fix: update auto merge on patch or minor#141
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/auto-merge-on-patch-or-minor
branch
from
July 12, 2026 22:49
7f1393a to
cdd8d16
Compare
renovate
Bot
force-pushed
the
renovate/auto-merge-on-patch-or-minor
branch
from
July 13, 2026 12:34
cdd8d16 to
af9e262
Compare
renovate
Bot
force-pushed
the
renovate/auto-merge-on-patch-or-minor
branch
9 times, most recently
from
July 20, 2026 03:56
4201c73 to
d3827b8
Compare
renovate
Bot
force-pushed
the
renovate/auto-merge-on-patch-or-minor
branch
6 times, most recently
from
July 22, 2026 23:15
72dc8d2 to
7e794a1
Compare
renovate
Bot
force-pushed
the
renovate/auto-merge-on-patch-or-minor
branch
from
July 23, 2026 19:38
7e794a1 to
07fd881
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
11.2.0→11.2.2^2.0.8→^2.0.10^7.8.0→^7.9.0^7.8.0→^7.9.0^7.8.0→^7.9.010.6.0→10.7.0^4.12.28→^4.12.31^8.1.2→^8.2.16.25.0→6.27.017.0.8→17.1.011.10.0→11.15.111.10.0→11.15.13.9.4→3.9.57.8.0→7.9.0Release Notes
ardatan/graphql-tools (@graphql-tools/utils)
v11.2.2Compare Source
Patch Changes
e90719bThanks @pbomb! - fix mergeDeep to treat explicit undefined property
values as overrides rather than skipping them, distinct from an absent property
v11.2.1Compare Source
Patch Changes
615c1a2Thanks @pbomb! - fix mergeDeep to treat null property values as
explicit overrides rather than skipping them
honojs/node-server (@hono/node-server)
v2.0.10Compare Source
Security fixes
This release includes a fix for the following security issue:
Unauthenticated memory-leak DoS via aborted WebSocket handshake
Affects:
upgradeWebSocket. A WebSocket upgrade request with a missing or malformedSec-WebSocket-Keyheader leaked the request'sIncomingMessageand left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cggUsers of
upgradeWebSocketare encouraged to upgrade to this version.v2.0.9Compare Source
What's Changed
New Contributors
Full Changelog: honojs/node-server@v2.0.8...v2.0.9
prisma/prisma (@prisma/adapter-pg)
v7.9.0Compare Source
Today, we are excited to share the
7.9.0stable release 🎉🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!
Highlights
ORM
Tab completions for the Prisma CLI
Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for
bash,zsh,fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.Setting it up. Most projects run Prisma through a package manager, so completions are enabled through
@bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:@bomb.sh/tabdelegates to any locally-installed CLI that ships completions, sopnpm prisma <TAB>,pnpm exec prisma <TAB>,yarn prisma <TAB>, andbun x prisma <TAB>all complete Prisma's commands, options, and values — no per-project setup. (npxandbunxdon't support completion themselves; usenpm execandbun x.)If instead you have Prisma installed globally on your
PATH, source its own completion directly:source <(prisma complete zsh)(or thebash/fish/powershellvariant).This is built on
@bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @AmirSa12 (#28351) — thank you!prisma.mp4
Prisma ORM, ready for AI agents
Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.
Agent skills installed with
prisma init(#29689)prisma initnow installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with--no-skills.A safer default around destructive commands (#29684, #29691, #29713)
Prisma's AI safety checkpoint refuses to run destructive commands when it detects that an AI agent is at the keyboard, unless the user has given explicit consent. In this release we:
AI_AGENT/AGENTconventions so future agents are caught without a code change.db push --accept-data-loss, which previously bypassed the checkpoint even though it can drop data.migrate-resettool from theprisma mcpserver entirely — resetting a database drops it, and that is not an operation an agent should be handed as a first-class tool. An agent that needs a reset must run the CLI, where the checkpoint applies.Bug Fixes
Many of the fixes below are community contributions — thank you to everyone who reported and fixed these!
