The AI-agent safety checkpoint now also covers interactive `prisma db push` confirmations involving data-loss warnings, rather than only invocations using `--accept-data-loss`. [#29793](https://github.com/prisma/prisma/pull/29793)
  152. ## Performance and reliability
  154. - Optimized query-plan execution by eagerly evaluating plans with one unconditional database operation and synchronously interpreting the remaining pure plan. Cached plans remain immutable. [#29004](https://github.com/prisma/prisma/pull/29004)
  155. - Prevented call-stack overflows when rendering very large parameter lists or combining chunked results containing hundreds of thousands of rows. [#29751](https://github.com/prisma/prisma/pull/29751)
  156. - Reduced ordinary query setup overhead by constructing fluent-relation field maps lazily and in linear time. Non-fluent queries no longer build this map. [#29752](https://github.com/prisma/prisma/pull/29752)
  158. ## Dependencies
  160. - Updated the transitive `fast-uri` dependency to a patched release addressing production audit advisories affecting versions through `3.1.3`. [#29758](https://github.com/prisma/prisma/pull/29758)

view on githubimported 2026-09-28 via npm