Prisma Client
OmitOptsgeneric default letstscreuse cached type instantiations again, bringing type-checking on large schemas back from minutes to seconds (#29592, from @nfl1ryxditimo12).XORtype helper now rejects primitive values such asdata: 5, which were previously accepted at compile time even though the runtime rejected them (#29735, from @kyungseopk1m).$queryRawand$executeRawnow fail fast with a clear validation error when passed an invalidDate, instead of silently serializing it asnulland corrupting the value sent to the database (#29697, from @jibin7jose).///documentation comment that contains a*/sequence; the comment terminator is now escaped when doc comments are emitted, in both the TypeScript and JavaScript generators (#29736, from @kyungseopk1m).PrismaClientconstructor; both now include a copy-pasteable example and a link to the driver adapters docs (#29624).P2039(PrismaClientKnownRequestError) carrying the original code and message, instead of an opaque failure, which keeps schema-drift-style problems debuggable (#29512).prisma-client-jsgenerator no longer emits a strayundefinedstatement when generating from a schema that declares only enums or types and no models (#29738, from @kyungseopk1m).maxWait) while it is still starting: the discarded transaction now sends an explicitROLLBACKbefore the connection is returned to the pool, instead of releasing it mid-transaction. Previously, on adapters like@prisma/adapter-pgand@prisma/adapter-neon, the next query to reuse that connection could fail withthere is already a transaction in progress— or silently commit the leaked transaction's work (#29727, from @lazerg).CLI
prisma validate(and other schema-loading commands) no longer hangs forever on a multi-file schema whose directories contain a symlink cycle, and no longer reports the same file twice when a directory is reachable under two spellings (e.g./tmp→/private/tmpon macOS) (#29740, from @kyungseopk1m).%APPDATA%\Prisma) instead of acwd-relativenode_modules\.cache, which eliminated duplicate cache directories and the bloated Serverless/Docker bundles they caused (#29730, from @santichausis; closes #22574, #6670, #11577).Driver Adapters
Bytescolumn no longer emits Node.js'DEP0005deprecation warning, thanks to an upstreampostgres-byteabump (#29538, from @kolia-zamnius).ColumnNotFound(P2022) errors now parse both quoted and unquoted PostgreSQL column names, including identifiers containing spaces, matching the fix previously applied toadapter-pg(#29737, from @kyungseopk1m).Bytes?(@db.VarBinary) field tonullno longer fails with an implicit-conversion error; the adapter now sends the parameter typed asVarBinaryinstead of letting SQL Server default it tonvarchar(#29630, from @AnupamKumar-1).Schema Engine
prisma migrate statusnow reports a rolled-back migration that still exists on disk as unapplied, instead of incorrectly treating the schema as up to date (prisma/prisma-engines#5817, from @goutamadwant).ALTER TABLEstatements on PostgreSQL, avoiding a database error when a single table has multiple changes in one migration (prisma/prisma-engines#4906, from @eruditmorina).Security
honosecurity advisories at their source:@prisma/devwas updated to a version that no longer depends onhonoat all, so the CLI is no longer exposed to those advisories through that path. We also patched moderate-severity advisories inajvanduuidacross production dependencies (#29514).~/.config/prisma-platform/auth.json) and its directory to0o600/0o700so OAuth tokens are no longer world-readable, bringing Prisma in line with the GitHub, AWS, and Google Cloud CLIs (#29568, from Jaeyoung Yun).opensslcrate in the schema engine binaries from 0.10.74 to 0.10.81 (prisma/prisma-engines#5815).Prisma Studio
The bundled Prisma Studio moves from
0.27.3to0.33.0(#29720), gathering up everything shipped in the Studio releases in between.Migrations view
Studio can now visualise your migration history. This view is powered by Prisma Next — the next major version of Prisma ORM, a full TypeScript rewrite (available now in Early Access) that keeps the schema-first workflow and model-first queries you know, but treats your schema as a versioned, inspectable contract instead of compiling it into a heavy generated client. Prisma Next records every migration and its contract snapshots in the database, and Studio reads them to draw the timeline and diff below. Databases managed with classic Prisma Migrate don't carry this ledger, so the view simply stays hidden there.
When the connected database has a Prisma Next migration ledger, a Migrations entry appears in the sidebar: a newest-first timeline of every applied migration with its name, apply time, operation count, and compact chips summarizing what changed (
+2 models,~2 models +3 fields,+1 model, …). Selecting a migration opens a visual, FigJam-style diff canvas — added, removed, and changed models as colour-coded cards (NEW/UPDATED/UNCHANGED) with per-field before → after details, enum cards, and relation edges — next to a SQL panel of the executed statements and a Prisma-schema line diff. Switching migrations morphs the canvas rather than rebuilding it.Prisma Streams browser
Studio gains first-class support for Prisma Streams: a dedicated stream browser, live stream aggregations, stream diagnostics, routing-key browsing, and a WAL-history handoff straight from your tables, plus richer stream request observability with concise event-log and OpenTelemetry span summaries.
Working with SQL
Fixes
Thanks to our contributors
A heartfelt thank you to the community members whose contributions shaped this release:
@AmirSa12, @kyungseopk1m, @nfl1ryxditimo12, @jibin7jose, @santichausis, @kolia-zamnius, @goutamadwant, @eruditmorina, @lazerg, @AnupamKumar-1, @Swapanrishi, @anupamme, and @oyi77.
Prisma Compute is now in public beta
"Push code, it runs." Prisma Compute — managed hosting for TypeScript apps that run right next to your database — is now available in public beta, and free to use while the beta lasts.
Compute deploys your app as a long-lived process on Bun, colocated with your Prisma Postgres database, so there are no cold starts, no request timeouts, and no separate hosting vendor to wire up. It's a fit for REST and GraphQL APIs, full-stack apps, streaming and gRPC, and the long-running, stateful AI agents that keep connections open and hold in-process caches — "self-hosting, without the painful parts".
With Prisma ORM for type-safe data access, Prisma Postgres for the managed database, and now Prisma Compute for hosting, the whole stack lives in one place. Read the full story in the Prisma Compute blog series.
Enterprise support
Thousands of teams use Prisma and many of them already tap into our Enterprise & Agency Support Program for hands-on help with everything from schema integrations and performance tuning to security and compliance.
With this program you also get priority issue triage and bug fixes, expert scalability advice, and custom training so that your Prisma-powered apps stay rock-solid at any scale. Learn more or join: https://prisma.io/enterprise.
prisma/prisma (@prisma/client)
v7.9.0Compare Source
eslint/eslint (eslint)
v10.7.0Compare Source
Features
cf2a9bffeat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)f8b873afeat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)557fde8feat: support computedNumber.parseIntmember access inradixrule (#21041) (Pixel)0b4a73bfeat: add suggestions to no-compare-neg-zero (#21034) (den$)96cdd42feat: report invalid signed numeric radix values inradixrule (#21030) (Pixel)Bug Fixes
3e7bf15fix: applyignoreClassesWithImplementsto class expressions (#21069) (Pixel)0d7d70cfix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)75ec753fix: handle static template literals ineqeqeqrule (#21058) (Pixel)b717a22fix: preventeqeqeqnull option from reporting non-equality operators (#21057) (Pixel)e35b05ffix: avoidno-invalid-regexpfalse positive for shadowed RegExp (#21051) (Pixel)a3172b6fix: avoidno-control-regexfalse positive for shadowed RegExp (#21050) (Pixel)d1f637efix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)8859baffix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)a9e5961fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)8a240a7fix: avoid false positives inradixrule for spread arguments (#21044) (Pixel)Documentation
c30d808docs: Update README (GitHub Actions Bot)5139800docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)04174cbdocs: Update README (GitHub Actions Bot)026e130docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)9d42fefdocs: Update README (GitHub Actions Bot)b230159docs: Update README (GitHub Actions Bot)0129972docs: correct**/.jsglob to**/*.jsin config files guide (#21036) (EduardF1)Chores
9489379chore: update dependency @eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])81a4774chore: updates for v9.39.5 release (Jenkins)9835414chore: enable$ExpectTypeannotations in all TypeScript files (#21071) (Francesco Trotta)72adf6bchore: restrictmarkdownlint-cli2updates in renovate (#21067) (lumir)833ec10chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])7ea106dchore: update ecosystem plugins (#21059) (ESLint Bot)8fb550echore: add prettier update commit to.git-blame-ignore-revs(#21056) (lumir)e4e1166chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])0493f53chore: update prettier to v3.9.0 (#21054) (Pixel)1056a99chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])4d4155dci: run ecosystem tests on pull requests (#21027) (sethamus)993539fchore: update dependency @eslint/json to ^2.0.1 (#21042) (renovate[bot])53f8b69test: add error locations tono-constant-binary-expression(#21039) (lumir)5ab71d5refactor: clean up radix rule internals (#21015) (Pixel)a80a9a4chore: update ecosystem plugins (#21035) (ESLint Bot)7c9a029ci: add Node.js 26 to CI (#20847) (lumir)honojs/hono (hono)
v4.12.31Compare Source
v4.12.30Compare Source
What's Changed
Full Changelog: honojs/hono@v4.12.29...v4.12.30
v4.12.29Compare Source
What's Changed
compatibilityDateby @yusukebe in #5100*as a match by @yusukebe in #5084New Contributors
Full Changelog: honojs/hono@v4.12.28...v4.12.29
inversify/monorepo (inversify)
v8.2.1Compare Source
Patch Changes
jitlesscontainer option, avoidingFunctionconstructor usage in CSP-restricted environments.v8.2.0Compare Source
Minor Changes
ContainerOptionswith optionaljitless(default true).Patch Changes
v8.1.3Compare Source
Patch Changes
transientscoped resolution performance forcing inlined v8 constructor calls.webpro-nl/knip (knip)
v6.27.0: Release 6.27.0Compare Source
98191a0)53d1fec)33e9799)d9508c2)5fd863b)bd63cd8)91de938)b5a3176)4267675)1d2cdff)2157f39)a627f53)989292f)5e9a7f0)f682327)c273d5f)57a4770)1b0a2c0)605c904)d05e775)18f0bff)e52aecf)a63e927)a521cf7)b597de9)c059c2b)v6.26.0: Release 6.26.0Compare Source
4249935) - thanks @trueberryless!1da09fd)39125a7)aed361c)3b4d58c)d92107e)ef3b601)8292981)#-imports to source when node condition is unbuilt (resolve #1873) (f2713ed)a6f0772)5742913)7301075)5e6f82b)009aad8)f638c83)9396ab1)3ceee89)9bc1754)45dea0a)e1249ad)a45941d)43aecd5)589ffda)f041c19)8fa7b11)4254f7d)dfb9acb)d533da8)b99702a)aab080b)5dea975)c84bb7a)620079d)b5231c1)fc1ba0f)f256a5b) - thanks @trueberryless!6b8454a)606e5d0)199180d)1974533)a220729)lint-staged/lint-staged (lint-staged)
v17.1.0Compare Source
Minor Changes
#1816
7568d4f- The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to removeListr2, a very large dependency.Before:
Size of
node_modules/after installing:1561.7 kBwith 29 packages.Fancy interactive spinners, but output dynamically changes:
After:
Size of
node_modules/after installing:974.0 kBwith 5 packages (37.6 % smaller, 82.7 % less transitive dependencies).Simpler but more explicit output:
Patch Changes
#1816
c19079d- Try to restore hidden unstaged changes when using--no-revert.#1818
efb23a2- Console output colors are enabled/disabled more consistently.#1818
26112a1- Failed JS function tasks now properly kill other tasks, unless--continue-on-erroris used. Previously their failure didn't affect other tasks.pnpm/pnpm (pnpm)
v11.15.1Compare Source
v11.15.0: pnpm 11.15[Compare Source](http
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.